Mind the MTU

Thu, 18 Jun 2026 10:00:00 +0100

My phone’s hotspot and WireGuard refused to get along: ping went through, but seemingly nothing else. It bugged me for quite some time before I finally dug in.

It was MTU. Mobile carriers often run IPv6-only networks and translate IPv4 along the way (464XLAT), so the path over cellular fits less than the usual 1500 bytes. WireGuard’s default of 1420 fills that budget exactly once encapsulated, and with the ICMP “fragmentation needed” replies lost in CGNAT land, big packets were silently dropped and only small pings squeezed through. 3 Once you know it’s an MTU issue, the fix is almost insultingly small. Lower the MTU on the WireGuard interface to something conservative, like 1280 - the IPv6 minimum, which in practice clears almost any path.

Wireguard on Johan Eliasson

Mind the MTU