VPNSmith
Free tool - WireGuard MTU

WireGuard MTU calculator

Your tunnel connects and pings, but pages hang? Enter the largest do-not-fragment ping that gets through, or pick your link type, and get the MTU to put in wg0.conf, the commands to apply it and the ping ladder to verify it. Everything runs in your browser.

Tired of a messy path? A VPS with a public IPv4 gives one clean 1500-byte hop: see the Contabo offer

Runs entirely in your browser. Nothing you type leaves the page.

What do you know about your link?

Example: ping -M do -s 1472 SERVER_PUBLIC_IP replies, so you type 1472. If it fails, try the ladder in the test commands below and enter the largest size that passes.

Connection to the server (outside the tunnel)
Commands for

Result

1500
Path MTU
-80
WireGuard overhead
1420
MTU to set

Your path carries full 1500-byte packets: the default 1420 fits. If large transfers still stall, the cause is elsewhere (forwarding, masquerade, AllowedIPs). You can still set MTU = 1420 explicitly.

wg0.conf
[Interface]
PrivateKey = <client private key>
Address = 10.66.66.2/32
MTU = 1420

[Peer]
PublicKey = <server public key>
Endpoint = SERVER_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25
apply-mtu.sh
# 1. Add the MTU line to [Interface] in /etc/wireguard/wg0.conf, then restart the tunnel
sudo wg-quick down wg0 && sudo wg-quick up wg0

# 2. Or change it live without restarting (lost at the next wg-quick down)
sudo ip link set dev wg0 mtu 1420
ip link show wg0 | grep -o 'mtu [0-9]*'
test-mtu.sh
# Ping ladder to the server's PUBLIC IP, outside the tunnel: run from the top, the first size that replies is your payload
# A failing size prints 'message too long', 'needs to be fragmented' or no reply
ping -M do -s 1472 -c 3 SERVER_PUBLIC_IP
ping -M do -s 1464 -c 3 SERVER_PUBLIC_IP
ping -M do -s 1452 -c 3 SERVER_PUBLIC_IP
ping -M do -s 1444 -c 3 SERVER_PUBLIC_IP
ping -M do -s 1400 -c 3 SERVER_PUBLIC_IP
ping -M do -s 1372 -c 3 SERVER_PUBLIC_IP
ping -M do -s 1300 -c 3 SERVER_PUBLIC_IP
ping -M do -s 1252 -c 3 SERVER_PUBLIC_IP

# Verification through the tunnel, to the server's tunnel IP: this must reply with the new MTU
ping -M do -s 1392 -c 3 10.66.66.1
# payload = MTU minus 28; if this fails, lower the MTU further

Half of MTU trouble is the path, not the config

Double NAT, a home router and a tunnel stacked on a tunnel all shave bytes off your path. A VPS with a clean public IPv4 is one hop on a 1500-byte link, where the default 1420 just works. Contabo's entry VPS includes a public IPv4 address and full root.

Affiliate link: we may earn a commission, at no extra cost to you. The calculator stays free and does not depend on it.

See the Contabo VPS

Where the numbers come from

WireGuard wraps each of your packets in a UDP datagram. The wrapper has a fixed size, so the tunnel MTU is simply the path MTU minus that wrapper. This is exactly what wg-quick does when no MTU is set: it takes the MTU of the route to the endpoint and subtracts 80, which gives the familiar 1420 on a 1500-byte link.

HeaderBytes
Outer IPv4 header20
Outer IPv6 header40
UDP header8
WireGuard data header (type, index, counter)16
Poly1305 authentication tag16
Total over IPv4 / over IPv660 / 80
Ping: IPv4 + ICMP headers around the payload28

A ping payload of 1472 bytes therefore travels in a 1500-byte packet. If 1472 passes with the do-not-fragment flag, your path MTU is 1500 and the default 1420 fits. If only 1400 passes, the path MTU is 1428 and WireGuard must not send more than 1348 over IPv6. The calculator subtracts 80 unless you tell it the outer connection is IPv4-only, in which case 60 is enough.

Typical values when you cannot measure

A measured value always beats a table. These baselines are for the cases where you cannot run the ping, for example on a phone or on a network you do not control.

Link typePath MTUWireGuard MTU
Ethernet, fibre, cable15001420 (default)
PPPoE DSL14921412
Mobile, 5G, CGNATvaries1280 (fallback)
Tunnel inside another VPNreduced twice1280 (fallback)
IPv6 guaranteed minimum12801280
Full guide: why a tunnel pings but stalls, and how to measure MTU step by step →Why PersistentKeepalive = 25 for peers behind NAT →

Frequently asked questions

What is the default WireGuard MTU and why 1420?
When the config has no MTU line, wg-quick sets the interface MTU to the MTU of the route to the endpoint minus 80 bytes. On a standard 1500-byte link that gives 1420. The 80 bytes are the worst case: 40 bytes of IPv6 header, 8 of UDP and 32 of WireGuard framing. Over IPv4 the real overhead is 60 bytes, so 1440 would also fit, but 1420 is safe on both.
How do I measure the right MTU?
Send a ping to the server's public IP with the do-not-fragment flag and a large payload, then shrink the payload until replies come back: ping -M do -s 1472 on Linux, ping -f -l 1472 on Windows, ping -D -s 1472 on macOS. Take the largest payload that succeeds, add 28 bytes of IP and ICMP headers to get the path MTU, and subtract 80 for WireGuard. The calculator does the arithmetic and writes the commands for your system.
WireGuard connects but no page loads: is it MTU?
Very likely, when small traffic works and large traffic does not. A handshake, a DNS lookup and a ping are small, so they succeed. A full web page is a full-size packet; if it exceeds the path MTU and the ICMP fragmentation-needed message is filtered somewhere, it is dropped silently. Lowering the WireGuard MTU below the real path MTU is the fix. If nothing flows at all, check IP forwarding, the masquerade rule and AllowedIPs first.
Why is 1280 the safe fallback?
RFC 8200 requires every IPv6 link to carry packets of 1280 bytes, and in practice every IPv4 path does too. A WireGuard MTU of 1280 therefore works on PPPoE, mobile, CGNAT and tunnel-in-tunnel paths without measuring, at the price of a few percent of efficiency on a clean 1500-byte link. If the tunnel itself carries IPv6, the interface MTU must not go below 1280.
Client or server: where do I set the MTU?
On the side whose link is constrained, which is usually the client (home DSL, mobile, office). The MTU of an interface only limits what that interface sends, so lowering it on the client fixes uploads and requests, and the server's replies are sized by the TCP MSS that follows. If the server itself sits behind a sub-1500 uplink, set it there as well.
Does the MTU= line work on Windows, macOS, Android and iOS?
Yes. The official WireGuard apps read the MTU= key of the [Interface] section and apply it when the tunnel is activated. On Linux, wg-quick applies it, and you can also change it live with ip link set dev wg0 mtu, which does not survive a restart of the tunnel.