Mangle TCP options - Revision history

Fmyhr: Replaced text with link to Mangling packet headers, where this page has been copied to section "Mangling TCP options".

2021-04-16T21:26:11Z

Replaced text with link to Mangling packet headers, where this page has been copied to section "Mangling TCP options".

← Older revision		Revision as of 21:26, 16 April 2021
Line 1:		Line 1:
	Since Linux kernel 4.14 and nftables 0.9, you can clamp your TCP MSS to Path MTU. This is very convenient in case your router encapsulates traffic over PPPoE, which is what many DSL (and some FTTH) providers do:		See: [[Mangling packet headers]]

	~~<source lang="bash">~~
	~~nft add rule ip filter forward oifname ppp0 tcp flags syn tcp option maxseg size set rt mtu~~
	~~</source>~~

	~~where '''rt mtu''' calculates the MTU in runtime based on what the routing cache has observed via Path MTU Discovery (PMTUD).~~

	~~Note for iptables users: 'tcp option maxseg size set rt mtu' is equivalent to '-j TCPMSS --clamp-mss-to-pmtu'.~~

	You can also manually set to fixed value, eg. PPPoE takes 8 bytes to encapsulate packets, therefore, assuming MTU of 1500 bytes, 1500 - 20 (IPv4 Header) - 20 (TCP header) - 8 (PPPoE header) = 1452 bytes:

	~~<source lang="bash">~~
	~~nft add rule ip filter forward oifname ppp0 tcp flags syn tcp option maxseg size set 1452~~
	~~</source>~~

	~~Other supported TCP options are: window, sack-permitted, sack, timestamp and eol.~~

Admin at 19:00, 11 December 2017

2017-12-11T19:00:05Z

← Older revision		Revision as of 19:00, 11 December 2017
Line 1:		Line 1:
	Since Linux kernel 4.13 and nftables 0.9, you can clamp your TCP MSS to Path MTU. This is very convenient in case your router encapsulates traffic over PPPoE, which is what many DSL (and some FTTH) providers do:		Since Linux kernel 4.14 and nftables 0.9, you can clamp your TCP MSS to Path MTU. This is very convenient in case your router encapsulates traffic over PPPoE, which is what many DSL (and some FTTH) providers do:

	<source lang="bash">		<source lang="bash">

Admin: initial

2017-12-11T18:59:32Z

initial

New page

Since Linux kernel 4.13 and nftables 0.9, you can clamp your TCP MSS to Path MTU. This is very convenient in case your router encapsulates traffic over PPPoE, which is what many DSL (and some FTTH) providers do:

<source lang="bash">
nft add rule ip filter forward oifname ppp0 tcp flags syn tcp option maxseg size set rt mtu
</source>

where '''rt mtu''' calculates the MTU in runtime based on what the routing cache has observed via Path MTU Discovery (PMTUD).

Note for iptables users: 'tcp option maxseg size set rt mtu' is equivalent to '-j TCPMSS --clamp-mss-to-pmtu'.

You can also manually set to fixed value, eg. PPPoE takes 8 bytes to encapsulate packets, therefore, assuming MTU of 1500 bytes, 1500 - 20 (IPv4 Header) - 20 (TCP header) - 8 (PPPoE header) = 1452 bytes:

<source lang="bash">
nft add rule ip filter forward oifname ppp0 tcp flags syn tcp option maxseg size set 1452
</source>

Other supported TCP options are: window, sack-permitted, sack, timestamp and eol.