OpenVPN: Accessing devices without PMTUD via VPN: how to allow 1,500 byte packets to pass through unmodified?

Question

I'm trying to see if I can access a particular type of switches over an OpenVPN connection. I have the following situation;

I can't access the management console of these type of switches, as they have bugs dealing with packet fragmentation and maximum packet size. The switches must be considered dumb and must be able to communicate assuming the packet fragment size of any incoming and outgoing message is always exactly 1,500 bytes. This happens to match the maximum size supported by the internet connection in between, so I'd like a solution without Jumbo Frames.

By default, openVPN will use packet fragmentation messages to tell the devices involved to limit their packet size to say 1,470 or whatever fits within the encapsulation. But these devices will simply ignore such things and keep sending (and expecting to receive, when getting POST requests) 1,500 byte TCP packets, ignoring the PMTUD requests.

Is there a way to modify or configure openVPN so that it will fragment and reassemble packets instead (I understand this will lower performance, but this is just a management network, so that is of little concern)? Then all the relevant bits of the network are under my control and I can get the device the packet size it wants.

OpenVPN configuration is notoriously terrible to use. What options do I set to what values to get this to work?

Answer 1

The correct approach, at least in one case, appeared to be the following:

1. Ping the target switch with packets of various sizes using the do-not-fragment bit (the -f option) until you find the largest size, name this x.
2. Configure tun-mtu x; mssfix x-40;

I can't provide a detailed explanation why this works, only that it (in some cases) did.