Skip to contentMTU, Fragmentation and Why Your WireGuard Is Slow
If your WireGuard tunnel connects but crawls, stalls on large transfers, or hangs on certain sites, the usual culprit is MTU. This guide explains what MTU and fragmentation are, why tunnels break packet sizes, and the exact setting to change.
What MTU is and why tunnels break it
MTU (Maximum Transmission Unit) is the largest packet, in bytes, that a network link will carry in one piece. Ethernet's standard MTU is 1500. When a packet is too big for a link, it must be fragmented into smaller pieces or dropped.
A WireGuard tunnel wraps each of your packets inside an encrypted UDP packet, and that wrapper adds overhead — roughly 60 bytes for IPv4 and 80 for IPv6. So a full-size 1500-byte packet from your app becomes larger than 1500 once WireGuard encapsulates it, and the underlying link cannot carry it whole. This is why WireGuard defaults its interface MTU to 1420: it leaves headroom for the encryption overhead so the encapsulated packet still fits in a 1500-byte path.
Why the wrong MTU makes you slow
Normally, when a packet is too big to forward without fragmentation, a router sends back an ICMP "Fragmentation Needed" message and the sender lowers its packet size — this is Path MTU Discovery (PMTUD). The problem is that many networks and firewalls silently drop those ICMP messages. When that happens you get a PMTU black hole: small packets (like the start of a page) sail through, but large packets are silently discarded with no error. The symptom is unmistakable — connections start, then hang; SSH logs in but freezes on output; some sites load and others stall; large downloads stick at 0%.
If your path has a lower MTU than expected — common on DSL/PPPoE (which adds 8 bytes), some mobile networks, and double-encapsulated links — even WireGuard's 1420 can be too high, and you hit the black hole. The fix is to lower the tunnel's MTU so the encapsulated packets fit the real path.
Find and set the right MTU
Probe the largest packet that traverses your path without fragmentation, then set the WireGuard interface MTU below it. Values are examples; test yours.
# 1) Probe path MTU with don't-fragment pings (Linux/macOS). # Lower the size until it succeeds; that size + 28 = path MTU. ping -M do -s 1472 8.8.8.8 # 1472 + 28 (ICMP/IP headers) = 1500 ping -M do -s 1392 8.8.8.8 # if 1472 fails, try smaller (=> 1420) ping -M do -s 1252 8.8.8.8 # a safe fallback (=> 1280) # 2) Set the tunnel MTU in your WireGuard config, under [Interface]: # [Interface] # MTU = 1280 # widely-compatible fallback; try 1412/1420 first # 3) Apply and test a large transfer: wg-quick down wg0 && wg-quick up wg0 curl -o /dev/null https://speed.example/largefile # Rule of thumb: if small requests work but big ones hang, LOWER the MTU. # 1420 -> 1412 -> 1280 are common steps. 1280 is the IPv6 minimum and # almost always passes, at a small efficiency cost.
Questions, answered
What MTU should I use for WireGuard?
Start with WireGuard's default of 1420. If large transfers hang while small requests work, lower it — common steps are 1412, then 1280. 1280 is the IPv6 minimum MTU and almost always works, at a slight efficiency cost. Probe your path with don't-fragment pings to find the highest value that passes.
Why does WireGuard connect but then stall on large files?
Almost always a PMTU black hole. Your packets are too big for the path, and the ICMP messages that would signal it are being dropped, so large packets vanish silently while small ones succeed. Lowering the tunnel MTU makes packets fit and fixes the stall.
Why is WireGuard's default MTU 1420 and not 1500?
Because WireGuard encapsulates each packet in encrypted UDP, adding about 60 bytes (IPv4) of overhead. Setting the interface MTU to 1420 leaves room for that overhead so the encapsulated packet still fits within a standard 1500-byte path without fragmentation.
A tunnel tuned to just work
s4m runs WireGuard and OpenVPN with sensible defaults and a no-logs, RAM-first design. If a network needs a lower MTU, adjust one line and you are set. Anonymous accounts, crypto accepted.
People found this page by searching for
- MTU, fragmentation and why your WireGuard is slow
- how to configure wireguard
- wireguard explained
- wireguard
- proxy for scraping explained
- ip address for beginners
- free proxies vs paid proxies
- socks5 proxy plans
- openvpn for android
- proxy setup
- how to hide your IP address
- how to fix 429 too many requests when scraping
- http proxy for business
- how openvpn works
- proxy authentication
- proxy setup list txt
- http proxy
Real search phrases this page answers — the linked ones open the page that covers them in depth.