Re: value of /proc/sys/net/ipv4/ip_always_defrag changing due to masquerade traffic

[Olaf Titz]

> Thanks to the information provided by Julian Anastasov the problem
> was solved by setting ip_always_defrag to a high value or simply
> wait for all ip_masq-connections to time out before setting it to 1.

The obvious solution would be to set it to 1 in the firewall
initialization script _before_ any masquerading rules are established,
unless any masq connections are active (if this script is re-run).

Olaf