Account for encapsulation and MTU

Every tunnel adds outer headers. The wrapped packet is larger than the original packet. That small piece of arithmetic produces some of the strangest bugs you will ever debug.

A network interface has a Maximum Transmission Unit, or MTU: the largest packet it agrees to carry. Ethernet links commonly use 1500 bytes. WireGuard’s outer headers consume about 60 of those bytes on IPv4, so the tunnel interface must advertise a smaller MTU. wg-quick handles this for you, which is why you typically see 1420:

ip link show wg0
# 4: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue ...

If a protected packet becomes too large for some link on the path, the path must fragment it or tell the sender to use a smaller size. Modern senders set the Don’t Fragment flag and rely on ICMP “packet too big” messages coming back — that mechanism is Path MTU Discovery. Firewalls that silently drop ICMP break it.

Broken Path MTU Discovery has a signature: small requests work while larger transfers stall. The login page loads, the file download hangs at zero. Ping succeeds, HTTPS to the same host freezes mid-response. Nothing errors — packets just vanish.

You can probe packet sizes deliberately. -M do forbids fragmentation, so failures reveal exactly where the limit sits:

ping -c 1 -M do -s 1392 10.14.0.1
# 1392 data bytes + 28 header bytes = 1420: fits, replies arrive

ping -c 1 -M do -s 1400 10.14.0.1
# ping: local error: message too long, mtu=1420

If sizes fail well below the interface MTU, some link on the path is smaller than everyone assumed — a PPPoE connection at 1492 is a classic cause.

Do not guess first. Compare working and failing packet sizes, inspect the interface MTU, and change it only with evidence. When the evidence points to a smaller path, set MTU = 1380 in the [Interface] section and test again.

The mistake to avoid is the reflex fix: lowering MTU to some tiny value at the first sign of trouble. It often masks the symptom, costs throughput on every packet, and leaves the real cause — usually an ICMP-dropping firewall — in place.