One row per field. The total sets the tunnel MTU.
Generated from the numbers above. Set your interface name under Stack options.
The interface MTU only covers packets your own machine originates. A host behind your router sends full size, the router drops it and replies with ICMP "fragmentation needed", and the sender retries smaller. That is path MTU discovery, and plenty of networks filter the ICMP it needs. The sender then retransmits a packet that cannot fit, forever: ping and SSH work, the session freezes when something large moves.
Clamping the MSS skips discovery. The router rewrites the MSS option in the TCP SYN, so both ends agree on a segment size that fits before data flows. UDP has no equivalent, so a badly sized tunnel still breaks QUIC and VPN-in-VPN after the TCP clamp makes the web look fine.
The path MTU above is an assumption until you measure it. Send an ICMP echo with don't-fragment set at a fixed payload: if it returns, that size fits. Binary search between a size that works and one that fails, then add 28 bytes for the IPv4 and ICMP headers.
Each protocol at your current path MTU, outer IP version and link layer, with default options.