set interfaces ethernet <interface> ip adjust-mss <mss | clamp-mss-to-pmtu> adds a nft rule which modifies the TCP SYN MSS value in postrouting when going OUT via the <interface>, but it doesn't modify the the TCP SYN MSS value passing through FROM <interface>.
Here is what adjust-mss sets:
nft add rule raw VYOS_TCP_MSS 'oifname "<IFNAME>" tcp flags & (syn|rst) == syn tcp option maxseg size set rt mtu'
or
nft add rule raw VYOS_TCP_MSS 'oifname "<IFNAME>" tcp flags & (syn|rst) == syn tcp option maxseg size 1461-65535 tcp option maxseg size set 1460'
There should also be an additional rule for forward, something like eg:
chain mangle_forward {
type filter hook forward priority mangle; policy accept;
iifname "<IFNAME>" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu
}Per the nftables documentation:
Note: The TCP maximum segment size is announced through TCP options in the original syn and the reply syn+ack packets. TCP maximum segment size is not negotiated, the RFC specifies that it is possible to have different TCP maximum segment size in each direction of the flow. Therefore, make sure you mangle both the TCP options of the original syn and the reply syn+ack packets. - https://wiki.nftables.org/wiki-nftables/index.php/Mangling_packet_headers
If useful I can include a diagram of when the forward mss adjustment is required.