11 Commits

Author	SHA1	Message	Date
Quentin McGaw	0eeee5c496	chore(pmtud): clarify debug logs and fix log error message	2026-02-25 04:23:56 +00:00
Quentin McGaw	d21953f62e	chore(firewall): split apart iptables specific code in internal/firewall/iptables	2026-02-25 04:23:53 +00:00
Quentin McGaw	ea87c0a2aa	hotfix(pmtud): lower min MTU to MSS-matching-MTU minus 100 in case MSS is very small	2026-02-19 22:39:24 +00:00
Quentin McGaw	007c5159f4	hotfix(pmtud): increase TCP margin from 150 to 300 compared to ICMP found MTU	2026-02-19 17:24:06 +00:00
Quentin McGaw	8d86470905	feat(pmtud/tcp): use the TCP server with highest MSS to run MTU tests	2026-02-19 14:03:46 +00:00
Quentin McGaw	bc79901f1e	chore(pmtud/tcp): restrict temp firewall rules to source ip and source port	2026-02-19 13:20:58 +00:00
Quentin McGaw	04d7cef294	hotfix(pmtud/tcp): block kernel from racing to send RST packets ... - this makes PMTUD TCP reliable - this only works on kernels with the mark module - on kernels without the mark module, the icmp pmtud mtu found is used	2026-02-17 21:46:24 +00:00
Quentin McGaw	36dfd5b631	hotfix(pmtud): do not try every address for ICMP PMTUD	2026-02-16 23:54:38 +00:00
Quentin McGaw	be92aa2ac4	Path MTU discovery fixes and improvements (#3109) ... - Existing option `WIREGUARD_MTU` , if set, disables PMTUD and is used - New option `PMTUD_ICMP_ADDRESSES=1.1.1.1,8.8.8.8` and `PMTUD_TCP_ADDRESSES=1.1.1.1:443,8.8.8.8:443` - ICMP PMTUD now targets external-by-default IP addresses - New TCP PMTUD (binary search only) as a second MTU confirmation and fallback mechanism. - Force set TCP MSS to MTU - IP header - TCP base header - "magic 20 bytes" 🎆 - Fix #3108	2026-02-14 19:40:34 -05:00
Quentin McGaw	fe3d4a94d4	chore(all): make code compilable for other platforms than Linux	2026-01-24 17:56:10 +00:00
Quentin McGaw	de38d759a4	feat(vpn): path MTU discovery to find the best MTU (#2586)	2026-01-21 09:02:23 -08:00