> I couldn't try at that time (IPFilter 3.4.23?), so I only know
> some sites are not accessible now (IPFilter 3.4.25), which is
> accessible with rp-pppoe's clamping feature.

It works for me on a system recompiled from new sources today:

# uname -a 
NetBSD nightfall.duskware.de 1.5ZC NetBSD 1.5ZC (NIGHTFALL) #0: Mon Mar 18 18:09:57 MET 2002
root@night-porter.duskware.de:/usr/src/sys/arch/sparc/compile/NIGHTFALL sparc

Did you enable MSS clamping as described in the URL below?

  http://www.netbsd.org/Documentation/network/pppoe/#clamping

We would need a tcpdump from the outside interface and the relevant parts
of your ipnat.conf file to diagnose the problem further.

Martin