> On Oct 26, 2026, at 9:37 AM, Brian Brombacher <[email protected]> wrote:
>
>
>> On Oct 26, 2026, at 7:14 AM, Johannes Thyssen Tishman <[email protected]>
>> wrote:
>>
>> Hi. I'm in the process of configuring an OpenBSD router at home. My ISP
>> uses DS-Lite, so I've placed the OpenBSD router behind the ISP's
>> Fritz!Box as an exposed host, so that the Fritz!Box can handle PPPoE and
>> the DS-Lite encapsulation. So far, the OpenBSD router operates only in
>> IPv4 space as I haven't set up IPv6 yet (no port-forwards).
>>
>> +-----+ +-----------------+ +---------+ +---------+
>> | ISP | | Fritz!Box | em0 | OpenBSD | em2/switch | LAN |
>> | | --- | PPPoE / DS-Lite | --- | Router | ---------- | Clients |
>> +-----+ +-----------------+ +---------+ +---------+
>> | em1
>> +---------+ +---------+
>> | Access | | WLAN |
>> | Point | )))))))))) | Clients |
>> +---------+ +---------+
>>
>> While this is working mostly fine, I've experienced some slowness when
>> browsing some websites. I read on the internet that this could be
>> related to a misconfigured MSS.
>>
>> Using 'ping -D -s <size> 1.1.1.1' with different sizes, I was able to
>> find that the MTU in my setup is 1452 bytes
>>
>> 1500 bytes (standard Ethernet MTU)
>> - 8 bytes (PPPoE header)
>> - 40 bytes (IPv6 header for DS-Lite)
>> --------------------------------------
>> 1452 bytes
>>
>> which, and please correct me if I'm wrong, should result in the
>> following MSS:
>>
>> 1452 bytes
>> - 20 bytes (IPv4 header)
>> - 20 bytes (TCP header)
>> --------------------------------------
>> 1412 bytes
>>
>> In pf.conf(5) I see there is the scrub parameter max-mss. However, I'm
>> not sure if this is the right way to clamp the MSS in my situation. I
>> see examples using this parameter like here[0]
>>
>> match in all scrub (no-df random-id max-mss 1440)
>>
>> which, from what I read, is used to normalize incoming packets. IIUC, I
>> could change this to 'max-mss 1412' and this would clamp the MSS on
>> traffic leaving from clients (because packets travel *in*to the router)
>> and then exit to the Fritz!Box with the correct size ready for
>> encapsulation, right? However, this would cause all internal traffic,
>> which doesn't require clamping, to also operate with that MSS, correct?
>> Would something like the following be more appropriate?
>>
>> match out on em0 scrub (max-mss 1412)
>>
>> Also, say I configure this, what would be a good way to test the before
>> and after? I suppose I could just browse the internet and see if the
>> situation improves, but I would prefer to see some proof. IIUC, I can't
>> use the ping test from above because the max-mss only applies to TCP
>> packets, right?
>>
>> I'd appreciate any help to help me understand this better and configure
>> this properly. Thank you!
>>
>> [0] https://www.openbsd.org/faq/pf/example1.html#pf
>>
>> PS. Here's my still very basic pf.conf:
>>
>> ext_if = "em0"
>> wifi = "em1"
>> wired = "em2"
>>
>> set skip on lo0
>> match out on $ext_if inet from !($ext_if:network) to any nat-to ($ext_if)
>> block all
>> pass out quick inet
>> pass in on { $wifi $wired } inet
>>
>
> I use max-mss for different reasons, so I can attest that it does work both
> ways (all or specific interfaces, among other match rules).
>
> I prefer to use the mtu parameter on ifconfig for your situation. Everything
> leaving em0 is presumably going out through the DS-Lite, so setting mtu to
> 1452 on em0 would do the trick. It would also enforce the limit on UDP and
> ICMP as well.
>
> Add this to /etc/hostname.em0
>
> mtu 1452
I’m wrong here, you need max-mss since you are forwarding packets. Setting mtu
only would not be enough.
