Question about clamp-tcp-mss

RouterOS General
1

Hi,

this is a question about GRE/EoIP/... tunneling. I am looking for help about the explanation of the clamp-tcp-mss parameter of EoIP interfaces:

Controls whether to change MSS size for received TCP SYN packets. When enabled, a router will change the MSS size for received TCP SYN packets if the current MSS size exceeds the tunnel interface MTU (taking into account the TCP/IP overhead). The received encapsulated packet will still contain the original MSS, and only after decapsulation the MSS is changed.

To me, it sounds like setting this parameter to yes would automagically mangle TCP packets to an appropriate MSS based on the interface MTU:

/interface eoip add allow-fast-path=no tunnel-id=2 \
    local-address=192.168.1.2 remote-address=192.168.1.1 name=vpn01 \
    mtu=1280

So my question is whether the following is needed or not:

/ip firewall mangle add action=change-mss chain=forward \
    new-mss=1240 protocol=tcp tcp-flags=syn tcp-mss=1241-65535 \
    out-interface=vpn01
/ip firewall mangle add action=change-mss chain=forward \
    new-mss=1240 protocol=tcp tcp-flags=syn tcp-mss=1241-65535 \
    in-interface=vpn01

I am also not sure how to understand that last sentence of the quoted explanation.

You input is very much appreciated.

2

On review, I am not sure the following helps, but anyway.

Normally an EoIP tunnel is attached to a bridge, so the input/output interface is the bridge, so these mangle rules won't ever match.

Though commonly (always?) when you attach an EoIP tunnel to a bridge, it drops the bridge MTU
to the EoIP MTU, so you do actually need to clamp the mss for the whole bridge. Then if you increase the EoIP MTU to get the bridge MTU back up to 1500 the existing clamp-tcp-mss becomes pointless.

It would maybe be useful if you could manually set the clamp-tcp-mss setting to 1240 in your case, even with an MTU of 1500 for EoIP and bridge, so tcp over EoIP is efficient.

I haven't tried this, but you could perhaps add bridge filtering rules that set a packet/connection mark that indicates if the in port or out port is the vpn, and then have your mss clamping mangle rules using that mark. (cpu expensive though)

3

My EoIP tunnel is not attached to a bridge. I am using it for RoMON.

4

The option at interface level (EoIP, PPPoE etc) has the same effect as a mangle rule with “clamp to PMTU”, but it has the advantage that it works in fastpath and fasttrack. Mangle rules are not effective there, and may be skipped (although in this case it probably works because the rule is targeting new connections).

When you want to set a specific MSS, you need a mangle rule. Then you can leave the interface option unchecked.