WireGuard MTU calculator

Enter your underlying link MTU (1500 for most connections, 1492 for PPPoE) to get the recommended WireGuard tunnel MTU and MSS clamp.

How to use the wireguard mtu calculator

  1. Enter your link MTU (1500 is typical; 1492 for PPPoE/DSL).
  2. Choose whether your endpoint is reached over IPv4 or IPv6.
  3. Read the recommended tunnel MTU and MSS clamp, and add the MTU line to your [Interface].

How the numbers are worked out

WireGuard wraps each packet in extra headers, so the tunnel MTU must be smaller than your underlying link. The overhead is about 60 bytes over IPv4 (20-byte IP header + 8 UDP + 32 WireGuard) and 80 over IPv6 (the IPv6 header is 40 bytes). On a standard 1500 link that gives a tunnel MTU of 1440 (IPv4) or 1420 (IPv6); 1420 is the safe all-round default. PPPoE/DSL links start at 1492, and mobile or CGNAT paths sometimes need less. The MSS clamp (tunnel MTU − 40) caps TCP segments so they fit without fragmenting: useful when path-MTU discovery is blocked. Set the result with an MTU = line in your config's [Interface] section; generate the rest with the config generator. The classic sign of a too-large MTU is small requests working while large pages and downloads stall.

Code & API examples

Use this from the command line or your code.

Set MTU in wg config
[Interface]
MTU = 1420
Find your link MTU (Linux)
ip link show

See all endpoints at /api/tools/.

Frequently asked questions

MTU (Maximum Transmission Unit) is the largest packet, in bytes, that a network link will carry without fragmenting it. Most Ethernet and home links use an MTU of 1500.

WireGuard wraps each packet in extra headers, so the tunnel must use a smaller MTU than the underlying link. Get it wrong and packets fragment or get dropped, causing stalls, slow speeds, and pages that won't load.

About 60 bytes over IPv4 and 80 over IPv6: a 20- or 40-byte IP header, 8 bytes of UDP, and 32 bytes of WireGuard framing. You subtract that from the link MTU to get the tunnel MTU.

On a standard 1500 link, use 1440 if the outer transport is IPv4 (1500 minus 60) and 1420 if it's IPv6 (1500 minus 80). When unsure, 1420 is the safe default because it survives both.

Check your interface ('ip link' on Linux, ifconfig/netsh elsewhere) or run a ping with do-not-fragment, increasing the size until it fails: the largest size that passes, plus 28, is your path MTU.

MSS clamping caps the TCP segment size so TCP packets fit the tunnel without fragmenting. Set MSS = MTU minus 40; on a 1420 tunnel that's 1380. It's especially useful when path-MTU discovery is being blocked.

SSH or small requests work but large pages, file downloads, or HTTPS sites hang or load partially. That selective failure (small packets fine, big ones stuck) is the classic MTU-too-large signature.

PPPoE adds 8 bytes of its own, so the link MTU is 1492, not 1500. That makes the WireGuard tunnel MTU roughly 1432 over IPv4 or 1412 over IPv6: enter 1492 as the link MTU to get the right value.

Often yes. Carrier networks, CGNAT, and 464XLAT can lower the effective MTU below 1500, so a tunnel of 1280-1400 is sometimes needed. If mobile stalls but Wi-Fi is fine, lower the MTU and retest.

Add an MTU line under the [Interface] section, e.g. MTU = 1420. wg-quick applies it when the tunnel comes up; without the line WireGuard auto-detects, which usually works but can guess wrong over tunneled or PPPoE links.

The IPv6 outer header is 40 bytes versus 20 for IPv4: 20 bytes more overhead. So if your endpoint is reached over IPv6, the tunnel MTU drops by an extra 20, e.g. from 1440 to 1420.

A conservative value like 1280 (the IPv6 minimum) almost always works and is a good troubleshooting fallback, but it's slightly less efficient because each packet carries less payload. Use the highest value that doesn't fragment for best throughput.
Related tools
WireGuard config generator WireGuard key generator Open port checker
Want to hide your IP for real?

vpn.golf is a no-logs WireGuard VPN. Pick a hole, take the shot.

Step up to the tee for free