In some cases, like a WAN Loadbalance configuration with different MTU in the WAN interfaces, PMTU still needed to make sure sites that are MTU-dependent doesn't break when the WAN switching to the interface that has a different MTU (happens when it has lower MTU) than the initial WAN interface.
As tcp-mss pmtu is currently removed in followup of T2868 and this feature request made in followup for T2868#80746 to move tcp-mss pmtu to different CLI with different logic.
I'm currently running this, but I still had to clamp the MSS to the client interface as the WAN interface shifted to the interface that has the lowest MTU, some sites with SSL become unreachable. Occasionally, the WAN interface that has a bigger MTU runs at a slower performance without altering the MSS of the client interface to follows the MSS value of the currently running WAN interface.
Here are my firewall options.
vyos@vyos# show firewall options
interface eth0.15 {
adjust-mss 1200
}
interface eth0.20 {
adjust-mss 1200
}
interface eth0.99 {
adjust-mss 1420
}
interface wg0 {
adjust-mss 1200
}
interface wg1 {
adjust-mss 1200
}@raphielscape Could you re-test it?
vyos@r14# set interfaces ethernet eth0 ip adjust-mss Possible completions: clamp-mss-to-pmtu Automatically sets the MSS to the proper value <500-65535> TCP Maximum segment size in bytes