Mind the MTU

My phone’s hotspot and WireGuard refused to get along: ping went through, but seemingly nothing else. It bugged me for quite some time before I finally dug in.

🥁🥁 … It was MTU. Mobile carriers often run IPv6-only networks and translate IPv4 along the way (464XLAT), so the path over cellular fits less than the usual 1500 bytes. Add WireGuard’s own encapsulation overhead on top and large packets no longer fit - and since the errors that would normally report this got lost behind CGNAT, they were silently dropped. Only small pings went through.

Once you know it’s an MTU issue, the fix is almost insultingly small. Lower the MTU on the WireGuard interface to something conservative, like 1280 - the IPv6 minimum, which in practice clears almost any path.

[Interface]
MTU = 1280

Or on NixOS, something like this:

networking.wg-quick.interfaces.wg0.mtu = 1280;

That pesky MTU…