B A <openbsd-ab@ya.ru> wrote:

quoted text
> My question is how to overwrite MSS value in SYN packets?
> I have read http://www.openbsd.org/faq/pf/ and found
> scrub option.
>
> My current rule is:
> scrub all no-df max-mss 1400 random-id fragment reassemble
>
> but it's not doing what I expect. It does packet fragmentation,
> and I want actual mss rewriting for outgoing SYN packets.
> Something like
> iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1400
> in linux.

max-mss does exactly what it says. See man 6 pf.conf

TRAFFIC NORMALIZATION
     Traffic normalization is used to sanitize packet content in such a way
     that there are no ambiguities in packet interpretation on the receiving
     side.  The normalizer does IP fragment reassembly to prevent attacks that
     confuse intrusion detection systems by sending overlapping IP fragments.
     Packet normalization is invoked with the scrub directive.

     scrub has the following options:
...
     max-mss <number>
           Enforces a maximum MSS for matching TCP packets.
...

Also, I see the rule above omits interface name so maybe you need to
explicitly specify an interface where you need to scrub.

Can you show tcpdump output to see how SYN and SYN-ACK packets
looks like?

- Alexey.