WireGuard VPN Works on Wi-Fi but Hangs on Cellular: Set the MTU to 1280

Chris, painted like a highway headroom warning, waves down an oversized parcel truck stuck at a low tunnel mouth while a smaller one drives through — Illustration: LockerGnome

The symptom is strange enough that it doesn’t look like a network problem.

“You can ping devices on your local network, but SSH and TLS connections to your local network will hang,” the page says. SSH stalls at the start. Firefox sits on “Performing a TLS handshake with [website]” and never gets past it.

“The easiest way to detect this is just to have some things work but other things not,” the page says. “DNS might work, but TLS to a service you know is working won’t.”

Small packets get through. Ping and DNS fit. The first big packet of a TLS or SSH handshake doesn’t, and “your packets will simply be too big for the physical link and get dropped.” The page says this happens “particularly on LTE/5G,” where network overhead plus WireGuard’s own adds up.

Steal this

Set the MTU by hand when the tunnel half-works. If ping and DNS work over the VPN but web pages and SSH hang on cellular, open your WireGuard config and add MTU = 1280 under [Interface], then reconnect. Kerem Erkan, who chased his own MTU problem, now recommends 1280 because “it will encounter fewer configuration problems across different sites.” This is like loading a moving truck so it clears the lowest bridge on the route, not just the first one.
Use the stuck handshake as your test. Before you change anything, check for the pattern: ping works, a name lookup works, an HTTPS page you know is up hangs on the handshake. That’s MTU, not a dead server. Kind of like a door that opens for the mail but not for the couch.
Clamp on the router if you run it. If you control the Linux box the traffic goes through, Erkan’s MSS clamp tells TCP connections to agree on smaller segments: iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu. It’s like posting the height limit at the entrance of the parking garage.

Why Wi-Fi works and cellular doesn’t

WireGuard picks its packet size from the network you’re on. The wg-quick man page says that if you don’t set one, “the MTU is automatically determined from the endpoint addresses or the system default route, which is usually a sane choice.”

“Usually” is the catch. The Linux wg-quick script takes the MTU it finds, falls back to 1500 if it finds none, and subtracts 80. On an ordinary 1500-byte link that’s 1420, which Erkan calls “the default MTU of WireGuard.” His trouble was a PPPoE home connection, where “the maximum MTU is generally 1492 instead of widely used 1500.” Some sites worked, others had intermittent problems, “and some were just not working.”

The cellular version showed up on the WireGuard mailing list in December 2019. Rémi Lapeyre wrote that his users had “many issues when using the WireGuard client on MacOS laptops with IPv6 networks,” and that “most of those issues disappear when we set the MTU to 1280.” Some of them “where tethering over their phone connection.”

He’d found the reason in the Apple client’s code. On iOS, with no MTU set, it used 1280. A comment explained: “there are too many broken networks out there,” so “Instead set it to 1280. Boohoo.” On macOS, it took the network’s MTU and subtracted 80.

WireGuard creator Jason A. Donenfeld confirmed that the macOS setting means “the MTU of your wifi interface minus 80.” On why only the VPN broke, he guessed: “Probably the phone’s dhcp server doesn’t pass the right MTU back to the client, but then the phone does the mss-mtu hack to fix up TCP connections. That hack doesn’t work when the traffic is end-to-end encrypted, as is the case with WireGuard, so no smaller MSS is ever negotiated.”

Why it matters

The phone’s patch can’t see inside the tunnel. Your phone quietly shrinks ordinary TCP connections to fit, per Donenfeld. Encrypted WireGuard traffic is opaque to it, so the shrinking never happens and the big packets die.

1280 is a floor every IPv6 link has to meet. RFC 8200 says “IPv6 requires that every link in the Internet have an MTU of 1280 octets or greater.” Set the tunnel to that and it fits on Wi-Fi, a tethered phone or a hotel network, at the cost Erkan names: “it is smaller and will generate more packets.”

iPhones already do it. The MTU Matters page says “iOS seems immune to this type of tomfoolery,” while “macOS and Linux-based stacks do not seem to automatically negotiate this in a reasonable way.” That lines up with the 1280 the iOS client picked on its own in the 2019 code.

Lapeyre wrote back the day Donenfeld answered, with a bigger question: “Won’t this situation happen a lot? Should we fix the default MTU to 1280 to avoid users having their tunnel randomly fail on some network?” That’s in the thread from December 19, 2019. The wg-quick script that ships for Linux today still takes the link’s MTU and subtracts 80.

Search

WireGuard VPN Works on Wi-Fi but Hangs on Cellular: Set the MTU to 1280

Why Wi-Fi works and cellular doesn’t

More Software