Achieving an MTU of 1500 on BT FTTC

The BT FTTC service uses PPPoE as its mode of connection via the VDSL modem.

Although the default Ethernet MTU is 1500, when using PPPoE, 8 bytes are used for the PPPoE header, this then reduces the MTU to 1492.

There are some devices such as the Vodafone SureSignal (a 3G Femotocell), that have an embedded IPSec client that will not connect over a connection that has an MTU of below 1500. There are other applications such as the Cisco AnyConnect client that can also have issues with an MTU of below 1500

There is however a method to increase the MTU to 1500 which has been documented in RFC 4638. This method is to increase the MTU on the interface running the PPPoE connection to 1508 which are called “Baby Jumbo Frames”, and to then instruct the PPPoE client to use an MTU of 1500. The BT FTTC service supports this method, as do some modern Cisco routers such as the ISR 1812, this then enables you to run an MTU of 1500 over the connection.

To enable this method, there are two extra commands that you need to enable on the physical interface the you are using for PPPoE connection

The first part is to set the interface to use baby jumbo frames

mtu 1508

The second part is to set the PPPoE dialler to negotiate an MTU of 1500 as per RFC 4638

pppoe-client ppp-max-payload 1500

A complete interface config would look something along the lines of

interface FastEthernet0

description BT FTTC PPPoE
mtu 1508
no ip address
ip access-group FastEthernet0 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip virtual-reassembly in
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
pppoe-client ppp-max-payload 1500
no cdp enable

The Dialer interface does does not need to be changed, neither do any internal interfaces.

With these changes you should have an MTU of 1500 over the connection, devices and/or applications that had issues with an MTU of 1492 should no longer be affected.

Install a private root CA certificate for OpenSSL in Ubuntu 12.04

To install the root certificate into the openssl “certificate store” store it needs to be in pem (as opposed to DER) format

Copy the .pem format certificate into /etc/ssl/certs

in the directory /etc/ssl/certs run the below, where myca.pem is the root CA certificate in pem format.

ln -s myca.pem `openssl x509 -hash -noout -in myca.pem`.0

not that it is a ` not a ‘

any applications that use the openssl “certificate store” should now accept the root cert

Convert pfx to pem

Rather than use the certificate creation tools on Linux for web servers, I find it quicker and less error prone to create the certificate on Windows and then convert to pem format on the Linux server, this is particularly useful for internal certificates…

So, create the certificate on Windows and export it as a pfx file noting the password that you used

copy the pfx file onto the Linux box

create the pem

openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.pem

create the key file

openssl pkcs12 -in certificate.pfx -nocerts -nodes -out certificatekeypass.key

to enable the key file to be used without entering a password (useful for a webserver…), remove the password

openssl rsa -in certificatekeypass.key -out certificatekey.key

you can now use the certificate.pem and certificatekey.pem in the web server configuration

To use crt files instead of pem files

export the certificate

openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.crt

create the key file

openssl pkcs12 -in certificate.pfx -nocerts -nodes -out certificatekeypass.key

to enable the key file to be used without entering a password (useful for a webserver…), remove the password

openssl rsa -in certificatekeypass.key -out certificatekey.key

Building HAProxy from GIT on Ubuntu 12.04

Starting with a base install of Ubuntu 12 with openssh installed

As HAProxy will be built from source, there are some pre-reqs

sudo apt-get install build-essential libssl-dev libpopt-dev git libpcre3-dev

now get the haproxy source and build it

git clone http://git.1wt.eu/git/haproxy.git/ haproxy
cd haproxy
make TARGET=linux2628 CPU=native USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1
sudo make install

link it from /usr/local/sbin to /usr/sbin

sudo ln -s /usr/local/sbin/haproxy /usr/sbin/haproxy

Create the directory to use

sudo mkdir /usr/share/haproxy

now configure HAProxy to start automatically, create the init file as per attached file init.d.haproxy.txt

sudo nano /etc/init.d/haproxy

make it executable

sudo chmod +x /etc/init.d/haproxy

now set the runlevels

sudo update-rc.d haproxy defaults

Now create the file that enables it

sudo nano /etc/default/haproxy
# Set ENABLED to 1 if you want the init script to start haproxy.
ENABLED=1
# Add extra flags here.
#EXTRAOPTS="-de -m 16"

add a haproxy user

sudo adduser --system haproxy

copy the rest of the files into place

sudo mkdir /etc/haproxy
sudo mkdir /etc/haproxy/errors
sudo cp ~/haproxy/examples/errorfiles/* /etc/haproxy/errors

The build can be updated with

cd ~/haproxy
git pull
make clean
make TARGET=linux2628 CPU=native USE_PCRE=1 USE_OPENSSL=1 USE_ZLIB=1
sudo make install

Then restarting haproxy to use the updated version

sudo service haproxy restart