From dbbcf273e98f9efff9e644cf98207a3eac6fc63a Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Mon, 5 Dec 2005 01:22:50 +0000 Subject: Add note that TCPMSS is only valid in the mangle table (not true today, but maybe someday) --- extensions/libipt_TCPMSS.man | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'extensions') diff --git a/extensions/libipt_TCPMSS.man b/extensions/libipt_TCPMSS.man index da1bce2d..30668b02 100644 --- a/extensions/libipt_TCPMSS.man +++ b/extensions/libipt_TCPMSS.man @@ -3,6 +3,9 @@ the maximum size for that connection (usually limiting it to your outgoing interface's MTU minus 40). Of course, it can only be used in conjunction with .BR "-p tcp" . +It is only valid in the +.BR mangle +table. .br This target is used to overcome criminally braindead ISPs or servers which block ICMP Fragmentation Needed packets. The symptoms of this @@ -25,7 +28,7 @@ ssh works fine, but scp hangs after initial handshaking. Workaround: activate this option and add a rule to your firewall configuration like: .nf - iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN \\ + iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \\ -j TCPMSS --clamp-mss-to-pmtu .fi .TP -- cgit v1.2.3