| From: Andrei Borzenkov arvidjaar@gmail.com
| It sounds like the documentation bug. For all I can tell, tcp-mss-clamp can | only be used in rich rules and all firewalld regression tests also use it only | in rich rules.
Thanks for the quick reply.
(That still leaves the problem of Firewalld crashing with a python stack dump.)
Speaking without a lot of knowledge:
I try to avoid Rich Rules since they feel like a kind of failure of the model of Firewalld.
I think clamping is required when forwarding is done: the application cannot just ask the (local) interface what its MTU is. So it seems natural to put this in a Policy Object. I guess not all forwarding is inter-zonal, but all mine is. Not all interfaces in a zone need to have the same MTU, but all mine do.
In the mean time, I will go look at Rich Rules again.
This might not be the whole picture. For example, I don't know:
- why PMTU discovery doesn't solve this problem
- how clamping can work in the face of end-to-end encryption.
- why my one router works and my other doesn't. They both run Fedora 38 with Firewalld and limit the upstream MTU to 1492.