Any advice to diagnose this problem? I once thought maybe something wrong with the FORWARD rules, and tried to log the blocked packages. But there's no log info.
Probably you're encoutering the Path MTU Discovery problem. There are serveral solutions to this problem.
1. Lower the MTU of the network interface of your internal host.
2. Use the clamp-mss-to-pmtu feature of iptables:
# iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS \
--clamp-mss-to-pmtu3. Use the clamp MSS feature of rp-pppoe (e.g. -m 1412).
Wenzhuo -- Wenzhuo Zhang <wenzhuo@xxxxxxxxxx> GnuPG Key ID 0xBA586A68 Key fpr: 89C7 C6DE D956 F978 3F12 A8AF 5847 F840 BA58 6A68
