There is TCPMSS target to edit MSS value of connections (including forwarded).

How to edit window size (for example, cap to some maximum value) by iptables rule?

Expecting something like

iptables -t mangle -A OUTPUT -p tcp --dport 1234 -j TCPWINDOW --tcpwindow-set 'min(val,100000)'
  • Have to admit, pretty curious as to why you would want to do this? Aug 1, 2013 at 19:59
  • I'm playing with traffic shaping currently and looking for various ways to limit inbound TCP traffic. I think capping the receive window + adding some delay (tc qdisc ... netem delay ...) can more or less cleanly set the speed of receiving without crude things like intentionally dropping valid packets.
    – Vi.
    Aug 1, 2013 at 20:24
  • 1
    Dropping packets is a valid way to inform about congestion. Other way is using ECN (rfc3168), if both ends support it.
    – Teftin
    Aug 1, 2013 at 23:03

2 Answers 2


To change TCP window from iptables you need to:

iptables -t mangle -I OUTPUT -p tcp --sport 80 --tcp-flags SYN,ACK SYN,ACK -j TCPWIN --tcpwin-set 1000


Yes, you can use the option --set-mss to achieve this.


iptables -I FORWARD -o ppp0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1492

Documentation: http://www.linuxtopia.org/Linux_Firewall_iptables/x4700.html

  • 1
    MSS and TCP Window are similar but still different things.
    – Bratchley
    Mar 31, 2015 at 14:50
  • MSS is akin to IP MTU, so instead of reducing the window size you'd get smaller messages than the path MTU allows for, but still the same window size. Jan 2, 2021 at 21:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .