I have a network topological graph like this:
Local box GateWay box
+---------------+ +--------------------------+
|192.168.1.200 | -> |192.168.1.2 10.2.10.2 |
+---------------+ +--------------------------+
|
|GRE tunnel over pppoe
|
v
+----------------+ +--------------------------+
| The Internet | <-- |54.179.141.101 10.2.10.1 |
+----------------+ +--------------------------+
Remote "proxy" box
And the gateway box
's ppoe has a mtu of 1468 as well as the tun0
tunnel(which is a gre tunnel).
The problem is when it's plaint http request, things works just fine. But when it comes to https, some site like https://www.gravatar.com/avatar/8bd68135185d99a58252795422d21bb9?s=24&d=identicon&r=PG . The https connection can't be established. And output with curl got stuck on this:
curl -v "https://www.gravatar.com/avatar/8bd68135185d99a58252795422d21bb9?s=24&d=identicon&r=PG"
* Hostname was NOT found in DNS cache
* Trying 68.232.44.121...
* Connected to www.gravatar.com (68.232.44.121) port 443 (#0)
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
It stuck there only wait for a timing out. But I can do the same request, successfully on the Remote "proxy" box
. So I'm presuming there is something wrong with the gre tunnel (or even the iptable rules I wrote?)
So I get wireshark and capture the package on GateWay box
and the result is:
It shows there is segment missing with the ssl handshake.
For more additional info, the iptables rule is as this:
On GateWay box
*nat
:PREROUTING ACCEPT [61416:4763478]
:INPUT ACCEPT [19674:1619565]
:OUTPUT ACCEPT [18416:1183854]
:POSTROUTING ACCEPT [3:144]
-A POSTROUTING -o ppp0 -j MASQUERADE
-A POSTROUTING -o tun0 -j MASQUERADE #<- this is a gre tunnel and the route for this request
-A POSTROUTING -o tun1 -j MASQUERADE
On the Proxy Box
*nat
:PREROUTING ACCEPT [3997:794751]
:INPUT ACCEPT [297:43841]
:OUTPUT ACCEPT [612:44944]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
I googled it and some guys said it may be some thing to do with the MTU, But how can I diagnose this issue furthermore?