Why MSS clamping in iptables(-nft) seems to take no effect in nftables?
2
votes
1
answer
4071
views
My pppoe client automatically adds an iptables rule
iptables -t mangle -o "$PPP_IFACE" --insert FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:65495 -j TCPMSS --clamp-mss-to-pmtu
from /etc/ppp/ip-up.d
. However, this rule in nftables looks like
table ip mangle {
chain FORWARD {
type filter hook forward priority mangle; policy accept;
oifname "ppp0" meta l4proto tcp tcp flags & (syn|rst) == syn # tcpmss match 1400:65495 counter packets 714 bytes 42388 tcp option maxseg size set rt mtu
}
}
Why contents after tcpmss is commented and this rule seems to do nothing?
Asked by Steven Yang
(463 rep)
Oct 11, 2021, 10:30 AM
Last activity: Oct 11, 2021, 08:04 PM
Last activity: Oct 11, 2021, 08:04 PM