Subject: Re: Lower MTU behind NAT
To: None <>
From: Feico Dillema <>
List: current-users
Date: 02/05/2001 00:04:28
On Mon, Feb 05, 2001 at 07:38:12AM +0900, wrote:
> >I have a bit of a problem with NAT and ICMP and haven't been able to
> >find the answer in the ipfilter documentation. I hope you can give me
> >a hint whether and how this can be fixed. I have the following setup:
> >
> >client <=> gif tunnel MTU=1280 <==> NAT <==> Outside world
> >
> >Problem is that TCP connections to servers using PMTU discovery faisl
> >as the internal IP-addresses in ICMP messages do not get translated.
> >The NAT machine sends out ICMP mesgs like:
> >
> >17:35:40.185184 > icmp: unreachable - need to frag (mtu 1280) (ttl 255, id 35140)
> >
> >Rewriting these addrs in ICMP msg is maybe not perfectly correct, but
> >it would make my setup work. So, I'd like to know whether there's some
> >rule I can add for this.
> 	NAT = ipnat (in ipfilter)?
Yes, on NetBSD-1.5.1 branch.

> 	then, this should be the same problem as PR 10993.  not sure
Ah, should've checked the PR database first...

> 	if recent ipfilter corrects it or not.
Hmmm, the PR says a fix is available from recent ipfilter source or
netbsd-current. If so, it would be nice to see it appear on the 1.5.1