some sites can not browsering behind nat

[k simon]

Hi,List,
  Last day I migrate one haproxy box from FreeBSD to DflyBSD, then some
client reported can not browsering some site. After some investigation,
I found these client is benhind some NAT box or benhind firewall, the
other client without nat have no issue.
  Then I modify the pf.conf with "scrub out on $RESPOND_IF max-mss
1400", and I tried set the mssdflt or enable PMTU, but it has nothing
helped. With tcpudmped it shows

02:04:37.736802 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [S.],
seq 1060181879, ack 1461664647, win 32768, options [mss 1400], length 0
02:04:38.108258 IP 116.211.123.216.80 > 192.168.108.16.38589: Flags
[S.], seq 173104871, ack 3175683181, win 32768, options [mss 1400], length 0
02:04:38.145912 IP 123.58.176.224.80 > 192.168.108.16.55675: Flags [S.],
seq 3825658113, ack 2801603669, win 32768, options [mss 1400], length 0
02:04:38.145942 IP 220.181.8.27.80 > 192.168.108.16.59883: Flags [S.],
seq 918876111, ack 1103954263, win 32768, options [mss 1400], length 0
02:04:38.146083 IP 116.211.118.34.80 > 192.168.108.16.58487: Flags [S.],
seq 3760967127, ack 2050207109, win 32768, options [mss 1400], length 0
02:04:38.146084 IP 116.211.123.225.80 > 192.168.108.16.38705: Flags
[S.], seq 486747537, ack 3978733903, win 32768, options [mss 1400], length 0
02:04:38.146182 IP 116.211.123.225.80 > 192.168.108.16.38706: Flags
[S.], seq 3914276862, ack 930057259, win 32768, options [mss 1400], length 0
02:04:38.146332 IP 61.183.42.150.80 > 192.168.108.16.52172: Flags [S.],
seq 752539209, ack 2217414361, win 32768, options [mss 1400], length 0
02:04:38.146612 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.],
ack 664, win 32917, length 0
02:04:38.154915 IP 221.235.187.76.80 > 192.168.108.16.52441: Flags [S.],
seq 4210760199, ack 2227559102, win 32768, options [mss 1400], length 0
02:04:38.182455 IP 117.21.179.38.80 > 192.168.108.16.34394: Flags [S.],
seq 375928677, ack 966252891, win 32768, options [mss 1400], length 0
02:04:38.209605 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.],
seq 1:1461, ack 664, win 33580, length 1460
02:04:38.209610 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [P.],
seq 1461:1728, ack 664, win 33580, length 267
02:04:38.209918 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.],
seq 1728:3188, ack 664, win 33580, length 1460
02:04:38.210901 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.],
seq 3188:4648, ack 664, win 33580, length 1460
02:04:38.210911 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags
[FP.], seq 4648:5799, ack 664, win 33580, length 1151
02:04:38.212422 IP 221.235.187.76.80 > 192.168.108.16.52433: Flags [.],
ack 665, win 33580, length 0
02:04:38.226759 IP 116.211.123.225.80 > 192.168.108.16.38693: Flags [.],
ack 671, win 33248, length 0
02:04:38.228104 IP 116.211.123.225.80 > 192.168.108.16.38693: Flags [.],
seq 12030:13490, ack 671, win 33580, length 1460
02:04:38.228109 IP 116.211.123.225.80 > 192.168.108.16.38693: Flags [.],
seq 13490:14950, ack 671, win 33580, length 1460
02:04:38.228114 IP 116.211.123.225.80 > 192.168.108.16.38693: Flags
[P.], seq 14950:16182, ack 671, win 33580, length 1232
02:04:38.229573 IP 116.211.123.225.80 > 192.168.108.16.38694: Flags [.],
ack 1006, win 33249, length 0
02:04:38.229592 IP 116.211.123.225.80 > 192.168.108.16.38675: Flags [.],
ack 1368, win 33255, length 0
02:04:38.230891 IP 116.211.123.225.80 > 192.168.108.16.38675: Flags [.],
seq 16798:18258, ack 1368, win 33580, length 1460
02:04:38.230896 IP 116.211.123.225.80 > 192.168.108.16.38675: Flags
[P.], seq 18258:18783, ack 1368, win 33580, length 525
02:04:38.238474 IP 221.235.187.76.80 > 192.168.108.16.52400: Flags [.],
ack 2021, win 33255, length 0
02:04:38.239942 IP 119.97.146.47.80 > 192.168.108.16.44877: Flags [.],
ack 3069, win 33245, length 0
02:04:38.240068 IP 221.235.187.76.80 > 192.168.108.16.52400: Flags [.],
seq 40066:41526, ack 2021, win 33580, length 1460
02:04:38.240070 IP 221.235.187.76.80 > 192.168.108.16.52400: Flags [.],
seq 41526:42986, ack 2021, win 33580, length 1460
02:04:38.240073 IP 221.235.187.76.80 > 192.168.108.16.52400: Flags [P.],
seq 42986:43548, ack 2021, win 33580, length 562
02:04:38.240984 IP 119.97.146.47.80 > 192.168.108.16.44877: Flags [.],
seq 65226:66686, ack 3069, win 33580, length 1460
02:04:38.240989 IP 119.97.146.47.80 > 192.168.108.16.44877: Flags [P.],
seq 66686:67498, ack 3069, win 33580, length 812
02:04:38.241401 IP 221.235.187.76.80 > 192.168.108.16.52412: Flags [.],
ack 4028, win 33250, length 0

  How can I go deep into the issue and resolve it?

P.S.
I tried set "bind mss" parameters in the haproxy configration, but it
reported does not support on dfly.



Regards
Simon