Winpkflt Rebind

[feller]

Hi!
I use c++ rebind example and winpkflt to to redirect traffic from ehternet adapter to wireguard adapter. Just install winpkflt, build rebind example and run. Have constantly issue with loading sites in Chrome and Firefox – tooo slow loading or timeout errors. Wireshark shows many packets retransmission and out-of-order. Is it known issue or am I doing something wrong? If anyone else faced such issues, what is solutions?

Thanks!

[Vadim Smirnov]

The Ethernet connection likely has a larger MTU than the WireGuard adapter. To address this discrepancy, you need to clamp the Maximum Segment Size (MSS) for TCP connections.

[feller]

Vadim thank you for response! Do I heed to do MSS on the server or with help of the MTU on the client and server WireGuard adapters? As I understand MSS clamping depends on the adapters MTU as well as can be set directly on the WireGuard server?

[feller]

Since when I set ethernet adapter mtu and wireguard adapter mtu on the client to 1380 as well as eth0 mtu and wg0 mtu on the server to 1380 it doesn’t solve situation, sites are still loaded too slowly and with timeout errors

[Vadim Smirnov]

I would apply MSS clamping when relaying the TCP SYN packet from the Ethernet to the WireGuard interface. If issues persist despite the MSS clamping, I recommend recording the processed traffic (see the capture example) and analyzing it in Wireshark

[feller]

Vadim, do you mean I have to modify rebind c++ example to parse TCP SYN packet and modify MSS value in such packet before rout it to WireGuard adapter? If so I am not sure how it can help, since packets fragmentation happens on TCP/IP level and I guess that WireGuard adapter expects already packets with size <= (WireGuard MTU – encryption overhead), maybe I am wrong here… I just want to avoid IP fragmentation when packets are redirected from Ethernet adapter to Wireguard and vice versa, and I guess that it case is already implemented in the rebind c++ example

Again, thank you very much for your help, it is really appreciated!

[Vadim Smirnov]

Yes, that’s exactly what I mean. This technique is implemented in the WireSock VPN Client’s Transparent mode to ensure that packets sent by the TCP stack fit within 1420 bytes.

[Author]

Posts