MikroTik RouterOS v2.9 Reference Manual page 470

Change MSS
It is a well known fact that VPN links have smaller packet size due to incapsulation overhead. A
large packet with MSS that exceeds the MSS of the VPN link should be fragmented prior to sending
it via that kind of connection. However, if the packet has DF flag set, it cannot be fragmented and
should be discarded. On links that have broken path MTU discovery (PMTUD) it may lead to a
number of problems, including problems with FTP and HTTP data transfer and e-mail services.
In case of link with broken PMTUD, a decrease of the MSS of the packets coming through the VPN
link solves the problem. The following example demonstrates how to decrease the MSS value via
mangle:
[admin@MikroTik] > /ip firewall mangle add out-interface=pppoe-out \
\... protocol=tcp tcp-flags=syn action=change-mss new-mss=1300 chain=forward
[admin@MikroTik] > /ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=forward out-interface=pppoe-out protocol=tcp tcp-flags=syn
action=change-mss new-mss=1300
[admin@MikroTik] >
Page 456 of 695
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.