IKEv2 and MTU (MSS / PMTUD)

Support came back to me on this and despite it was not solution it helped me in optimizing my MSS/PMTUD line in Mangle even more.

Till today I looked if a connection was marked as an IKEv2 connection by me and then apply the static/fixed MSS of 1382 in my case. I could not differentiate between down and upload and only upload needed the change in packet size.

In the support mail I received was written that the packets, I sent in the trace, were 1460 bytes and when trying I put just that number in the tcp-mss field and that worked to my surprise. Normally you put your static/fixed packet size range in there and that would be 1383-65000+ so that only packets in that range changed.

Now only the packets that are being uploaded did not react to automatic PMTUD or by the mangle line clamp-to-PMTUD so I tried to narrow that down. First WAN-in, this because IKEv2 uses PPPoE and that worked. Less packets handled meaning that download is PMTUD-ed in the background by RouterOS. So can I simplify it even more so that I am certain that I only handle in that line the upload traffic.

add action=change-mss chain=forward ipsec-policy=in,ipsec new-mss=1382 passthrough=yes protocol=tcp tcp-flags=syn

I am pleased that I can now pin down the packet size to maximum and also the cascaded router gets 14 bytes more of data, in each packet. Before it was limited to 1382 and now it receives 1396 bytes in a packet.