From b859e526973c6ca554b21a8747df9af0bb7c560b Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sat, 22 Aug 2026 23:46:36 -0500 Subject: [PATCH] tune(vpn): shrink OpenVPN control-channel MTU + widen handshake window RSA-4096 strong-preset handshake is marginal over the pod's 1450 MTU (Cilium VXLAN). Lower tun-mtu to 1300 and add --tls-mtu 1200 (smaller control packets) + --hand-window 120 (more time to complete the handshake over a lossy path). Empirical test of the MTU-tuning path (operator's choice over Cilium native routing). Co-Authored-By: Claude Opus 4.8 --- platform/vpn-egress/gluetun-gateway.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/platform/vpn-egress/gluetun-gateway.yaml b/platform/vpn-egress/gluetun-gateway.yaml index 4f47db1..c8f8260 100644 --- a/platform/vpn-egress/gluetun-gateway.yaml +++ b/platform/vpn-egress/gluetun-gateway.yaml @@ -66,9 +66,13 @@ spec: # DATA-channel packets fit (the handshake is small so this wasn't the connect blocker, but the # data channel needs it). Hardcoded strings (int-coercion gotcha). See DECISIONS-LOG. - name: OPENVPN_MTU - value: "1350" + value: "1300" # tun-mtu: extra margin under the 1450 pod MTU (data channel) - name: OPENVPN_MSSFIX - value: "1350" + value: "1300" # clamp TCP-in-tunnel to match + - name: OPENVPN_FLAGS + value: "--tls-mtu 1200 --hand-window 120" # shrink the CONTROL-channel packets (RSA-4096 strong + # preset handshake) so they fit reliably under 1450, and give the + # handshake longer than the default 60s to complete over a lossy path. # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env): - name: OPENVPN_USER valueFrom: