system/2162: ppp mssfixup does not work on pf nat

[Chris Pockele <chrisp@belgacom.net>]

>Number:         2162
>Category:       system
>Synopsis:       ppp mssfixup does not work on pf nat
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Nov  1 10:30:01 MST 2001
>Last-Modified:
>Originator:     
>Organization:
http://www.BSDaemon.be/
>Release:        OpenBSD 3.0
>Environment:
        
        System      : OpenBSD 3.0
        Architecture: OpenBSD.i386
        Machine     : i386
>Description:
        
I'm using OpenBSD 3.0 as a NAT gateway to connect an local
network to the internet using an ADSL (PPPoE) connection.
The file /etc/ppp/ppp.conf contains a line saying
 enable mssfixup (as the tun0's mtu is 1492).
When using pf to take care of the NAT'ing, some web/ftp
sites are not reachable from machines inside the local
network.  However, it does work when setting that machine's
mtu to 1492.
So the mssfixup option does not seem to have any effect on
packets NAT'ed by pf.
When using ppp's "nat enable yes" option instead of pf,
everything works just fine.
 
>How-To-Repeat:
        Connect an OpenBSD 3.0 box to an ADSL modem on one NIC, a local
        network on another.  Use PPPoE to bring up the adsl connection
        (http://www.bsdaemon.be/sections.php?op=viewarticle&artid=10 for
        a sample config file).  Use pf to take care of NAT (e.g.
        nat on tun0 from 192.168.0.1/24 to any -> my.ip.address).
        Visiting some sites from machines in the local network (running
        BSD) will not work correctly if their mtu is set to 1500
        (e.g. try http://www.NetBSD.org/), even if mssfixup is enabled
        (which should fix this issue).
>Fix:
        Using ppp's NAT option (and mssfixup) works around the problem.

>Audit-Trail:
>Unformatted: