"Thanks to our new cloudflare DDOS protection, you must drop the MSS on your host to 1432."
Uh... where? On the physical interface? On the virtual bridge? On each of the virtual interfaces for the jails? All of them?
tbf, that's not a host problem, just another annoyance I get to figure out. Probably best to change it everywhere to hold fragmentation down?