Hi. I'm in the process of configuring an OpenBSD router at home. My ISP
uses DS-Lite, so I've placed the OpenBSD router behind the ISP's
Fritz!Box as an exposed host, so that the Fritz!Box can handle PPPoE and
the DS-Lite encapsulation. So far, the OpenBSD router operates only in
IPv4 space as I haven't set up IPv6 yet (no port-forwards).
+-----+ +-----------------+ +---------+ +---------+
| ISP | | Fritz!Box | em0 | OpenBSD | em2/switch | LAN |
| | --- | PPPoE / DS-Lite | --- | Router | ---------- | Clients |
+-----+ +-----------------+ +---------+ +---------+
| em1
+---------+ +---------+
| Access | | WLAN |
| Point | )))))))))) | Clients |
+---------+ +---------+
While this is working mostly fine, I've experienced some slowness when
browsing some websites. I read on the internet that this could be
related to a misconfigured MSS.
Using 'ping -D -s <size> 1.1.1.1' with different sizes, I was able to
find that the MTU in my setup is 1452 bytes
1500 bytes (standard Ethernet MTU)
- 8 bytes (PPPoE header)
- 40 bytes (IPv6 header for DS-Lite)
--------------------------------------
1452 bytes
which, and please correct me if I'm wrong, should result in the
following MSS:
1452 bytes
- 20 bytes (IPv4 header)
- 20 bytes (TCP header)
--------------------------------------
1412 bytes
In pf.conf(5) I see there is the scrub parameter max-mss. However, I'm
not sure if this is the right way to clamp the MSS in my situation. I
see examples using this parameter like here[0]
match in all scrub (no-df random-id max-mss 1440)
which, from what I read, is used to normalize incoming packets. IIUC, I
could change this to 'max-mss 1412' and this would clamp the MSS on
traffic leaving from clients (because packets travel *in*to the router)
and then exit to the Fritz!Box with the correct size ready for
encapsulation, right? However, this would cause all internal traffic,
which doesn't require clamping, to also operate with that MSS, correct?
Would something like the following be more appropriate?
match out on em0 scrub (max-mss 1412)
Also, say I configure this, what would be a good way to test the before
and after? I suppose I could just browse the internet and see if the
situation improves, but I would prefer to see some proof. IIUC, I can't
use the ping test from above because the max-mss only applies to TCP
packets, right?
I'd appreciate any help to help me understand this better and configure
this properly. Thank you!
[0] https://www.openbsd.org/faq/pf/example1.html#pf
PS. Here's my still very basic pf.conf:
ext_if = "em0"
wifi = "em1"
wired = "em2"
set skip on lo0
match out on $ext_if inet from !($ext_if:network) to any nat-to ($ext_if)
block all
pass out quick inet
pass in on { $wifi $wired } inet
