I have VyOS-1.1.7 router with ipsec tunnel(s) and vlan(s) and I have problem with forwarding bigger packets (well-known mtu/tcp-mss problem).
I need to setup tcp-mss option for connections incoming from ipsec tunnel and outgoing to vlan.
I tried that:
set policy route mss rule 5 protocol 'tcp' set policy route mss rule 5 set tcp-mss '1366' set policy route mss rule 5 tcp flags 'SYN' set interfaces ethernet eth0 vif 10 policy route 'mss'
It works, but only in one direction (vlan -> ipsec). I checked iptables rules and found that:
Chain VYATTA_FW_IN_HOOK (1 references) pkts bytes target prot opt in out source destination 273K 501M mss all -- eth0.10 * 0.0.0.0/0 0.0.0.0/0
I checked manually added iptable rules: similar with "-o eth0.10" instead of "-i eth0.10" works, rule added to filter/FORWARD chain also works.
It is impossible to add policy to vti interface, it is impossible to add policy for ethernet/vlan interface for outgoing traffic.