Sten, Followup on "Dynamic TCP MSS rule breaks stuff&qu

RouterOS General
1

Sten and others,

So is the definitive solution to the broken behaviour of the “Change TCP MSS” function to do the following:

  1. Set the Change TCP MMS option to no.

  2. Set the PPPoE Server’s Max MTU and Max MRU to 1480.

  3. Add the following firewall rule to the mangle table:
    / ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn tcp-mss=1453-65535 action=change-mss new-mss=clamp-to-pmtu comment=“” disabled=no

Thank you for your help!! I’m still tearing hair out over this. I’ll be bald soon. :smiley:

-Brandon

2

Bump.

3

The solution to the broken behavior is to make sure all connections have same MTU/MRU and use the above rule.

1492 is the IDEAL size for pppoe connections when you do not use compression/encryption of the pppoe connections.

4

You can try the MSS value= 1400 to test

5

Yeah

The trick is that mss always needs to be 40 less than the mtu.

6

Are the dynamic rules fixed in later versions? Like 6.38.1

I’ve not seen any release note related to this and things definitely work better with the rules below instead of the default dynamic Tik ones. But really I’d like to just use the default ones. I found these on the forum a long time ago and been using them since, although I cant locate the original post, but I thought it had the same title as this thread.

/ip firewall mangle
add action=jump chain=forward comment="tcp, mss" in-interface=all-ppp jump-target=mss protocol=tcp tcp-flags=syn
add action=jump chain=forward comment="tcp, mss" jump-target=mss out-interface=all-ppp protocol=tcp tcp-flags=syn

add action=change-mss chain=mss comment="tcp, mss fixation" new-mss=1440 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=!536-1460
add action=change-mss chain=mss comment="tcp, mss 1440 for mtu 1492" new-mss=1440 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1453-65535
add action=change-mss chain=mss comment="tcp, mss clamp-to-pmtu" new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn