Browse Source

readme.eng: beautify

pull/98/head
bol-van 3 years ago
parent
commit
f05e39a527
  1. 4
      docs/readme.eng.md

4
docs/readme.eng.md

@ -425,14 +425,14 @@ ipv4 : Linux allows to send ipv4 fragments but standard firewall rules in OUTPUT
ipv6 : There's no way for an application to reliably send fragments without defragmentation by conntrack.
Sometimes it works, sometimes system defragments packets.
Looks like kernels <4.16 have no simple way to solve this problem. Unloading of nf_conntrack module
and its dependency nf_defrag_ipv6 helps but this severely impacts functionality.
and its dependency `nf_defrag_ipv6` helps but this severely impacts functionality.
Kernels 4.16+ exclude from defragmentation untracked packets.
See `blockcheck.sh` code for example.
Sometimes it's required to load `ip6table_raw` kernel module with parameter raw_before_defrag=1.
In openwrt module parameters are specified after module names separated by space in files located in `/etc/modules.d`.
In traditional linux check whether `iptables-legacy` or `iptables-nft` are used. If legacy create the file
In traditional linux check whether `iptables-legacy` or `iptables-nft` is used. If legacy create the file
`/etc/modprobe.d/ip6table_raw.conf` with the following content :
```
options ip6table_raw raw_before_defrag=1

Loading…
Cancel
Save