Troubleshoot MTU problems: hanging pages, stuck SSH and slow VPNs

The MTU (maximum transmission unit) is the largest packet a link can carry, normally 1500 bytes on Ethernet. Tunnels such as VPNs, PPPoE and some cloud networks reduce it. If a large packet does not fit and the "too big" message is blocked, connections set up fine and then hang. These problems look mysterious until you know the pattern.

Before you start

• Terminal access to the affected machine.
• Tools from the network diagnostics guide.

Typical symptoms

• Small pages load, large pages or downloads hang part way.
• SSH logs in, then freezes when you run a command with a lot of output.
• Ping works but HTTPS or a TLS handshake times out.
• Problems only over a VPN, PPPoE line or Docker overlay network.

Find the largest packet that fits

Send pings with the "don't fragment" flag and shrink the size until they pass. The payload size plus 28 bytes (IP and ICMP headers) is the path MTU.

Linux:

ping -M do -s 1472 -c 3 1.1.1.1
ping -M do -s 1420 -c 3 1.1.1.1

Windows:

ping -f -l 1472 1.1.1.1

macOS:

ping -D -s 1472 1.1.1.1

If 1472 works, the path MTU is 1500 and MTU is not your issue. If you get "message too long" or "needs to be fragmented", lower the size until it works; for example a working 1452 means an MTU of 1480.

Fix it on Linux

Test temporarily:

sudo ip link set dev eth0 mtu 1450

Make it permanent with Netplan by adding mtu: 1450 under the interface, or with nmcli:

sudo nmcli con mod eth0 802-3-ethernet.mtu 1450

Fix it on Windows

netsh interface ipv4 show subinterfaces
netsh interface ipv4 set subinterface "Ethernet" mtu=1450 store=persistent

VPNs, WireGuard and Docker

• WireGuard adds 60 bytes (IPv4) or 80 bytes (IPv6) of overhead, which is why its default MTU is 1420. If the underlying link is already smaller, set MTU = 1380 in the [Interface] section (WireGuard VPN on a VPS).
• Docker bridges default to 1500. On hosts with a smaller MTU, set "mtu": 1450 in /etc/docker/daemon.json.
• Routers and firewalls can clamp the TCP MSS so connections choose a smaller segment size automatically:

sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Check afterwards

Repeat the ping test with the new size and retry the large download or the SSH command that used to freeze.

Next steps

• Set up a WireGuard VPN on a VPS
• Docker bridge and custom networks
• Speed test a server