Few months ago I setup a RB5009UPr+S+ (factory firmware 7.6, currently firmware 7.11.2) with few IPSEC VPN to 4 remote locations with 1 Mikrotik routers and 3 FritzBox routers.
As a background information, the RB5009UPr+S+ is connected to a Huawey LTE router setup in “bridge mode”, so the RB5009UPr+S+ has a public IP address on its ether8 interface.
I setup the firewall on RB5009UPr+S+ as of “Building Advanced Firewall” tutorial on Mikrotik web site.
After few tweaks everything worked decently until few weeks ago. I don’t think I changed anything relevant on RB5009UPr+S+ or on remote routers but now all VPNs have issues. At some point I updated the firmware on RB5009UPr+S+ and the ISP may have changed something.
Seems that ICMP and UPD traffic are flowing correctly but not TCP. For example, after opening a SSH session to a server, I can run a “ls -la” only few times after everything hang. I can open the initial connection to a web server, I receive back an initial response (for example a redirect), but nothing more. Seems that I cannot receive more that ~20k bytes of reply traffic over a TCP connection.
Read something about PMTUD issue, which I think I had at the beginning (slow VPN), but now the issue seems quite different because TCP connections hangs instead of being slow.
Notes:
- advanced firewall raw apparently doesn’t drop any tcp/icmp packet
- I can “ping www.google.it -l 1472 -f” but not more
- I can “ping […] -l 1410 -f” one of the fritzbox but not more
- I can “ping 192.168.10.1 -l 1418 -f” the remote mikrotik router but not more
- Seems that some SMB trafic sometimes flow
I tried setting with a “change MSS mangle rule” with a very low random MSS value (1350) and this seems to solve the issue but:
- I don’t understand why previously this was unneded
- if this is needed because now PMTUD is not working anymore and how to diagnose/solve this isuee
- how to input the proper value and to change (automagically) when needed to ensure continuity
Any input?