0

Sophos Firewall XG when connected to OpenVPN 2.3.8 (i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [IPv6] built on Jul 3 2017)

client
dev tun
proto tcp
verify-x509-name "OU=Domain Control Validated, CN=*.domain.com"
route remote_host 255.255.255.255 net_gateway
resolv-retry infinite
nobind
persist-key
persist-tun
<ca>
Bag Attributes: <No Attributes>
subject=/C=BE/O=GlobalSign nv-sa/CN=XXXSSL CA - SHA256 - G2
issuer=/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
</key>
auth-user-pass pass.txt
cipher AES-128-CBC
auth SHA256
comp-lzo no
route-delay 4
verb 3
reneg-sec 86400

remote xxx.xx.xxx.xx 8443
remote xxx.xx.xxx.xx 8443
remote xxx.xx.xxx.xx 8443
remote xxx.xxx.xxx.xx 8443
remote xxx.xxx.xxx.xx 8443

So by adding below config does it make any difference

cipher none
#;cipher AES-128-CBC
ncp-disable
sndbuf 0
rcvbuf 0
push "sndbuf 393216"
push "rcvbuf 393216"
tun-mtu 8192
fragment 0
mssfix 0 #1360
txqueuelen 4000
remote-cert-tls server
verify-x509-name server_IzA1QdFzHLRFfEoQ name
auth-nocache
setenv opt block-outside-dns # Prevent Windows 10 DNS leak

Checking MTU

netsh int ipv4 show int

Enabling Jumbo frames

netsh interface ipv4 show subinterface
netsh interface ipv4 set subinterface “TheNameOfYourInterface” mtu=8192 store=persistent
Get-NetAdapterAdvancedProperty "TheNameOfYourInterface" -DisplayName "Jumbo*" | Set-NetAdapterAdvancedProperty -RegistryValue "8192"

Verifying

ping `-f -l 8192 [host IP]`
  • I would suggest not raising your MTU so high. You're opening yourself up to more retransmits than you probably want to deal with, given the nature of the internet and how there are no guarantees with packet flow. – Jesse P. Mar 25 at 18:05
  • MTU on the physical interface is 1500, so your saying it is better to set OpenVPN TUN MTU to a value lower than the real MTU (i.e.,tun-mtu 1400), and MSSFIX to MTU-40 (i.e., mssfix 1360) @JesseP. – Nɪsʜᴀɴᴛʜ ॐ Mar 25 at 18:43
  • You have to find the balance. Too high of an MTU means more data per packet, which means more of a chance something will be corrupted and the whole packet will need to be retransmitted, meaning overall slowdowns. Too low of an MTU means too many packets, which can be bad for other reasons. – Jesse P. Mar 25 at 21:00
  • In some guides and on some troubleshooting forums you'll see many people suggest lowering the MTU to something like 1300. – Jesse P. Mar 25 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.