Use /ip firewall mangle to change MSS (maximum segment size) to a value less 40 bytes your connection MTU.
For example, if you have encrypted PPPoE link with MTU=1492, set the mangle rule as follows:
/ ip firewall mangle
add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1448
