So, I realized that when change-mss is enable in PPP profile, there is a bit of a problem...

If MAX MTU and MAX MRU is set = 1492
Two mangle rules are dynamically created (of course, this is with a version < 6.39)
One match traffic going to all-ppp interfaces and change MSS to 1452 when MSS is between 1453-65535
And another is to maatch traffic coming from all-ppp interfaces and change the same thing as the rule above.

But... If one PPP is connected and the other side (normally a router from a customer) is configure as MTU 1400, for example..... the rule for traffic coming from all-ppp is automaticaly changed with this new MTU as parameter. For this example, as 1400, the new action is to change mss to 1360

/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes \
protocol=tcp tcp-flags=syn

tcp-mss=1441-65535

tcp-mss=1453-65535

v6.40rc13 have this line in changelog:
*) ppp - fixed "change-mss" functionality (introduced in 6.39);

so i assume when it is confirmed to test your issue it will be included in v6.39.2

/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes \
protocol=tcp tcp-flags=syn

If we put this, all packets, even those with MSS lower will have MSS increased.

/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes \
protocol=tcp tcp-flags=syn

If we put this, all packets, even those with MSS lower will have MSS increased.

Is that a guess, or did you actually observe that?
It should only lower the MSS when too high, never increase it. When you observe increasing MSS by that rule,
please file a bug report to MikroTik (probably with pcap files with evidence).

Now this functionality is build-in into ppp interfaces themselves

no connection tracking, fastpath possible - everything much better.

no connection tracking, fastpath possible - everything much better.

well fasttrack enables you to use fastpath with NAT.

The choice is always "do I want to bother with fasttrack and get some additional performance" or "do I want a system where all features work".
For me, until now the choice has always been to disable fastpath and fasttrack, as fortunately everywhere where I need performance I have a CCR.
For others, it may be different and those tweaks may be welcome. Anyway, you can install the latest RC and test it.
I have used the "clamp to pmtu" rule and I think it has worked for me, I want to test if there really is the above mentioned bug in it but I doubt it.

Just updated whole my pppoe site to 6.39.2, you can forget about change-mss rules, it all is now nicely build-in into ppp interfaces, even with MRU now it works fine.

Could you see, please, if all PPPoE interfaces has same MTU?

I want to test it when MTU is not the same for all interfaces, just to see if will work in that case, or if is considering the minimal mtu to run this "new" algorithm.

Thank you for your time

Just updated whole my pppoe site to 6.39.2, you can forget about change-mss rules, it all is now nicely build-in into ppp interfaces, even with MRU now it works fine.

Just updated whole my pppoe site to 6.39.2, you can forget about change-mss rules, it all is now nicely build-in into ppp interfaces, even with MRU now it works fine.

Just updated whole my pppoe site to 6.39.2, you can forget about change-mss rules, it all is now nicely build-in into ppp interfaces, even with MRU now it works fine.

this is out of topic but I would like to ask in interface pppoe-server server side, how should i set service. should i set max-mtu=1480 max-mru=1480 mrru=1600 or should i set them auto ?

thanks

Just updated whole my pppoe site to 6.39.2, you can forget about change-mss rules, it all is now nicely build-in into ppp interfaces, even with MRU now it works fine.

Is not the following rule necessary?

/ip firewall mangle
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes \
protocol=tcp tcp-flags=syn

Hi ploquets
thank you for your great info..
My network is bridged network. and to sending customer pppoe_client connection to pppoe_server Im uinsg EoIP tunnels.
EoIP tunnels MTU is auto, when i check them actual MTU size is 1458 both side. I bridge wlan interface and EoiP interface at AP side. also pppoe bridge mtu is auto and actual MTU =1458.
On EoiP tunnels settings are as here;

Code: Select all

name="xxxx" mtu=auto actual-mtu=1458 l2mtu=65535 mac-address=02:91:77:9D:A7:B2 arp=enabled arp-timeout=auto loop-protect=default loop-protect-status=off 
      loop-protect-send-interval=5s loop-protect-disable-time=5m local-address=xxxxx remote-address=xxxx tunnel-id=xxx dscp=inherit clamp-tcp-mss=yes 
      dont-fragment=no allow-fast-path=yes 

and at PPPoEServer

Code: Select all

/interface pppoe-server server
add authentication=pap disabled=no interface=eoip max-mru=1480 max-mtu=1480 mrru=1600 one-session-per-host=yes service-name=XoMniTik

should i change mtu for EoIP , servers or another interface to increase performance ?

Thanks

MTU from all interfaces should be at least 1542

If you consider PPPoE over this L2 EoIP (which I guess is the case) you will need at least 1550 (to deliver the normal 1500 for the PPPoE interface).

Hi ploquets
thank you for your great info..
My network is bridged network. and to sending customer pppoe_client connection to pppoe_server Im uinsg EoIP tunnels.
EoIP tunnels MTU is auto, when i check them actual MTU size is 1458 both side. I bridge wlan interface and EoiP interface at AP side. also pppoe bridge mtu is auto and actual MTU =1458.
On EoiP tunnels settings are as here;

Code: Select all

name="xxxx" mtu=auto actual-mtu=1458 l2mtu=65535 mac-address=02:91:77:9D:A7:B2 arp=enabled arp-timeout=auto loop-protect=default loop-protect-status=off 
      loop-protect-send-interval=5s loop-protect-disable-time=5m local-address=xxxxx remote-address=xxxx tunnel-id=xxx dscp=inherit clamp-tcp-mss=yes 
      dont-fragment=no allow-fast-path=yes 

and at PPPoEServer

Code: Select all

/interface pppoe-server server
add authentication=pap disabled=no interface=eoip max-mru=1480 max-mtu=1480 mrru=1600 one-session-per-host=yes service-name=XoMniTik

should i change mtu for EoIP , servers or another interface to increase performance ?

Thanks

Hello!
Since PPPoE client is using L2 MTU to reach the other side (PPPoE Server) you should be OK using 1492 as Max MTU
BUT...., keep in mind that what really matter is the path where EoIP is using, switches, interfaces, etc...
This path need to be able to pass the L3 MTU, because, EoIP is a method to stretch an L2 path inside L3 path.

The EoIP packet is up to 1542 byte in size (1500 bytes eoip MTU + 42 bytes EoIP header). If you want to use EoIP without any fragmentation, your MTU from all interfaces should be at least 1542.
And this to pass the normal 1500 bytes.

If you consider PPPoE over this L2 EoIP (which I guess is the case) you will need at least 1550 (to deliver the normal 1500 for the PPPoE interface).

So, EoIP normally will fragments packets and this will cause less performance, even if your PPPoE is 1500, EoIP will fragment those packets cause it needs 42 bytes of header.
Maybe would be better if you use VPLS, but, keep in mind Layer2 MTU to consider VPLS.

Here is a MUM video which you could learn about it:
https://www.youtube.com/watch?v=Q8AF-Srulmk

you need following rule before fasttrack-connection otherwise SYN packets will be fasttracked and clamp-tcp-mss will break

/ip firewall filter
add action=accept chain=forward comment="tcp syn no-FP" connection-state=established,related \
protocol=tcp tcp-flags=syn

fyi.

Since version 6.39, mangle rules it not needed anymore.