3 ms·
How about stripping MSS instead? Like so: iptables -t mangle -I PREROUTING -p tcp --tcp-flags SYN SYN -m tcpmss --mss 1:500 -j TCPOPTSTRIP --strip-options mss
by isodude 7y ago
How about stripping MSS instead? Like so:
iptables -t mangle -I PREROUTING -p tcp --tcp-flags SYN SYN -m tcpmss --mss 1:500 -j TCPOPTSTRIP --strip-options mss
I experimented with a host that sends out mss 216 and the communication was still ok with the above, but not while dropping the traffic.
- LinuxBender 7y agoThats a great idea. That would certainly help if someone unwittingly had some malware that enabled this behavior on their host, but you still wanted them to reach you.
- isodude 7y agoOr a totally unrelated misconfiguration, I assume this is why this particular host is sending a low MSS. I just assume that stripping MSS should be enough, looking through the information that is available.