undertowzen wrote: Sun Nov 01, 2020 8:04 pm
Hey so just reporting back.
First off found out a few things regarding the MTU I reported on earlier, the Sierra modems lock down the MTU of the hardware to 1430 so you will in fact have issues if you specify an MTU over 1430 - meaning you should populate 1430 all the way down the line from your modem to you client devices where you have the ability to change it manually. The MTU should get reported and hopefully automatically adopted by many devices once its set at the router but this doesn't always happen.
Secondly - continuing with the MTU - MSS clamping is required to really make sure things are sync'd together end to end, in the MOFI interface you'll find the option to enable this on the network screens on other routers you'll find it in either firewall settings or you may have to enable it via a script. On devices where you can modify the IPTables directly you can set the below config against your wan and lan interfaces, just copy paste and replace the section <wwan0> with whatever your interface name is without the < >. You'll have three entries minimum here one for lan and one for wan and the generic blanket rule - but experiment if you have additional configurations.
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o <wwan0> -j TCPMSS --clamp-mss-to-pmtu
I've also applied this blanket clamp rule which applies as a whole
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
Thirdly, I got away from the Mofi and onto a USB enclosure connected to a router running Golden Orb Rooter firmware. My settings here are as above when it comes to MTU and as well I've always forced DNS of 1.1.1.1/1.0.0.1 or 8.8.8.8/8.8.4.4 on my interfaces, I've also enabled QOS on Golden Orb against the wwan interface using the 0 up 0 down Cake SQM I specified in a previous post. I have TTL set to 64 instead of 65 however you may have better experience on one or the other. I'm happy to report that not only do I still have no disconnects, my once a day slow downs are gone and I have 10ms lower pings AND my download speed increased from 65Mbits to 100Mbits down - my Upload however remained the same at 17Mbits.
If anyone is curious I am on AT&T Sim through UBIFI I've had the service with them since December 2019. I am band locked to band 2 and 12 for aggregation.
I am still rebooting all my routers and the modem once a day as standard practice.
Lastly, I'm sure many of you may know but the reason why the VPN is fixing a lot of problems is because it sets itself up behind its own network with its own settings which don't necessarily interact directly with your hardware in the same way a standard network would hence why it isn't having the same problems as running without it. However I do run a VPN on one of my Merlin WRT routers for online gaming and below is my additional / custom config I've found that works best for binding the VPN to the routers/modem MTU and speeds. This gives me the highest throughput and the lowest latency for my games and downloads through my VPN client. You may want to play around with the settings.
remote-cert-tls server
resolv-retry infinite
remote-random
nobind
tun-mtu-extra 0
mssfix 1303
tun-mtu 1428
persist-key
persist-tun
ping 15
ping-restart 0
ping-timer-rem
reneg-sec 0
remote-cert-tls server
nice -30
Anyways just thought I'd pass this all along in case it helps anyone out. Good luck to everyone.
Undertowzen:
Thanks for all this great work. I have a few question to complete the setup. I am using a WG1608 router with a EM20 modem and GoldenOrb. This connects directly to my Unifi USG and my home network including Unifi access points I do not use the wifi on the wg1608.
1. Set TTL to 65 - under Network-Firewall-Custom TTL settings
2. I have set the SQM QOS on wwan0 (wan1) to cake and piece of cake.
3. I tested my MTU and its 1402 which means I set it to 1430 as in your case.
4. Under Interfaces I set the following two interface MTU under Interface-(Select Interface)-Advanced Settings
- LAN (br-lan) -set override to 1430
- WAN1 (wwan0) - set override to 1430
Three additional question:
1. Do I need to change the MTU to 1430 on my Unifi USG
2. For MSS clamping I need to add the following 3 rules. Do I add these under Network-Firewall-custom Rules and are they correct?
- iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o <wwan0> -j TCPMSS --clamp-mss-to-pmtu
- iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o <br-lan> -j TCPMSS --clamp-mss-to-pmtu
- iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
3. Do I need to add any rules to the Unifi USG?
Thanks again for all your help. I will get back to you after I test it out and see it all works.