7.15. ( MTU ) - IP MASQ 似乎工作正常,但有些网站无法访问。这通常发生在 WWW 和一些 FTP 站点上。

关于您在 MASQ 服务器上运行的 Linux 内核版本,人们对真正的问题存在分歧。以下两种观点都有其道理,并且相互关联,来自不同阵营的用户至今仍在争论不休。

不过不用担心。 有几种非常好的方法可以解决这个棘手的 MTU 问题

7.15.1. 为 PPPoE 和一些 PPP 用户启用 PMTU 钳制

对于那些使用 PPPoE 客户端(DSL / 有线调制解调器)或 PPP(拨号)的用户,您的互联网连接不是“eth0”(例如),而通常是“ppp0”。 除此之外,您的互联网链路的 MTU 或最大传输单元(您可以通过互联网传输的最大数据包)不是 1500 字节,而是 1492 字节。 1492 字节的 MTU 来自以太网的链路大小(1518 字节) - 以太网 MAC 开销(18)= 1500。 然后您减去 PPPoE 标头(8 字节)== MTU 为 1492。 这种开销没什么大不了的,但有时 ISP 或远程互联网站点会做一些愚蠢的事情来破坏 PPPoE 或非 1500 字节 MTU 连接的机器。

您可以在网上找到有关此主题的更多信息。 具体来说,这是一个关于该主题的很好的演示文稿:mss-talk 演示文稿 (PDF)。 这是完整的文档和其他有用的信息

要在 RP 或 PPPd PPPoE 客户端中启用钳制,请将以下行添加到您的 /etc/ppp/pppoe.conf 文件中

  # - If you have a computer acting as a gateway for a LAN, choose "1412".
  #   The setting of 1412 is safe for either setup, but uses slightly more
  #   CPU power.
  #
  CLAMPMSS=1412
  

7.15.2. 通过 IPTABLES 钳制 MSS

如上文针对 PPPoE 用户所述,一些 ISP 和 WWW 站点会过滤关键的 ICMP 数据包,如 MTU 路径发现。 因此,许多用户可能会发现更多网站可以访问,但其他网站会挂起或工作不佳。 幸运的是,最近的 IPTABLES 添加了 PMTU 钳制支持,这应该对您有所帮助。 如果您正在使用 IPTABLES 并且认为您遇到了这个问题,请尝试将以下行添加到您的 rc.firewall-iptables* 规则集的末尾。 应该注意的是,IPCHAINS 中没有 PMTU 钳制支持。

 iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 
 

如果此行在您重新运行 rc.firewall-iptables* 防火墙规则集时导致错误,您可能需要升级您的 IPTABLES 版本,其中包含“TCPMSS”IPTABLES 模块。

7.15.3. 更改 MASQ 服务器的外部 MTU

此解决方案通常仅适用于拨号用户,因为 PPPoE 用户由于 PPPoE 的标头开销而无法增加其 MTU。

要使用此解决方案,首先请查看您的互联网链路的当前 MTU 是什么。 为此,请在 MASQ 服务器上运行“/bin/ifconfig”。 查看与您的互联网连接相对应的行,并查找 MTU(例如,ppp0)。 这需要设置为 1500。 通常,以太网链路的默认值为 1500,但串行/拨号调制解调器 PPP 链路的默认值可能为 576。

7.15.4. 更改各种操作系统的 MTU

如果您重新配置所有 MASQ 化的 PC 以使用与您的外部互联网链路的 MTU 相同的 MTU(例如,PPPoE 用户为 1492),一切都应该正常工作,并且这种方法有时是解决问题的最有效方法。 这包括上面提到的所有解决方案。 但是,如果有很多内部 MASQ 化机器,或者如果您没有对所有内部 MASQ 化机器的管理访问权限,则以这种方式做事可能会花费大量精力,甚至不可能做到。

