At my github openconnect client fork, I have a patch which allows explicit MTU detection after the DTLS channel is established. It uses binary search over IPv4 and the value of the MTU got from ICMP6 messages. It is tested both against ocserv and cisco ASA. https://github.com/nmav/openconnect-mine/commit/880cff4757233ac550876fe56df985e6e4b99498
