I've been following task [[ https://phabricator.vyos.net/T314 | T314 ]], but i believe this is a separate issue.
When using a virtual VyOS firewall, i cannot clamp MSS.
My particular setup is VyOS 1.2.0, using libvirtd 4.0, but i've tested on ESX 6.5 with the same results.
When trying to apply the following fix from T314 (though slightly modified), i get the following -
```
iptables -t mangle -I POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o tun0 -j TCPMSS --set-mss 1400
iptables -t mangle -I POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1400
```
```
root@vyos:/home/vyos# iptables-save -t mangle -c
# Generated by iptables-save v1.4.21 on Tue Feb 12 20:33:01 2019
*mangle
:PREROUTING ACCEPT [119690:106898908]
:INPUT ACCEPT [119261:106717952]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [105490:57099434]
:POSTROUTING ACCEPT [105490:57099434]
[0:0] -A POSTROUTING -o tun0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1400
[0:0] -A POSTROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1400
COMMIT
```
However, when i tried the same command on a physical VyOS box, the counters started incrementing.
```
iptables-save -t mangle -c
# Generated by iptables-save v1.4.20 on Tue Feb 12 20:25:38 2019
*mangle
:PREROUTING ACCEPT [843:107149]
:INPUT ACCEPT [589:59787]
:FORWARD ACCEPT [294:52053]
:OUTPUT ACCEPT [495:273495]
:POSTROUTING ACCEPT [789:325548]
[17:1028] -A POSTROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1400
```
I've searched around and the best i could come up with thus far is to disable tcp offloading with Ethtool, but that didn't make a difference -
```
ethtool -K tun0 tx off sg off tso off
ethtool -K eth0 tx off sg off tso off
ethtool -K eth1 tx off sg off tso off
```
I also tried using virtio, e1000, and rtl8139, plus the ethtool changes, none of which changed the results.
I'm clearly missing something, has anyone else run across this issue?