pfSense » pfSense Plus

diff --git a/src/etc/inc/pfsense-utils.inc b/src/etc/inc/pfsense-utils.inc
index fd05786fb9..526bef7265 100644
--- a/src/etc/inc/pfsense-utils.inc
+++ b/src/etc/inc/pfsense-utils.inc
@@ -5009,12 +5009,15 @@ function fix_config_artifacts() {
      * ===================================================================
      */

-    // Remove MTU and MSS custom options for tunnels with a proper interface
-    // assginment. These are set automatically when the service restarts.
+    // Tunnels with assigned interfaces that need to be configured.
     $openvpn_dco_interfaces = [];
+
+    // Collect OpenVPN DCO tunnels with MTU/MSS custom options and
+    // strip those options. The filtered options will be used instead
+    // for any tunnels that have an assigned interface already
+    // configured with MTU and MSS.
     foreach (['openvpn/openvpn-server', 'openvpn/openvpn-client'] as $config_path) {
-        // Find OpenVPN tunnels with DCO and tun-mtu.
-        foreach (array_get_path($conf, $config_path, []) as $idx => $tunnel_config) {
+        foreach (array_get_path($conf, $config_path, []) as $config_idx => $tunnel_config) {
             if (!isset($tunnel_config['dco']) || ($tunnel_config['dco'] != 'enabled') ||
                 isset($tunnel_config['disable']) | empty($tunnel_config['custom_options'])) {
                 continue;
@@ -5047,40 +5050,49 @@ function fix_config_artifacts() {
                     );
                 }
                 $openvpn_dco_interfaces[$interface_name] = [
-                    'path' => "{$config_path}/{$idx}/custom_options",
+                    'path' => "{$config_path}/{$config_idx}/custom_options",
                     'value' => implode(';', $custom_options),
                     'description' => $description
                 ];
             }
         }
     }
+
+    // Avoid a notice for tunnels with appropriate interfaces.
+    $unconfigured_openvpn_dco_descriptions = [];
     foreach (array_get_path($conf, 'interfaces', []) as $interface_label => $interface_config) {
         if (!isset($openvpn_dco_interfaces[array_get_path($interface_config, 'if', '')])) {
+            // Skip unasiggned interfaces.
             continue;
         }
-        if (!array_path_enabled($interface_config, $interface_label) || empty($interface_config['mss'])) {
+        if (!array_path_enabled($interface_config, '')) {
+            // Skip disabled interfaces.
             continue;
         }
+        if (is_numericint($interface_config['mtu']) && is_numericint($interface_config['mss'])) {
+            // The assigned interface configuration takes precedence.
+            // The appropriate OpenVPN configuration for MTU/MSS is
+            // generated without including it in the custom options.
+            array_set_path($conf,
+                $openvpn_dco_interfaces[$interface_config['if']]['path'],
+                $openvpn_dco_interfaces[$interface_config['if']]['value']
+            );
+            $conf_write = true;

-        // Update custom options.
-        array_set_path($conf,
-            $openvpn_dco_interfaces[$interface_config['if']]['path'],
-            $openvpn_dco_interfaces[$interface_config['if']]['value']
-        );
-        $conf_write = true;
-
-        // Don't trigger a notice for tunnels already configured correctly.
-        unset($openvpn_dco_interfaces[$interface_config['if']]);
+            // Skip the notice on interfaces that already set MTU and MSS.
+            continue;
+        }
+        $unconfigured_openvpn_dco_descriptions[] = $openvpn_dco_interfaces[$interface_config['if']]['description'];
     }

     // File the notice.
-    if (!empty($openvpn_dco_interfaces)) {
+    if (!empty($unconfigured_openvpn_dco_descriptions)) {
         file_notice('OpenVPN',
             localize_text(
                 'The following OpenVPN tunnels have a non-default MTU or MSS configuration ' .
                 'with DCO enabled. This requires setting both MTU and MSS values in the ' .
                 'assigned interface configuration (Interfaces > Interface Assignments): %s',
-                implode(', ', array_column($openvpn_dco_interfaces, 'description'))
+                implode(', ', $unconfigured_openvpn_dco_descriptions)
             )
         );
     }