@@ -587,7 +587,7 @@ routing.

   packets larger than ``tun-mtu`` (e.g. Linux and FreeBSD) but other platforms

   (like macOS) limit received packets to the same size as the MTU.

+--tun-mtu-max maxmtu

   This configures the maximum MTU size that a server can push to ``maxmtu``,

   by configuring the internal buffers to allow at least this packet size.

   The default for ``maxmtu`` is 1600. Currently, only increasing beyond 1600

@@ -2916,7 +2916,7 @@ frame_finalize_options(struct context *c, const struct options *o)

     /* We always allow at least 1600 MTU packets to be received in our buffer

      * space to allow server to push "baby giant" MTU sizes */

-    frame->tun_max_mtu = max_int(1600, frame->tun_max_mtu);

+    frame->tun_max_mtu = max_int(TUN_MTU_MAX_MIN, frame->tun_max_mtu);

     size_t payload_size = frame->tun_max_mtu;

@@ -69,6 +69,11 @@

 #define TUN_MTU_DEFAULT 1500

 /*

+ * Minimum maximum MTU

+ */

+#define TUN_MTU_MAX_MIN 1600

+

+/*

  * MTU Defaults for TAP devices

  */

 #define TAP_MTU_EXTRA_DEFAULT 32

@@ -297,6 +297,7 @@ static const char usage_message[] =

     "--tun-mtu-extra n : Assume that tun/tap device might return as many\n"

     "                  as n bytes more than the tun-mtu size on read\n"

     "                  (default TUN=0 TAP=%d).\n"

+    "--tun-mtu-max n : Maximum pushable MTU (default and minimum=%d).\n"

     "--link-mtu n    : Take the TCP/UDP device MTU to be n and derive the tun MTU\n"

     "                  from it.\n"

     "--mtu-disc type : Should we do Path MTU discovery on TCP/UDP channel?\n"

@@ -4844,8 +4845,9 @@ usage(void)

     fprintf(fp, usage_message, title_string, o.ce.connect_retry_seconds,

             o.ce.connect_retry_seconds_max, o.ce.local_port, o.ce.remote_port, TUN_MTU_DEFAULT,

-            TAP_MTU_EXTRA_DEFAULT, o.verbosity, o.authname, o.replay_window, o.replay_time,

-            o.tls_timeout, o.renegotiate_seconds, o.handshake_window, o.transition_window);

+            TAP_MTU_EXTRA_DEFAULT, TUN_MTU_MAX_MIN, o.verbosity, o.authname, o.replay_window,

+            o.replay_time, o.tls_timeout, o.renegotiate_seconds, o.handshake_window,

+            o.transition_window);

     fflush(fp);

 #endif                                       /* ENABLE_SMALL */

@@ -7011,7 +7013,7 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file,

             options->ce.occ_mtu = 0;

         }

     }

-    else if (streq(p[0], "tun-mtu-max") && p[1] && !p[3])

+    else if (streq(p[0], "tun-mtu-max") && p[1] && !p[2])

     {

         VERIFY_PERMISSION(OPT_P_MTU | OPT_P_CONNECTION);

         int max_mtu = positive_atoi(p[1], msglevel);

@@ -721,7 +721,7 @@ prepare_push_reply(struct context *c, struct gc_arena *gc, struct push_list *pus

         {

             msg(M_WARN,

                 "Warning: reported maximum MTU from client (%d) is lower "

-                "than MTU used on the server (%d). Add tun-max-mtu %d "

+                "than MTU used on the server (%d). Add tun-mtu-max %d "

                 "to client configuration.",

                 client_max_mtu, o->ce.tun_mtu, o->ce.tun_mtu);

         }