>>> and [MSS clamping] depends on a number of shaky assumptions (which,
>>> to be fair, it looks to me as though you'd get away with; it may be
>>> good enough for an interim patch for your case).
>> I'll try rp-pppoe as an alternative on NetBSD before I try OpenBSD
>> or reinstall FreeBSD on the box.

You also might try NetBSD recent enough that it does MSS clamping.
It's the Wrong Fix, but since it appears you're willing to paper over
the problem instead of fixing it....

> Have you tried: "route add default 1.2.3.4 -mtu 1492" on the inside
> machines?  (e.g. blue/green)

That _shouldn't_ matter, since what MSS clamping affects (and what
PMTU-D blackholes come from) is segments flowing in the other
direction.

It may "fix" it anyway, if the inside machines use the MTU to determine
the MSS value, presumably on the assumption that the path MTU equals
the path MRU, which can be false - consider cablemodems with dialup
backchannels.  (This is one of the "shaky assumptions".)

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B