Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MTU is wrong when enabling Wireguard for Multicluster #5914

Closed
tnqn opened this issue Jan 24, 2024 · 1 comment · Fixed by #5880
Closed

MTU is wrong when enabling Wireguard for Multicluster #5914

tnqn opened this issue Jan 24, 2024 · 1 comment · Fixed by #5880
Assignees
Labels
area/multi-cluster Issues or PRs related to multi cluster. area/transit/encryption Issues or PRs related to transit encryption (IPSec, SSL). kind/bug Categorizes issue or PR as related to a bug.

Comments

@tnqn
Copy link
Member

tnqn commented Jan 24, 2024

Describe the bug

While fixing #5868, @hjiajing and I tested more scenarios and found the issue: when enabling Wireguard for Multicluster, the MTU of all Pod interfaces and wireguard interface were reduced 130 bytes (50 for geneve + 80 for wireguard), however, cross-cluster traffic sent from Pods were not forwarded by wireguard interface.

This is because traffic originated from Pods will be encapsulated on gateway Node, and it's the encapsulated packet which will be encrypted. If the wireguard interface is set with the same MTU as the Pod interface, the encapsulated packet will exceed wireguard interface's MTU.

Versions:

  • Antrea version (Docker image tag). 1.14.1 and before
@tnqn tnqn added the kind/bug Categorizes issue or PR as related to a bug. label Jan 24, 2024
@tnqn
Copy link
Member Author

tnqn commented Jan 24, 2024

#5880 will fix this.

cc @luolanzone

@tnqn tnqn added area/transit/encryption Issues or PRs related to transit encryption (IPSec, SSL). area/multi-cluster Issues or PRs related to multi cluster. labels Jan 24, 2024
@tnqn tnqn self-assigned this Jan 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/multi-cluster Issues or PRs related to multi cluster. area/transit/encryption Issues or PRs related to transit encryption (IPSec, SSL). kind/bug Categorizes issue or PR as related to a bug.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant