ipsec site to site issue

I tried searching for this issue and couldn’t really find anything, please forgive me if this a know problem with a simple solution.

I set up a ipsec site to site similar to:

http://wiki.mikrotik.com/wiki/Routing_through_remote_network_over_IPsec

all seemed to be well and good, I could ping the remote servers I can connect to the remote mikrotik, but when I ssh into a remote server, I can move around fine cd ls apt all work. when I go to edit a file or run top the connection freezes, it doesn’t drop doesn’t do anything, I can create a new connection and kill the hung process and regain control of that terminal. but if the action is repeated the result is also.

I have a rb2011UiAS-2HnD-IN and a rb1100AHx2

I am not sure what specifically what info would be useful to diagnose, but please inform me and I would be more than happy to provide it.

I’m going to try and clear up my rambling, I’ve followed this manual entry

http://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Site_to_Site_IpSec_Tunnel

set up consists of;

SiteA
1.1.1.1 - Wan
192.168.0.0/24 - Lan

SiteB
1.1.1.2 - Wan
172.16.0.0/24 - Lan

it seems the tunnel is created properly, I can ping and connect to everything both ways. but once I ssh into a machine and run top or try to modify a file (vi, nano, emacs, cat) the session freezes until it times out and drops. Use of cd, ls, uptime show no issues. I can post my filter rules and nat rules. Thank you in advance any help is greatly appreciated.

anyone?

to clarify, I followed the manual

http://wiki.mikrotik.com/wiki/Manual:IP/IPsec#Site_to_Site_IpSec_Tunnel

almost vervatim;

siteA

WAN: 1.1.1.1
LAN: 192.168.0.1/24

siteB

WAN: 1.1.1.2
LAN: 172.16.0.1/24

I can see all the machines from both sides and I can connect to them with ssh, but one I do anything that uses any measurable bandwidth the connection freezes. if I forward port 22 for ssh and connect that way there is no such issues.

I’ve been using the Mikrotik for quite a few years now and have ALWAYS had the problem you describe. I have talked with experts with the Mikrotik and never could get them to understand the problem. From their perspective, “why would anyone use SSH to connect to a device through an IPSEC tunnel?” The experts think a person would always use telnet over an IPSEC tunnel. And if all you are connecting to is hardware (e.g., switches, routers, etc.) telnet will work well for you.

But for those of us that have to connect to servers running a flavor of Linux, SSH is the common approach. A person ALWAYS uses SSH to login to a server when they are on a local network with the server (i.e., not through an IPSEC tunnel). But when you are no longer local to the network, the IPSEC tunnels created by the Mikrotik ALWAYS mess up at varying points in the connection. This is an extremely frustrating issue with Mikrotik. And as I alluded to in the beginning, I have seen this for quite a few years now dating back to the 5.x releases.

If only the people at Mikrotik found it as frustrating.

Have you ever tried to set mangle rules to reduce TCP MSS?

it is a TCP MSS issue.
you have two possibilites to fix this:

  • mangle rules at one end of the tunnel to set MSS back to ~1400 or so.

  • forget IPSec Tunnel mode (sucks anyway), use GRE/IPIP/EOIP between the two sites with the new ipsec-secret option and clamp-mss=yes. in this case you can run an ordinary routing protocol over the tunnel, like OSPF or BGP, and have much better control over everything. not to mention tunnel keepalives which then indicate whether the tunnel is up or not - it’s great for redundancy.

in case you are using older ROS w/o tunnel encryption support, or you need certificate authentication, you can build the same tunnel, and set up IPSEC ESP transport mode with the tunnel source and destination. (which normally happens automatically when used with tunnels + ipsec-secret)

Thank you, for the insight and recommendations, I’ll try to implement the changes and report back.

An interesting note, I was recently at my dc setting up remote term on the servers and tested creating a ssh connection from there to my home (home being siteA and the dc being my siteB) and on that direction all works fine no drop or freeze, so that really put a spin on things, things are sometimes easier to diagnose when they are consistent haha

btw I am running ROS v6.29.1 on both devices, I’ll try the different approaches suggested and report back.

Thank you

I can happily report back with success, it was a TCP MSS issue as doneware pointed out, and the mangle rules fixed the problem, if you want to follow

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle

the very first example is how to change MSS, and once I set that at my target site (siteB) I have no more freezing ssh connection. As it was also pointed out that it might be better to implement IPsec through another method I’ll probably try this in the near future, but right now it is cause to celebrate, it works!

Thank you for all the help.