2026-10-26T09:41:00-0400 Brian Brombacher <[email protected]>: > > > > On Oct 26, 2026, at 9:37 AM, Brian Brombacher <[email protected]> wrote: > > > > > >> On Oct 26, 2026, at 7:14 AM, Johannes Thyssen Tishman <[email protected]> > >> wrote: > >> > >> Hi. I'm in the process of configuring an OpenBSD router at home. My ISP > >> uses DS-Lite, so I've placed the OpenBSD router behind the ISP's > >> Fritz!Box as an exposed host, so that the Fritz!Box can handle PPPoE and > >> the DS-Lite encapsulation. So far, the OpenBSD router operates only in > >> IPv4 space as I haven't set up IPv6 yet (no port-forwards). > >> > >> +-----+ +-----------------+ +---------+ +---------+ > >> | ISP | | Fritz!Box | em0 | OpenBSD | em2/switch | LAN | > >> | | --- | PPPoE / DS-Lite | --- | Router | ---------- | Clients | > >> +-----+ +-----------------+ +---------+ +---------+ > >> | em1 > >> +---------+ +---------+ > >> | Access | | WLAN | > >> | Point | )))))))))) | Clients | > >> +---------+ +---------+ > >> > >> While this is working mostly fine, I've experienced some slowness when > >> browsing some websites. I read on the internet that this could be > >> related to a misconfigured MSS. > >> > >> Using 'ping -D -s <size> 1.1.1.1' with different sizes, I was able to > >> find that the MTU in my setup is 1452 bytes > >> > >> 1500 bytes (standard Ethernet MTU) > >> - 8 bytes (PPPoE header) > >> - 40 bytes (IPv6 header for DS-Lite) > >> -------------------------------------- > >> 1452 bytes > >> > >> which, and please correct me if I'm wrong, should result in the > >> following MSS: > >> > >> 1452 bytes > >> - 20 bytes (IPv4 header) > >> - 20 bytes (TCP header) > >> -------------------------------------- > >> 1412 bytes > >> > >> In pf.conf(5) I see there is the scrub parameter max-mss. However, I'm > >> not sure if this is the right way to clamp the MSS in my situation. I > >> see examples using this parameter like here[0] > >> > >> match in all scrub (no-df random-id max-mss 1440) > >> > >> which, from what I read, is used to normalize incoming packets. IIUC, I > >> could change this to 'max-mss 1412' and this would clamp the MSS on > >> traffic leaving from clients (because packets travel *in*to the router) > >> and then exit to the Fritz!Box with the correct size ready for > >> encapsulation, right? However, this would cause all internal traffic, > >> which doesn't require clamping, to also operate with that MSS, correct? > >> Would something like the following be more appropriate? > >> > >> match out on em0 scrub (max-mss 1412) > >> > >> Also, say I configure this, what would be a good way to test the before > >> and after? I suppose I could just browse the internet and see if the > >> situation improves, but I would prefer to see some proof. IIUC, I can't > >> use the ping test from above because the max-mss only applies to TCP > >> packets, right? > >> > >> I'd appreciate any help to help me understand this better and configure > >> this properly. Thank you! > >> > >> [0] https://www.openbsd.org/faq/pf/example1.html#pf > >> > >> PS. Here's my still very basic pf.conf: > >> > >> ext_if = "em0" > >> wifi = "em1" > >> wired = "em2" > >> > >> set skip on lo0 > >> match out on $ext_if inet from !($ext_if:network) to any nat-to ($ext_if) > >> block all > >> pass out quick inet > >> pass in on { $wifi $wired } inet > >> > > > > I use max-mss for different reasons, so I can attest that it does work both > > ways (all or specific interfaces, among other match rules). > > > > I prefer to use the mtu parameter on ifconfig for your situation. > > Everything leaving em0 is presumably going out through the DS-Lite, so > > setting mtu to 1452 on em0 would do the trick. It would also enforce the > > limit on UDP and ICMP as well. > > > > Add this to /etc/hostname.em0 > > > > mtu 1452 > > I’m wrong here, you need max-mss since you are forwarding packets. Setting > mtu only would not be enough.
Thank you Brian. For now I'm doing the following which seems to be working well: match on em0 scrub (max-mss 1412)
