> On Oct 26, 2026, at 7:14 AM, Johannes Thyssen Tishman <[email protected]> > wrote: > > Hi. I'm in the process of configuring an OpenBSD router at home. My ISP > uses DS-Lite, so I've placed the OpenBSD router behind the ISP's > Fritz!Box as an exposed host, so that the Fritz!Box can handle PPPoE and > the DS-Lite encapsulation. So far, the OpenBSD router operates only in > IPv4 space as I haven't set up IPv6 yet (no port-forwards). > > +-----+ +-----------------+ +---------+ +---------+ > | ISP | | Fritz!Box | em0 | OpenBSD | em2/switch | LAN | > | | --- | PPPoE / DS-Lite | --- | Router | ---------- | Clients | > +-----+ +-----------------+ +---------+ +---------+ > | em1 > +---------+ +---------+ > | Access | | WLAN | > | Point | )))))))))) | Clients | > +---------+ +---------+ > > While this is working mostly fine, I've experienced some slowness when > browsing some websites. I read on the internet that this could be > related to a misconfigured MSS. > > Using 'ping -D -s <size> 1.1.1.1' with different sizes, I was able to > find that the MTU in my setup is 1452 bytes > > 1500 bytes (standard Ethernet MTU) > - 8 bytes (PPPoE header) > - 40 bytes (IPv6 header for DS-Lite) > -------------------------------------- > 1452 bytes > > which, and please correct me if I'm wrong, should result in the > following MSS: > > 1452 bytes > - 20 bytes (IPv4 header) > - 20 bytes (TCP header) > -------------------------------------- > 1412 bytes > > In pf.conf(5) I see there is the scrub parameter max-mss. However, I'm > not sure if this is the right way to clamp the MSS in my situation. I > see examples using this parameter like here[0] > > match in all scrub (no-df random-id max-mss 1440) > > which, from what I read, is used to normalize incoming packets. IIUC, I > could change this to 'max-mss 1412' and this would clamp the MSS on > traffic leaving from clients (because packets travel *in*to the router) > and then exit to the Fritz!Box with the correct size ready for > encapsulation, right? However, this would cause all internal traffic, > which doesn't require clamping, to also operate with that MSS, correct? > Would something like the following be more appropriate? > > match out on em0 scrub (max-mss 1412) > > Also, say I configure this, what would be a good way to test the before > and after? I suppose I could just browse the internet and see if the > situation improves, but I would prefer to see some proof. IIUC, I can't > use the ping test from above because the max-mss only applies to TCP > packets, right? > > I'd appreciate any help to help me understand this better and configure > this properly. Thank you! > > [0] https://www.openbsd.org/faq/pf/example1.html#pf > > PS. Here's my still very basic pf.conf: > > ext_if = "em0" > wifi = "em1" > wired = "em2" > > set skip on lo0 > match out on $ext_if inet from !($ext_if:network) to any nat-to ($ext_if) > block all > pass out quick inet > pass in on { $wifi $wired } inet >
I use max-mss for different reasons, so I can attest that it does work both ways (all or specific interfaces, among other match rules). I prefer to use the mtu parameter on ifconfig for your situation. Everything leaving em0 is presumably going out through the DS-Lite, so setting mtu to 1452 on em0 would do the trick. It would also enforce the limit on UDP and ICMP as well. Add this to /etc/hostname.em0 mtu 1452
