Packet fragmentation error, what could it be?

Question

linux

Hello!
I ran into such a problem, I have an ipip tunnel that has been thrown, and very often I get such an error in syslog
icmp: xx.xx.xx.xx: fragmentation needed and DF set
and the ports that are thrown on dst ip stop responding, for example 80 and 443.
After reading about the error in Google, they say that either ping is blocked, or that then with MTU.
On the tunnel I have 1480 MTU, the provider has 1500
What could be the problem? and how to fix it?

Answer 1

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu