How to use it
- Enter the MTU of the link under the tunnel, usually 1500 for Ethernet.
- Choose the encapsulation and, for IP tunnels, whether the tunnel itself runs over IPv4 or IPv6.
- Choose the IP version of the traffic inside, and add extra bytes for VLAN tags (4 each) or MPLS labels (4 each) on the path.
Formulas
- MTU inside = link MTU − overhead
- Overhead: PPPoE 8; GRE outer IP + 4; IP-in-IP outer IP; WireGuard outer IP + 8 UDP + 32; VXLAN outer IP + 8 UDP + 8 VXLAN + 14 inner Ethernet. Outer IP is 20 bytes for IPv4, 40 for IPv6.
- TCP MSS = MTU inside − IP header − 20
- Ping payload = MTU inside − IP header − 8
Worked example
WireGuard over IPv4 on a 1500-byte link, IPv4 inside:
- Overhead: 20 + 8 + 32 = 60 B.
- MTU inside: 1,500 − 60 = 1,440 B.
- TCP MSS: 1,440 − 20 − 20 = 1,400 B.
- Largest ping payload: 1,440 − 20 − 8 = 1,412 B.
Tips
- Clamp the MSS on the router when you cannot change every host: tools like iptables TCPMSS or nftables rewrite the MSS in SYN packets to the value above.
- Headers without options are assumed. IPv4 options, IPv6 extension headers and TCP options such as timestamps take a few more bytes, so real segments are often slightly smaller.
- Stacked tunnels add up. For WireGuard over PPPoE, enter 1492 as the link MTU.