TTL & MTU Packet Mangling

Many cellular carriers (e.g. T-Mobile, AT&T, Verizon) differentiate between on-device smartphone data and tethered/hotspot data by inspecting the IP Time To Live (TTL) header.

QManager RM551E TTL and MTU screen — RM551E: Rewrite TTL and hop limit and set the MTU on the cellular interface.

Why Mangle TTL (Time To Live)?#

When a computer or TV connects behind a router, each router hop decrements the packet's TTL value by 1. A smartphone packet typically starts at TTL 64, while a router-forwarded packet arrives at the cell tower with TTL 63. Carriers detect this decrement and throttle speeds to 3G rates (e.g. 600 kbps).

By mangling outgoing packets, QManager locks the TTL so all outbound traffic appears identical to direct on-device smartphone traffic.

Recommended TTL & HL Values#

In Network > TTL/HL Settings:

Carrier / Scenario	IPv4 TTL	IPv6 Hop Limit (HL)	Notes
T-Mobile (USA / Magenta)	`65` or `64`	`65`	Most common value for high-speed unlimited data.
Verizon Wireless	`65`	`65`	Prevents hotspot bucket deduction.
AT&T Wireless	`64`	`64`	Standard on-device mobile value.
Custom / International	`64`–`128`	`64`–`128`	Test between 64 and 65 depending on carrier DPI.

Under the hood, QManager inserts persistent iptables / ip6tables rules:

Shell

iptables -t mangle -I POSTROUTING -o rmnet_data+ -j TTL --ttl-set 65
ip6tables -t mangle -I POSTROUTING -o rmnet_data+ -j HL --hl-set 65

Under the Hood: OpenWRT lanUtils vs SDXLEMUR simplefirewall#

Maintaining TTL and Hop Limit mangling across cellular radio cycles requires hook integration into modem OS network events:

1. OpenWRT & RM551E: `/etc/data/lanUtils.sh` Hooks#

On the RM551E running custom on-modem OpenWRT, carrier network resets or baseband toggles trigger /etc/data/lanUtils.sh. Upstream analysis by Cameron Thompson identified the internal function util_combine_iptable_rules, which reassembles firewall chains on interface renewal. QManager hooks into this initialization pipeline to inject:

/etc/firewall.user.ttl
/etc/firewall.user.mtu directly into the mangle table postrouting chain, guaranteeing that TTL rules survive baseband restarts without being flushed by netifd.

2. SDXLEMUR Linux & RM520N: Systemd `simplefirewall`#

On native Qualcomm SDXLEMUR Linux (RM520N-GL), standard OpenWRT network scripts do not exist. Instead, persistence is managed by:

simplefirewall.service: Supervised systemd unit executing /usr/bin/simplefirewall.sh.
Reads persistent configuration from /usrdata/simplefirewall/ttl-override and /usrdata/simplefirewall/hl-override.
Applies iptables mangle rules dynamically to all active rmnet_data+ cellular endpoints and eth0 bridge interfaces upon link carrier acquisition.

MTU Clamping for Cellular Interfaces#

Cellular encapsulation (GTP tunnels) adds packet overhead. Setting an MTU that is too large causes packet fragmentation and sluggish web browsing.

QManager automatically applies optimal MTU Clamping (default: 1420 or 1440 for cellular WAN) to eliminate packet loss and TLS handshake timeouts.

Screens in QManager#

QManager RM520N TTL and MTU screen — RM520N: TTL & MTU rewrites the hop count and sets the packet size on the cellular interface.