请按照以下适用于您操作系统的简单步骤操作

以下示例使用 1492 的 MTU,用于某些 DSL 和有线调制解调器用户的典型 PPPoE 连接。 建议对所有速度为 128Kb/s 及更快的连接使用尽可能高的值。 应该注意的是,由于 ISP 内部网络中的额外开销,某些 PPPoE ISP 可能需要 1460(而不是 1492)的 MTU 设置才能实现正常连接。

使用小于 1492 或 1460 的 MTU 的唯一真正原因是降低您的互联网链路的延迟,但代价是吞吐量。 请参阅 http://www.ecst.csuchico.edu/~dranch/PPP/ppp-performance.html#mtu 以获取有关此主题的更多详细信息。

如果您知道如何对 OS/2、MacOS 等其他操作系统进行类似的更改,请发送电子邮件至 David Ranch,以便将其包含在 HOWTO 中。

7.15.4.1. 更改 Linux 上的 MTU

------------------------------------------
1. The setting of MTU can vary from Linux distribution to distribution.  

   For Redhat: You need to edit the various "ifconfig" statements in 
               the /sbin/ifup script

   For Slackware: You need to edit the various "ifconfig" statements in 
                  the /etc/rc.d/rc1.inet

2. Here is one good, any-distribution-will-work example, edit the 
   /etc/rc.d/rc.local file and put the following at the END of the file: 

        echo "Changing the MTU of ETH0"
        /sbin/ifconfig eth0 mtu 1492

     Replace "eth0" with the interface name that is the machine's upstream 
     connection which is connected to the Internet.

3. For advanced options like "TCP Receive Windows" and such, detailed examples
   on how to edit the respective networking scripts for your specific Linux
   distro, etc., please see Chapter 16 of 
   http://www.ecst.csuchico.edu/~dranch/LINUX/index-linux.html#trinityos 
------------------------------------------

7.15.4.2. 更改 MS Windows 2000 上的 MTU

------------------------------------------
1. Making ANY changes to the Registry is inheritantly risky but
   with a backup copy, you should be safe.  Proceed at your 
   OWN RISK.

2. Goto Start-->Run-->RegEdit

3. Registry-->Export Registry File-->Save a copy of your registry
   to a reliable place

4. Navigate down to the key:

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Inter
faces\<ID for Adapter>

   Each ID Adapter has default keys for DNS, TCP/IP address, Default Gateway, 
   subnet mask, etc. Find the key one that is for your network card.

5. Create the following Entry:

      type=DWORD
      name="MTU"				(Do NOT include the quotes)
      value=1492 (Decimal)      (Do NOT include the text "(Decimal)")

http://support.microsoft.com/support/kb/articles/Q120/6/42.asp?LN=EN-US&SD=gn&FR=0


 *** If you know how to also change the MSS, TCP Window Size, and the
 *** TTL parameters in NT 2000, please email dranch@trinnet.net as I 
 *** would love to add it to the HOWTO.

5. Reboot to let the changes take effect.
------------------------------------------

7.15.4.3. 更改 MS Windows NT 4.x 上的 MTU

------------------------------------------
1. Making ANY changes to the Registry is inheritantly risky but
   with a backup copy, you should be safe.  Proceed at your 
   OWN RISK.

2. Goto Start-->Run-->RegEdit

3. Registry-->Export Registry File-->Save a copy of your registry
   to a reliable place

4. Create the following keys in the Registry trees, choose two
   possible Registry trees.  Multiple entries are for various 
   network devices like DialUp Networking (ppp), Ethernet NICs, 
   PPTP VPNs, etc.

   http://support.microsoft.com/support/kb/articles/Q102/9/73.asp?LN=EN-US&SD=gn&FR=0


   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Parameters\Tcpip]
                     and
   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<Adapter-name>\Parameters\Tcpip]

      Replace "<Adapter-Name>" with the respective name of your uplink LAN NIC 
      interface

         type=DWORD
         name="MTU"              (Do NOT include the quotes)
         value=1492 (Decimal)    (Do NOT include the text "(Decimal>")

       (Do NOT include the quotes)


 *** If you know how to also change the MSS, TCP Window Size, and the
 *** TTL parameters in NT 4.x, please email dranch@trinnet.net as I 
 *** would love to add it to the HOWTO.

5. Reboot to make the changes take effect.
------------------------------------------

7.15.4.4. 更改 MS Windows 98 上的 MTU

------------------------------------------
1. Making ANY changes to the Registry is inheritantly risky but
   with a backup copy, you should be safe.  Proceed at your OWN RISK.

2. Goto Start-->Run-->RegEdit

3. You should make a backup copy of your Registry before doing anything.  To
   do this, copy the "user.dat" and "system.dat" files from the \WINDOWS 
   directory and put them into a safe place.  It should be noted that the
   previously mentioned method of using "Regedit: Registry-->Export Registry 
   File-->Save a copy of your registry" would only perform Registry MERGES 
   and NOT do a replacement.

4. Search though each of the Registry trees that end in "n" (e.g. 0007) 
   and have a Registry entry called "IPAddress" which has the IP address
   of your NIC.  Under that key, add the following:

   From http://support.microsoft.com/support/kb/articles/q158/4/74.asp

     [Hkey_Local_Machine\System\CurrentControlset\Services\Class\NetTrans\000n]
         type=STRING
         name="MaxMTU"            (Do NOT include the quotes)
         value=1492 (Decimal)     (Do NOT include the text "(Decimal)")


5. You can also change the "TCP Receive Window" which sometimes
   increases network performance SUBSTANTIALLY.  If you notice your
   throughput has DECREASED, put these items BACK to their original 
   settings and reboot.

     [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP]

        type=STRING
        name="DefaultRcvWindow"    (Do NOT include the quotes)
        value=32768 (Decimal)      (Do NOT include the text "(Decimal>")

        type=STRING
        name="DefaultTTL"          (Do NOT include the quotes)
        value=128 (Decimal)        (Do NOT include the text "(Decimal>")


6. Reboot to let the changes take effect.
------------------------------------------

7.15.4.5. 更改 MS Windows 95 上的 MTU

------------------------------------------
1. Making ANY changes to the Registry is inheritantly risky but
   with a backup copy, you should be safe.  Proceed at your OWN RISK.

2. Goto Start-->Run-->RegEdit

3. You should make a backup copy of your Registry before continuing.  To
   do this, copy the "user.dat" and "system.dat" files from the \WINDOWS 
   directory and put them into a safe place.  It should be noted that the
   previously mentioned method of using "Regedit: Registry-->Export Registry 
   File-->Save a copy of your registry" would only do Registry MERGES and NOT 
   do a replacement.

4. Search through each of the Registry trees that end in "n" (e.g. 0007) 
   and have a Registry entry called "IPAddress", which has the IP address
   of your NIC.  Under that key, add the following:

   From http://support.microsoft.com/support/kb/articles/q158/4/74.asp

     [Hkey_Local_Machine\System\CurrentControlset\Services\Class\NetTrans\000n]

         type=DWORD
         name="MaxMTU"           (Do NOT include the quotes)
         value=1492 (Decimal)    (Do NOT include the text "(Decimal)")

         type=DWORD
         name="MaxMSS"           (Do NOT include the quotes)
         value=1450 (Decimal)    (Do NOT include the text "(Decimal>")


5. You can also change the "TCP Receive Window" which sometimes
   increases network performance SUBSTANTIALLY.  If you notice your
   throughput has DECREASED, put these items BACK to their original 
   settings and reboot.

     [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP]
        type=DWORD
        name="DefaultRcvWindow"   (Do NOT include the quotes)
        value=32768 (Decimal)     (Do NOT include the text "(Decimal>")

        type=DWORD
        name="DefaultTTL"         (Do NOT include the quotes)
        value=128 (Decimal)       (Do NOT include the text "(Decimal>")


6. Reboot to let the changes take effect.
------------------------------------------