MTU troubles using IKEv2 providers like NordVPN [work around]

[mike7]

The default template will be moved to the top of the list if it was not already there. The second line should above (action=none) should be below default and above any added IKEv2 provider lines.

The explaination by Sindy.

Anyway, there should be a remedy - a static IPsec policy action=none src-address=0.0.0.0/0 dst-address=the.client’s.subnet placed before the policy template which is used to build the dynamic policy with the responder-provided IP address as src-address. This action=none policy will shadow the dynamically generated one so even though the ICMP code 3 type 4 packet will likely get src-nated by the dynamic src-nat rule, it will not reach the dynamic policy (which would divert it into the tunnel) so it will make it to the client. The client won’t care about the source address as it has no relevance for it, so it should adjust the size of the re-sent TCP packet and all the subsequent ones accordingly.

This solved my long standing problem. with that work around and many many thank to Sindy for suggesting this!

Looks like in the next release Mikrotik will place dynamic policies in the top of the list or I misunderstand something?
From 6.47rc2 changelog:
*) ipsec - place dynamically created IPsec policies at the begining of the table;