3 ms·
In the event anyone needs this, you can also override outbound mss in case someone is telling your client to use a low mss. This goes in the mangle table. DO
by LinuxBender 7y ago
In the event anyone needs this, you can also override outbound mss in case someone is telling your client to use a low mss.
This goes in the mangle table. DO NOT use this example unless you know for sure what you are doing.
iptables -t mangle -I POSTROUTING -o eth0 -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m tcpmss --mss 1:100 -j TCPMSS --set-mss 1360
This example should work for most use cases, but don't do this unless you for sure know the implications. Dropping bad inbound options is easy, but outbound can get more complicated. I am just showing this in case anyone asks and I am asleep. :-) Talk to your network admins and ask what is the highest mss/mtu your VPN's and 3rd party networks support.
This may not even help, as the packet has already been generated and we are too late in the process. I just figure someone might ask. There are probably use cases where this may help (for proxies, edge firewalls, hypervisors, docker hosts, maybe)
Or just log and drop the connections, or send yourself (your app) a tcp-reset.
- isodude 7y agoI read in a note just below --set-mss in man iptables-extensions that iptables will not increase mss if it's already lower than what set in --set-mss.
- LinuxBender 7y agoGood catch, I totally missed that.
- isodude 7y agoI did miss it at first also, but wondered why it didn't increase the value.
- LinuxBender 7y agoI'd have to dig into the source code of that module. It makes sense to not raise it artificially higher than the requesting host. I just didn't expect them to have that logic. IPTables usually blindly does whatever bad idea I give it. :-)
- cesarb 7y agoIncreasing the value would cause problems. If the remote end says its MSS is 512 octets, either it doesn't have enough memory to receive larger packets, or its link MTU is small enough that larger packets will always get dropped.