The MSS Rule Works on the Router, but Misses Squid

An administrator adds TCPMSS clamping to FORWARD. Direct routed traffic improves, but downloads through the local Squid instance still hang. The proxy's website connection is not simply the client's TCP connection passing through that chain.

In an ordinary terminating forward proxy, the client-facing connection ends locally. The proxy creates a second TCP connection toward the origin or parent. On Linux, packets generated for that connection follow the local output path.

A FORWARD-only rule can therefore be perfectly functional and still miss the handshake it was intended to adjust. Map the actual connection and the direction of the SYN before choosing a hook. Containers or separate namespaces can add another routed segment, so the correct placement depends on where the process runs.

Do not put the PMTU number directly into MSS

Path MTU is an IP-packet size. TCP MSS describes TCP payload and must account for the relevant headers. Likewise, a ping payload length is not the complete IP packet length. The familiar 28-byte addition is tied to a basic IPv4 ICMP echo arrangement, not every address family or encapsulation.

The TCPMSS target documents explicit values and PMTU clamping. Clamping still relies on the route's MTU information; it is not proof that path discovery is healthy or a replacement for allowing required ICMP messages.

Also match the symptom to the theory. A completed handshake followed by stalls on larger transfers can justify investigating packet size. Repeated unanswered SYNs or an immediate reset needs a wider explanation; small packets failing do not establish an oversized data segment.

Keep a working direct connection and a failing proxy connection distinct in the record. They can use different sources, routes and encapsulation, even from the same machine.