[Bug 207598] pf adds icmp unreach on gre/ipsec somehow

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Thu May 19 05:19:38 UTC 2016


--- Comment #2 from emz at norma.perm.ru ---
Sorry it took that long (I was kinda overwhelmed by the amount of work).

So, same setup: A <---gre/ipsec---> B <---gre/ipsec---> C.

1) ipsec removed between A and B. The issue persists.
2) pf disabled on B. The issue is no more.
3) ipsec added on B, pf still disabled. The issue is no more.
4) ipsec still on, pf enabled on B. The issue is back.
5) ipsec enabled, pf enabled, the following line removed from pf on B:

scrub on $oif from !<voippbxes> fragment reassemble

The issue persists.

6) Line from previous point added back, removed the line

scrub on gre0 max-mss 1360

where gre0 is the B <---> C tunnel

and the issue is gone.

But I don't understand how the MSS enforcing can affect the ICMP packets, while
it should only affect TCP.

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-pf mailing list