Re: Weird NAT problem

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Grant Taylor a écrit :
> 
> The first thing that comes to mind is that you may be dealing with an 
> MTU / MSS issue.  Some of your connections work and some never seem to 
> start, which is a classic symptom of an MTU / MSS mis-match with the 
> ICMP error being filtered out along the way.

Or with the ICMP error not being generated at all, because of the MTU 
mismatch not occuring at an IP device. This is quite common with a DSL 
modem acting as transparent bridge : as it works only at the link layer, 
when it receives a PPPoE frame bigger than 1500 bytes from the ISP, it 
cannot either forward it on the ethernet link, fragment it or send an 
ICMP error.

The ISP routers should be responsible for doing the fragmentation and 
sending ICMP errors. But unfortunately they don't always do it. 
Sometimes the ISP don't even know the customer uses PPPoE, for example 
when it uses a third-party DSL carrier which deals with the PPPoX stuff 
and delivers user sessions to the ISP in L2TP tunnels.

> Try playing with the TCPMSS match extension and target to clamp the MSS 
> to some lower values.

Be aware that this workaround only works for TCP, not for other IP 
protocols such as UDP, ICMP (big pings), GRE, IPSec (AH, ESP), IPIP, 6in4...