From 5a7b068b67bfe623f6bc1a62dcddfca2535c3a46 Mon Sep 17 00:00:00 2001 From: yyamashita Date: Wed, 1 Jul 2026 13:24:22 +0900 Subject: Fix IKE fragmentation: use fragmentation=no instead of fragment_size=0 fragment_size=0 was interpreted as minimum fragment size (resulting in 4 tiny fragments), not disabled. fragmentation=no in swanctl.conf is the correct per-connection setting to disable IKE fragmentation entirely. The server now sends a single large UDP packet; the OS kernel handles IP fragmentation instead of the IKE layer. Co-Authored-By: Claude Sonnet 4.6 --- vpn/strongswan.conf | 1 - vpn/swanctl.conf.tpl | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/vpn/strongswan.conf b/vpn/strongswan.conf index e2543a5..eeed46c 100644 --- a/vpn/strongswan.conf +++ b/vpn/strongswan.conf @@ -12,6 +12,5 @@ charon { } } send_vendor_id = no - fragment_size = 0 } include strongswan.d/*.conf diff --git a/vpn/swanctl.conf.tpl b/vpn/swanctl.conf.tpl index da988e0..1fc84df 100644 --- a/vpn/swanctl.conf.tpl +++ b/vpn/swanctl.conf.tpl @@ -1,6 +1,7 @@ connections { ikev2-eap { version = 2 + fragmentation = no # iOS/macOS/Android 互換の暗号スイート proposals = aes256gcm16-prfsha256-ecp256,aes256-sha256-ecp256,aes256gcm16-prfsha384-ecp384,aes256-sha256-modp2048,aes256-sha1-modp2048 -- cgit v1.2.3