note down the MTU MSS issue, which really matter if VPN running on NAT router