[Bug 207598] pf adds icmp unreach on gre/ipsec somehow

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207598

--- Comment #2 from emz at norma.perm.ru ---
Sorry it took that long (I was kinda overwhelmed by the amount of work).

So, same setup: A <---gre/ipsec---> B <---gre/ipsec---> C.

1) ipsec removed between A and B. The issue persists.
2) pf disabled on B. The issue is no more.
3) ipsec added on B, pf still disabled. The issue is no more.
4) ipsec still on, pf enabled on B. The issue is back.
5) ipsec enabled, pf enabled, the following line removed from pf on B:

scrub on $oif from !<voippbxes> fragment reassemble

The issue persists.

6) Line from previous point added back, removed the line

scrub on gre0 max-mss 1360

where gre0 is the B <---> C tunnel

and the issue is gone.

But I don't understand how the MSS enforcing can affect the ICMP packets, while
it should only affect TCP.

-- 
You are receiving this mail because:
You are the assignee for the bug.