From 772d032d4c902b99337dde3ea1a39509491949ef Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 22 Aug 2026 23:56:28 -0500 Subject: [PATCH] tune(vpn): --mtu-disc no so oversized handshake packets fragment (not drop) RSA-4096 strong-preset handshake is marginal over the 1450 pod MTU (Cilium VXLAN). --mtu-disc no clears DF so oversized control packets fragment through instead of being silently dropped. Last MTU-path lever (OpenVPN 2.6 has no --tls-mtu). Co-Authored-By: Claude Opus 4.8 --- platform/vpn-egress/gluetun-gateway.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml index 49291fe..f071b75 100644 --- a/platform/vpn-egress/gluetun-gateway.yaml +++ b/platform/vpn-egress/gluetun-gateway.yaml @@ -70,9 +70,9 @@ spec: - name: OPENVPN_MSSFIX value: "1300" # clamp TCP-in-tunnel to match - name: OPENVPN_FLAGS - value: "--hand-window 120" # OpenVPN 2.6 has no control-channel MTU option (--tls-mtu is - # invalid) and PIA doesn't support --fragment; so just give the - # RSA-4096 handshake 120s (vs 60s default) to complete over loss. + value: "--hand-window 120 --mtu-disc no" # --mtu-disc no clears the DF bit so oversized RSA-4096 + # handshake packets FRAGMENT through the 1450 pod MTU instead of being + # silently dropped; --hand-window 120 gives the handshake more time. # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env): - name: OPENVPN_USER valueFrom: