Benny Amorsen <benny+usenet at amorsen.dk> writes: > -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1380 This is, unfortunately, wrong. It should be: -A FORWARD -p tcp -m tcp -m tcpmss --tcp-flags SYN,RST SYN ! --mss 0:1380 -j TCPMSS --set-mss 1380 Otherwise set-mss will increase mss if mss is below 1380. Oops. /Benny