Mind the MTU

My phone’s hotspot and WireGuard refused to get along: ping went through, but seemingly nothing else. It bugged me for quite some time before I finally dug in.

It was MTU. Mobile carriers often run IPv6-only networks and translate IPv4 along the way (464XLAT), so the path over cellular fits less than the usual 1500 bytes. WireGuard’s default of 1420 fills that budget exactly once encapsulated, and with the ICMP “fragmentation needed” replies lost in CGNAT land, big packets were silently dropped and only small pings squeezed through. 3 Once you know it’s an MTU issue, the fix is almost insultingly small. Lower the MTU on the WireGuard interface to something conservative, like 1280 - the IPv6 minimum, which in practice clears almost any path.

[Interface]
MTU = 1280

Or on NixOS, something like this:

networking.wg-quick.interfaces.wg0.mtu = 1280;

That pesky MTU…