MTU (Maximum Transmission Unit) mismatches cause subtle, hard-to-diagnose network issues — connections that hang or fail only for certain traffic types. This guide covers understanding and troubleshooting these problems.
What MTU Is and Why Mismatches Cause Problems
MTU defines the largest packet size a network link can transmit without fragmentation — when a packet exceeds a link's MTU along its path, it must be fragmented (or dropped if fragmentation is disabled), and mismatched MTU configurations across a network path are a common, often-overlooked source of connectivity problems.
Common Symptoms of MTU Issues
- SSH connections that establish but hang on larger output
- Small requests work fine, but larger data transfers fail or hang
- VPN connections (see How to Set Up a VPN Server with WireGuard) that connect but pass no meaningful traffic
Why VPNs Are Particularly Prone to MTU Issues
VPN encapsulation adds overhead (encryption headers, tunnel headers) to each packet — if the underlying network's MTU doesn't account for this overhead, the effectively-usable MTU inside the tunnel is smaller than the outer network's MTU, and traffic sized for the outer MTU can fail once encapsulated.
Checking Your Current MTU
ip link show eth0Testing for MTU-Related Path Issues
ping -M do -s 1472 8.8.8.8-M do disables fragmentation, forcing the ping to fail if the packet is too large for any link along the path — systematically reducing the size (-s) reveals the actual maximum packet size the path supports.
Finding the Exact Working MTU (Binary Search Approach)
ping -M do -s 1400 8.8.8.8 # if fails, try smaller
ping -M do -s 1300 8.8.8.8 # if works, try larger between 1300-1400Systematically narrow down to find the exact maximum packet size that succeeds without fragmentation — the standard diagnostic technique ("Path MTU Discovery" manually performed).
Adjusting MTU on a VPN Interface
ip link set dev wg0 mtu 1380For WireGuard specifically, a slightly reduced MTU (accounting for encapsulation overhead) often resolves connectivity issues where the default MTU doesn't correctly account for the tunnel's actual overhead.
Configuring WireGuard's MTU Directly
[Interface]
MTU = 1380Set this directly in your WireGuard configuration rather than adjusting the interface manually after each connection, ensuring the correct MTU persists across reconnections.
Checking for ICMP Blocking (A Common Root Cause)
Path MTU Discovery relies on ICMP "Fragmentation Needed" messages — if a firewall along the path blocks ICMP entirely, PMTUD breaks, causing exactly this class of symptom (large packets silently dropped rather than properly negotiated); verify ICMP isn't being overly aggressively filtered somewhere in your path.
Testing After Adjustment
ping -M do -s 1372 YOUR_VPN_PEER_IPAfter adjusting MTU, retest to confirm the issue is genuinely resolved, not just masked or partially improved.
Common Errors
Small pings work fine but larger transfers still hang despite MTU adjustment — verify the MTU change was applied on both ends of the connection (client and server), since a mismatch on just one side can still cause issues.
Continue Reading
- How to Set Up a VPN Server with WireGuard
- How to Diagnose Network Packet Loss on a VPS
- How to Diagnose and Fix High Network Latency
Browse more articles in Advanced Networking & VPN.
