PPP + BCP Layer 2 VPN MTU, MRU, and MRRU

Tuning the MRU/MTU to make best use of the WAN MTU, i.e. ensuring there is no IPsec padding and getting the packet as close to the MTU as possible, is definitely the starting point. Even with encryption you can see the the number and size of the packets sent via the WAN interface using the packet sniffer.

I know that L2TP/IPsec AES with SHA-256 and no NAT-T is 80 bytes (so an MRU/MTU of 1420 with a WAN MTU of 1500), SHA-1 will be slightly less but MLPPP increases it and there is an ethernet header as well so it may take some testing to pin down the optimal size. Certainly with an MTU of 1450 each large source packet will generate three packets across the WAN, the MLPPP will be breaking the source packet into chunks less than the MTU, after IPsec the larger of these chunks will be greater than the WAN MTU and subjected to IP fragmentation.

The Mikrotik BCP implementation has limitations with VLAN-aware bridges in that VLANs don’t work as there is no mechanism to configure them on the BCP link. Regular bridges, which act like unmanged switches and pass any untagged or tagged ethernet frames on all ports, are fine but this may limit what else you can set up on the Mikrotik. EoIP is an alternative to BCP but with more overhead, you could do either EoIP/IPsec or unecrypted EoIP over L2TP/IPsec if you need to use VLAN-aware bridges.

Having optimised the MRU/MTU to avoid IP fragmentation you could in addition look at MSS clamping to optimise TCP packet size and boost performance further. As the bridge filter doesn’t have the appropriate matchers and actions it would be one of the few cases where the bridge settings use-ip-firewall and use-ip-firewall-for-vlan are used to force the layer 2 traffic between bridge ports, and including the BCP link, through some of the ip firewall chains to spot new TCP connections and clamp the MSS - see https://help.mikrotik.com/docs/display/ROS/Packet+Flow+in+RouterOS.

Mikrotiks are excellent value for money, very configurable but as with many products do have some annoying omissions and foibles.