Some sites don't load, using PPPoE

[goncalopp]

Hello everyone
I'm very new to pfsense (or any BSD), but I'm trying to set it up to be a firewall to a small network.

I got most of it working, but some sites won't load. I've had a similar problem in another platform years ago, and I remember the MTU was wrong, but I've double checked that and it seems correct.

My setup:

• pfsense 2.0.2-RELEASE

• ALIX board - alix2d13

• DSL line attached to a modem in bridge mode

• Using PPPoE on pfsense, MTU of 1500 on vr0 (wan port), 1492 on pppoe1

What works:

• SSH to outside world

• I can "dig" everything

• most sites (google.com, pcengines.ch, twitter.com)

What doesn't:

• some sites (yahoo.com, microsoft.com, flattr.com). The browser keeps loading on a blank page for a long time

What I've already done:

• Disable hardware checksum offload

• restart interfaces, pppoe, pfsense, modem…

• After setting MTU to 1500, ping works with packets up to 1464 bytes, so the MTU should be 1492. After setting MTU to 1492, situation persists

• Packet analysis with Wireshark. On working sites, I get a small HTTP response. On sites that don't work, there's TCP fragments of 1506 bytes, but wireshark doesn't identify any packet as being HTTP

  Here's my ifconfig (vr1 is LAN):

  vr0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
  	options=8280b <rxcsum,txcsum,vlan_mtu,wol_ucast,wol_magic,linkstate>ether [CENSORED MAC 0]
  	inet6 fe80::20d:b9ff:fe2a:b5f0%vr0 prefixlen 64 scopeid 0x1 
  	nd6 options=43 <performnud,accept_rtadv>media: Ethernet autoselect (100baseTX <full-duplex>)
  	status: active
  vr1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
  	options=82808 <vlan_mtu,wol_ucast,wol_magic,linkstate>ether [CENSORED MAC 1]
  	inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
  	inet6 fe80::20d:b9ff:fe2a:b5f1%vr1 prefixlen 64 scopeid 0x2 
  	nd6 options=43 <performnud,accept_rtadv>media: Ethernet autoselect (100baseTX <full-duplex>)
  	status: active
  vr2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
  	options=82808 <vlan_mtu,wol_ucast,wol_magic,linkstate>ether [CENSORED MAC 2]
  	inet6 fe80::20d:b9ff:fe2a:b5f2%vr2 prefixlen 64 scopeid 0x3 
  	nd6 options=43 <performnud,accept_rtadv>media: Ethernet autoselect (none)
  	status: no carrier
  ath0: flags=8802 <broadcast,simplex,multicast>metric 0 mtu 2290
  	ether [CENSORED MAC 3]
  	media: IEEE 802.11 Wireless Ethernet autoselect (autoselect)
  	status: no carrier
  lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
  	options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000 
  	inet6 ::1 prefixlen 128 
  	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5 
  	nd6 options=43 <performnud,accept_rtadv>pfsync0: flags=0<> metric 0 mtu 1460
  	syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
  enc0: flags=0<> metric 0 mtu 1536
  pflog0: flags=100 <promisc>metric 0 mtu 33200
  pppoe1: flags=88d1 <up,pointopoint,running,noarp,simplex,multicast>metric 0 mtu 1492
  	inet6 fe80::20d:b9ff:fe2a:b5f0%pppoe1 prefixlen 64 scopeid 0x9 
  	inet 85.246.162.252 --> 194.65.169.248 netmask 0xffffffff 
  	nd6 options=43 <performnud,accept_rtadv></performnud,accept_rtadv></up,pointopoint,running,noarp,simplex,multicast></promisc></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></broadcast,simplex,multicast></performnud,accept_rtadv></vlan_mtu,wol_ucast,wol_magic,linkstate></up,broadcast,running,simplex,multicast></full-duplex></performnud,accept_rtadv></vlan_mtu,wol_ucast,wol_magic,linkstate></up,broadcast,running,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,wol_ucast,wol_magic,linkstate></up,broadcast,running,simplex,multicast> 
  

  I'm a bit lost as to what I can do to debug this  :-\ any help is welcome

[slu]

DNS work?

http://forum.pfsense.org/index.php/topic,57020.0.html

[goncalopp]

@slu:

DNS work?

Actually, PPPoE was returning 127.0.0.1 as the DNS server, but I went ahead and added them manually, and everything seems correct on the DNS level. As I mentioned, I can "dig" all hosts, including the sites that don't work

[cmb]

Almost certainly because you need a lower value for MSS clamping.

[goncalopp]

@cmb:

Almost certainly because you need a lower value for MSS clamping.

Yes! Setting Interfaces->WAN->MSS to 1492 (or lower) solves this.
Now I can finally move on to more important configuration… Thank you so much!  ;D