Why does the traffic in the IPsec tunnel stop when transferring a heavy file?

Question

VPN

Available: IPsec StrongSwan and L2TP/IPsec Keenetic 4G III servers. Both work stably, they are geographically located in different places, clients successfully connect and work, StrongSwsn even has a permanent tunnel with another office (everything is ok). But when I myself connect from home, some kind of devilry is going on.

At home: PC with Win10 2004, laptop with Win10 1903, Keenetic Giga router. Connection to StrongSwan (IKEv2) via certificate, to Keenetic4G III (L2TP/IPsec) via PSK.

When connected by wire (both from a computer and from a laptop) to any of the servers, the tunnel is created and functions. But, if you start transferring a file (for example, 500MB in size), then after transferring 100-200MB (in different ways), the traffic stops going, when you connect to RDP, the situation is the same (a couple of minutes of work and that's it). In this case, the tunnel is preserved (at least on the StrongSwan server).

If the connection is wireless (via wi-fi), then everything works flawlessly. I also tried to replace my home router with Miktotik - it works stably.

Tell me which way to dig.

UPD: I tried it on a Linux computer (strongswan client) - it works without problems

Answer 1

It is solved by disabling unnecessary components on the home router (Keenetic giga NDMS v2.04), in particular, the "hardware packet handler" .
But, what is the reason for this behavior, I did not understand. There was an assumption that the router could not cope with packet fragmentation, but experiments with MTU did not lead to anything.
But on Linux, everything works fine - with the included components on the router, by wire / without wire.

Answer 2

Try reducing the MTU on the VPN, to 512 for example. In theory it should help.

Answer 3

I also tried to replace my home router with Miktotik - it works stably.

Tell me which way to dig.

In the direction of replacing the complete miserable kinetics with microtics. There is nothing falling and everything works perfectly.

Answer 4

It rests on the processor of the router (prolonged overload) and the settings for disconnecting the connection when there is no connection. The router OS cannot process the ping in the tunnel and thinks it has failed. Play around with the cliff detection settings.