MTU, TCP MSS & VPN Overhead Calculator

Calculate exact tunnel interface MTU and TCP Maximum Segment Size (MSS) clamping values for WireGuard, IPsec, GRE, VXLAN, and PPPoE links to prevent packet fragmentation.

Physical / WAN Link MTU (Bytes)

Tunnel / Overlay Protocol

Underlying Access Framing

Optimal MTU & MSS Parameters

Ready-to-Use Configuration & PMTUD Test Commands

Preventing Packet Fragmentation & PMTUD Black Holes

Maximum Transmission Unit (MTU) defines the largest Layer 3 IP packet (in bytes) that can traverse a network interface without fragmentation. On standard Ethernet links, the default MTU is 1500 bytes. When traffic is encapsulated inside a VPN or data-center overlay—such as WireGuard, IPsec, GRE, or VXLAN—outer IP, UDP, and cryptographic headers consume part of that 1500-byte budget.

If an inner packet plus its tunnel headers exceeds the WAN MTU and the Don't Fragment (DF) bit is set, upstream routers drop the packet and return an ICMP Fragmentation Needed message (Type 3, Code 4 in IPv4; Packet Too Big in IPv6). When strict firewalls block ICMP, Path MTU Discovery (PMTUD) black holes occur: SSH sessions, BGP neighbor establishment, and TLS handshakes stall silently while small pings succeed.

Network engineers eliminate tunnel black holes with two complementary settings: lowering the virtual tunnel interface MTU to WAN_MTU - Overhead, and configuring TCP MSS Clamping on edge routers (Inner_MTU - 40 for IPv4 or Inner_MTU - 60 for IPv6) so endpoints negotiate smaller TCP segments during the initial SYN handshake.