diff --git a/shadowsocks/obfsplugin/auth.py b/shadowsocks/obfsplugin/auth.py
index 51a1b00..a745e09 100755
--- a/shadowsocks/obfsplugin/auth.py
+++ b/shadowsocks/obfsplugin/auth.py
@@ -501,7 +501,7 @@ class auth_aes128_sha1(auth_base):
     def rnd_data_len(self, buf_size, full_buf_size):
         if full_buf_size >= self.server_info.buffer_size:
             return 0
-        tcp_mss = self.server_info.tcp_mss if self.server_info.tcp_mss < 1500 else 1500
+        tcp_mss = self.server_info.tcp_mss
         rev_len = tcp_mss - buf_size - 9
         if rev_len == 0:
             return 0
diff --git a/shadowsocks/tcprelay.py b/shadowsocks/tcprelay.py
index c26109f..3096e00 100644
--- a/shadowsocks/tcprelay.py
+++ b/shadowsocks/tcprelay.py
@@ -248,7 +248,9 @@ class TCPRelayHandler(object):
     def _update_tcp_mss(self, local_sock):
         self._tcp_mss = TCP_MSS
         try:
-            self._tcp_mss = local_sock.getsockopt(socket.SOL_TCP, socket.TCP_MAXSEG)
+            tcp_mss = local_sock.getsockopt(socket.SOL_TCP, socket.TCP_MAXSEG)
+            if tcp_mss > 500 and tcp_mss <= 1500:
+                self._tcp_mss = tcp_mss
             logging.debug("TCP MSS = %d" % (self._tcp_mss,))
         except:
             pass