firehol-tcpmss(5)

💖 firehol-tcpmss — the FireHOL helper that fixes your MSS drama 💖

okay bestie, so you know how sometimes packets are just... too big and everyone's being dramatic about it? yeah. this is the page for firehol-tcpmss, a lil helper from the FireHOL 3.1.8 era that sets the MSS of TCP SYN packets for routers. it's giving traffic cop energy. ✨

---

✨ NAME ✨

firehol-tcpmss — set the MSS of TCP SYN packets for routers. periodt. 🎀

---

🦋 SYNOPSIS 🦋

tcpmss { mss | auto } [if-list]

that's it. that's the whole vibe. two things you can put in the first slot, and an optional little list of interfaces tagging along at the end. 💅

---

🌸 DESCRIPTION 🌸

okay so the tcpmss helper command sets the MSS (Maximum Segment Size) of TCP SYN packets that get routed through the firewall. why do we care? because sometimes Path MTU Discovery is just NOT working — it's flaky, it's messy, it's not showing up for you — and packet fragmentation isn't possible either. and when those two things fail together? your connections are lowkey doomed. that's where this comes in. 🫶

now, the mss part:

• a numeric mss will set the MSS of TCP connections to the value you give it. you pick a number, it uses that number, no cap.
• the word auto will set the MSS to the MTU of the outgoing interface minus 40. that's the clamp-mss-to-pmtu behaviour, iykyk. 😌

and here's the part where you need to pay attention to where you write it, because placement changes everything:

• if you use it inside a router or interface definition, the MSS gets applied to outgoing traffic on the outface(s) of that router or interface. main character placement.
• if you use it before any router or interface definitions, it gets applied to all traffic passing through the firewall. big scope energy.
• and if if-list is given, the MSS gets applied only to those interfaces. so you can be picky, and honestly? slay.

⚠️ real talk: this exists to work around broken Path MTU Discovery. it is not a cute decorative accessory, it is a fix. use it on purpose. 💀

---

🔥 EXAMPLES 🔥

here's how it actually looks, copy-paste girlies:

tcpmss auto

tcpmss 500

tcpmss 500 "eth1 eth2 eth3"

see? auto when you want it to figure itself out. 500 when you're being specific. and a whole little squad of interfaces in quotes when you're feeling selective. iconic behaviour, fr fr. 💜

---

🌈 SEE ALSO 🌈

go read these too, bestie, they're all connected:

• firehol(1) — the FireHOL program
• firehol.conf(5) — FireHOL configuration
• firehol-interface(5) — interface definition
• firehol-router(5) — router definition
• FireHOL Website
• FireHOL Online PDF Manual
• FireHOL Online Documentation
• https://www.frozentux.net/iptables-tutorial/iptables-tutori‐al.html#TCPMSSTARGET — TCPMSS target in the iptables tutorial

(that URL is long enough to need its own zip code, but it's the TCPMSS target section in the iptables tutorial, and it's worth the scroll. 🧚)

---

👑 AUTHORS 👑

FireHOL Team. absolute legends, no notes. 💖

---

okay that's the whole page, bestie!! this was FireHOL Reference, built 13 Apr 2025, from the firehol-tcpmss(5) manual — go forth and clamp those MSS values responsibly. 🎀💅✨