There is TCPMSS target to edit MSS value of connections (including forwarded).

How to edit window size (for example, cap to some maximum value) by iptables rule?

Expecting something like

iptables -t mangle -A OUTPUT -p tcp --dport 1234 -j TCPWINDOW --tcpwindow-set 'min(val,100000)'
  • Have to admit, pretty curious as to why you would want to do this? – Kyle Brandt Aug 1 '13 at 19:59
  • I'm playing with traffic shaping currently and looking for various ways to limit inbound TCP traffic. I think capping the receive window + adding some delay (tc qdisc ... netem delay ...) can more or less cleanly set the speed of receiving without crude things like intentionally dropping valid packets. – Vi. Aug 1 '13 at 20:24
  • 1
    Dropping packets is a valid way to inform about congestion. Other way is using ECN (rfc3168), if both ends support it. – Teftin Aug 1 '13 at 23:03

To change TCP window from iptables you need to:

iptables -t mangle -I OUTPUT -p tcp --sport 80 --tcp-flags SYN,ACK SYN,ACK -j TCPWIN --tcpwin-set 1000

| improve this answer | |

Yes, you can use the option --set-mss to achieve this.


iptables -I FORWARD -o ppp0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1492

Documentation: http://www.linuxtopia.org/Linux_Firewall_iptables/x4700.html

| improve this answer | |
  • 1
    MSS and TCP Window are similar but still different things. – Bratchley Mar 31 '15 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.