pwnsycybersecurity + privacy community
Computed in your browser

VPN MTU and MSS Calculator

The VPN MTU and MSS calculator takes your path MTU and tunnel stack, adds up every encapsulation byte, and gives the interface MTU and TCP MSS clamp to set. It is for anyone running WireGuard, OpenVPN, IPsec, GRE, VXLAN, Geneve or IP-in-IP whose tunnel stalls on large packets.

Header sizes follow the specs and source. All arithmetic runs in your browser; nothing is sent anywhere.

Path
Stack options link layer, second tunnel, cipher, interface

    How the calculator works

    Every tunnel wraps your packet in extra headers, and those bytes come out of the path MTU. The calculator lists each header field for the stack you pick (link layer, an optional outer tunnel, then the tunnel protocol), adds them up, and does two subtractions:

    • Tunnel MTU = path MTU minus total encapsulation overhead. Set this on the tunnel interface.
    • TCP MSS = tunnel MTU minus the inner IP header (20 bytes for IPv4, 40 for IPv6) minus 20 bytes of TCP. Clamp SYN packets to this on the forward chain, both directions.

    WireGuard, for example, adds an outer IP header, 8 bytes of UDP and 32 bytes of its own (type, receiver index, counter and the Poly1305 tag): 60 bytes over IPv4 and 80 over IPv6. Rows marked worst case (CBC and ESP padding, VLAN tags) are charged at their maximum, which keeps the MTU safe.

    The page cannot see carrier tunnels, MPLS or DSL encapsulation under you, so measure the path with the Measure tab. Path MTU discovery needs ICMP "fragmentation needed", which many networks filter; UDP traffic (QUIC, nested VPNs) has no clamp, so the interface MTU still has to be right.

    How to read the result

    • Total overhead is the bytes added to every packet. The Bytes tab itemises them; open a row for what each field is.
    • Tunnel MTU and TCP MSS clamp are the two numbers to set. The tile turns amber when the tunnel MTU is under 576, or under 1280 with IPv6 inside.
    • Payload efficiency is MSS divided by path MTU, the share of each full packet that is your data, next to the same figure without the tunnel.
    • The packet bar draws one full-size packet split by layer.
    • The check list compares the shipping default MTU (WireGuard 1420, Tailscale 1280, OpenVPN 1500, Linux GRE, VXLAN and IP-in-IP defaults) with your result and flags any that are too big for this path.
    • Every protocol runs the same path through each protocol with default options. Tap a row to load it.

    FAQ

    What MTU should I set on a WireGuard interface?

    WireGuard adds 60 bytes over an IPv4 path and 80 over IPv6, so a 1500 byte path leaves 1440 or 1420. The wg-quick default of 1420 fits both. On PPPoE (1492) over IPv6 the answer drops to 1412, so enter your own path MTU.

    Why clamp the TCP MSS as well as setting the MTU?

    Path MTU discovery needs ICMP fragmentation needed messages, which many networks filter. Without them, large TCP segments vanish and sessions stall once real data moves. The clamp rewrites the MSS in each SYN so both ends pick a size that fits. UDP has no clamp, so the interface MTU still has to be right.

    How do I measure my path MTU?

    Send pings with the do not fragment flag and raise the size until they fail. Size flags count ICMP payload only, so path MTU is the largest payload that worked plus 28 bytes on IPv4 or 48 on IPv6. If a 100 byte probe also fails, ICMP is filtered and the method tells you nothing.

    Why are some rows marked worst case?

    CBC padding, ESP alignment padding and VLAN tags vary from packet to packet. The calculator charges their maximum size, which keeps the MTU it gives safe for every packet.

    What happens if the tunnel MTU is below 1280?

    IPv6 requires a link MTU of at least 1280 bytes, so a smaller tunnel cannot carry IPv6 inside it. The page flags this and suggests carrying IPv4 inside, raising the underlay or removing a layer. Below 576 bytes it also warns that software assuming the IPv4 minimum datagram size breaks.

    Sources: WireGuard paper, RFC 4303 (ESP), RFC 3948 (NAT-T), RFC 2784 (GRE), RFC 2661 (L2TP), RFC 7348 (VXLAN), RFC 8926 (Geneve), RFC 2003 and RFC 2473 (IP-in-IP), OpenVPN protocol docs. Part of the pwnsy VPN tools.

    Copied