diff --git a/internal/nftables/compiler.go b/internal/nftables/compiler.go
index b054955..0bb1f1a 100644
--- a/internal/nftables/compiler.go
+++ b/internal/nftables/compiler.go
@@ -838,7 +838,7 @@ func (c *Compiler) compileMSSClamp(state *FirewallState) {
 					Type:         2,
 					Offset:       2,
 					Len:          2,
-					Op:           0,
+					Op:           expr.ExthdrOpTcpopt,
 				},
 				&expr.Cmp{Op: expr.CmpOpGt, Register: 1, Data: mssBytes},
 				&expr.Immediate{Register: 1, Data: mssBytes},
@@ -847,7 +847,7 @@ func (c *Compiler) compileMSSClamp(state *FirewallState) {
 					Type:           2,
 					Offset:         2,
 					Len:            2,
-					Op:             1,
+					Op:             expr.ExthdrOpTcpopt,
 				},
 			)
 			state.Rules["forward"] = append(state.Rules["forward"], ManagedRule{
diff --git a/internal/nftables/compiler_test.go b/internal/nftables/compiler_test.go
index 37c3f7a..ac36125 100644
--- a/internal/nftables/compiler_test.go
+++ b/internal/nftables/compiler_test.go
@@ -1202,14 +1202,26 @@ func TestCompile_MSSClamp(t *testing.T) {
 		t.Fatalf("Compile() error: %v", err)
 	}
 
-	found := false
-	for _, r := range state.Rules["forward"] {
+	var rule *ManagedRule
+	for i, r := range state.Rules["forward"] {
 		if r.Tag == "mss:eth1" {
-			found = true
+			rule = &state.Rules["forward"][i]
 		}
 	}
-	if !found {
-		t.Error("MSS clamp rule not found in forward chain")
+	if rule == nil {
+		t.Fatal("MSS clamp rule not found in forward chain")
+	}
+
+	mss := []byte{0x05, 0x78}
+	want := []expr.Any{
+		&expr.Exthdr{DestRegister: 1, Type: 2, Offset: 2, Len: 2, Op: expr.ExthdrOpTcpopt},
+		&expr.Cmp{Op: expr.CmpOpGt, Register: 1, Data: mss},
+		&expr.Immediate{Register: 1, Data: mss},
+		&expr.Exthdr{SourceRegister: 1, Type: 2, Offset: 2, Len: 2, Op: expr.ExthdrOpTcpopt},
+	}
+	got := rule.Exprs[len(rule.Exprs)-len(want):]
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("MSS clamp exprs = %#v, want %#v", got, want)
 	}
 }