Sample Header Ad - 728x90

Why MSS clamping in iptables(-nft) seems to take no effect in nftables?

2 votes
1 answer
4071 views
My pppoe client automatically adds an iptables rule iptables -t mangle -o "$PPP_IFACE" --insert FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:65495 -j TCPMSS --clamp-mss-to-pmtu from /etc/ppp/ip-up.d. However, this rule in nftables looks like
table ip mangle {
	chain FORWARD {
		type filter hook forward priority mangle; policy accept;
		oifname "ppp0" meta l4proto tcp tcp flags & (syn|rst) == syn # tcpmss match 1400:65495 counter packets 714 bytes 42388 tcp option maxseg size set rt mtu
	}
}
Why contents after tcpmss is commented and this rule seems to do nothing?
Asked by Steven Yang (463 rep)
Oct 11, 2021, 10:30 AM
Last activity: Oct 11, 2021, 08:04 PM