From 0e2289a2a88a5a36c9e04a5edf76941ee755888b Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 22 Aug 2026 23:50:00 -0500 Subject: [PATCH] fix(vpn): valid OpenVPN flags only (--hand-window 120; --tls-mtu invalid in 2.6) OpenVPN 2.6.16 rejects --tls-mtu (not a real option) and PIA doesn't support --fragment, so control-channel packets can't be shrunk. Keep --hand-window 120 to give the RSA-4096 handshake more time over a lossy/marginal path, plus tun-mtu 1300. Co-Authored-By: Claude Opus 4.8 --- platform/vpn-egress/gluetun-gateway.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml index c8f8260..49291fe 100644 --- a/platform/vpn-egress/gluetun-gateway.yaml +++ b/platform/vpn-egress/gluetun-gateway.yaml @@ -70,9 +70,9 @@ spec: - name: OPENVPN_MSSFIX value: "1300" # clamp TCP-in-tunnel to match - name: OPENVPN_FLAGS - value: "--tls-mtu 1200 --hand-window 120" # shrink the CONTROL-channel packets (RSA-4096 strong - # preset handshake) so they fit reliably under 1450, and give the - # handshake longer than the default 60s to complete over a lossy path. + value: "--hand-window 120" # OpenVPN 2.6 has no control-channel MTU option (--tls-mtu is + # invalid) and PIA doesn't support --fragment; so just give the + # RSA-4096 handshake 120s (vs 60s default) to complete over loss. # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env): - name: OPENVPN_USER valueFrom: