I cannot surf some sites when I use PPPoE.

Use '/ip firewall mangle' to change MSS (maximum segment size) to a value less 40 bytes your connection MTU. For example, if you have encrypted PPPoE link with MTU=1492, set the mangle rule as follows:

/ip firewall mangle add protocol=tcp tcp-options=syn-only action=passthrough tcp-mss=1448

Change MSS

It is a well known fact that VPN links have smaller packet size due to incapsulation overhead. A large packet with MSS that exceeds the MSS of the VPN link should be fragmented prior to sending it via that kind of connection. However, if the packet has DF flag set, it cannot be fragmented and should be discarded. On links that have broken path MTU discovery (PMTUD) it may lead to a number of problems, including problems with FTP and HTTP data transfer and e-mail services.

In case of link with broken PMTUD, a decrease of the MSS of the packets coming through the VPN link solves the problem. The following example demonstrates how to decrease the MSS value via mangle:

[admin@MikroTik] > /ip firewall mangle add out-interface=pppoe-out action=change-mss \
\.. new-mss=1300 chain=forward
[admin@MikroTik] > /ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=forward out-interface=pppoe-out action=change-mss new-mss=1300
[admin@MikroTik] >

[admin@netalfa] > ip firewall mangle add out-interface=Panline action=change-mss \
\... new-mss=1448 chain=forward
tcp mss change works only on tcp syn packets

tcp mss change works only on tcp syn packets

ip firewall mangle add out-interface=ether1 action=change-mss new-mss=1448 chain=forward protocol=tcp tcp-flags=syn