I’ll show what I came up with today, maybe it can serve you as a reference.
Finally it works as intended.
If your connection is still stuck, try inspecting packet flow in RouterOS with Packet Sniffer tool and on LibreSwan side with tcpdump.
I have my LAN with Mikrotik box here, and on remote I have a Linux VPS.
All traffic generated by chosen apps in LAN (just Firefox for now) are assigned a DSCP value of 42 in IP header on my computers (I use cgroups for that). Those connections are forwarded into IPsec tunnel by the router.
Also, all traffic from guest Wi-Fi network also goes into the tunnel.
Remote side assigns IP address 192.168.5.57 to my router for the tunnel endpoint.
My policies:
[rondo@runesave] /ip firewall address-list> /ip ipsec policy print
Flags: T - template, X - disabled, D - dynamic, I - invalid, A - active, * - default
# PEER TUN SRC-ADDRESS DST-ADDRESS PROTOCOL ACTION LEVEL
0 T * ::/0 ::/0 all
1 192.168.5.56/29 192.168.0.0/16 all none
2 T ::/0 ::/0 all
3 DA ik.. yes 192.168.5.57/32 0.0.0.0/0 all encrypt unique
Policy #2 (template) is the main one. With this template policy #3 is generated, saying that everything with source IP of 192.168.5.57 (tunnel endpoint) should be encrypted and sent over the tunnel.
Policy #1 I came up with was the hard part. It says that ICMP “fragmentation needed” messasges, used in normal TCP data flow, generated locally on router, also with source IP of 192.168.5.57 and destined for LAN should not be encrypted and go into the tunnel! They should go directly to LAN, thus the action is “none” (leave them alone)
Before I added this policy, things worked, but on many websites some of their resources were broken.
Mangle table
[rondo@runesave] /ip firewall address-list> /ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic
<...>
5 ;;; detect magic DSCP
chain=prerouting action=mark-connection new-connection-mark=ipsec passthrough=yes connection-state=new
dst-address-list=!direct_route connection-mark=no-mark in-interface-list=lans dscp=42 log=no log-prefix=""
6 chain=prerouting action=change-dscp new-dscp=0 passthrough=no in-interface-list=lans dscp=42 log=no log-prefix=""
7 ;;; guest Wi-Fi
chain=prerouting action=mark-connection new-connection-mark=ipsec passthrough=yes connection-state=new src-address=!192.168.4.7
dst-address=!192.168.0.0/16 dst-address-list=!direct_route connection-mark=no-mark in-interface=vlan_wifi_guest log=no
log-prefix=""
dynamic srcnat rule generated by IPsec subsystem:
/ip firewall address-list> /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; ipsec mode-config
chain=srcnat action=src-nat to-addresses=192.168.5.57 src-address-list=local dst-address-list=!local connection-mark=ipsec