rich1.0lnemail wrotelnemail (npub1rk…uxk76)https://nostr.now/npub1rkh3y6j0a64xyv5f89mpeh8ah68a9jcmjv5mwppc9kr4w9dplg9qpuxk76njumphttps://nostr.nownostr:nprofile1qy88wumn8ghj7mn0wvhxcmmv9uq32amnwvaz7tmwdaehgu3wdau8gu3wv3jhvtcqyr7dsxz9gqp2d3r6nqpe8uz5ntrwv2wj34tgsy2tkcxcxx6urqe2wkx04za there's a networking issue affecting LNVPS instances that's blocking connectivity to several external hosts.
Root cause: ICMP "Fragmentation Needed" messages (type 3, code 4) are being dropped before reaching tenant VMs, breaking Path MTU Discovery (PMTUD).
Details:
- LNVPS VMs have an effective path MTU of 1450, not 1500
- When a VM sends packets exceeding this MTU, the network correctly drops them, but never sends back the ICMP type 3/code 4 "Fragmentation Needed" response that TCP relies on to detect the limit
- Without these ICMP messages, TCP sessions stall or reset when talking to peers with MTU < 1500 (e.g. during large downloads or `iperf -R`)
- The filter appears to be somewhere between the hypervisor uplink and the VM's `eth0`, likely at the VXLAN/GRE tunnel layer or upstream border
Reproduced via:
```
ping -M do -s 1422 94.156.119.69 → 4/4 received (within MTU)
ping -M do -s 1423 94.156.119.69 → 0/4 received (exceeds MTU, silently dropped)
tcpdump 'icmp[0] == 3' during probe → 0 packets (no ICMP unreachables arriving at eth0)
```
You can reproduce this directly: `curl -v https://deb.debian.org/debian/extrafiles` from any LNVPS machine will stall. `apt` on Debian is broken for the same reason.
Fix (either of):
1. Allow ICMP type 3 code 4 through to tenant VMs
2. Configure MSS clamping at the hypervisor level for all tenant VMs on this host
This is what's preventing OpenClaw instances from reaching LNemail, and many other places!