pfSense » pfSense Docs

@viktor or Christian McDonald — What should the MTU be set to? 1420?

I recently spent a few hours troubleshooting a slow site-to-site WG VPN, and in the end it seemed to boil down to needing to manually set the MTU to 1420 on the interfaces of each side of the tunnel.

I notice this used to be automatically set (see https://github.com/pfsense/pfsense/commit/8b9d2275015be7bf8febb1714f8a979d7c5f2beb) but was removed in https://github.com/pfsense/pfsense/commit/281dede0421a0b80183ce5d0305de695eca43b7e and does not appear to have been put back.

https://lists.zx2c4.com/pipermail/wireguard/2017-December/002201.html

- 20-byte IPv4 header or 40 byte IPv6 header
- 8-byte UDP header
- 4-byte type
- 4-byte key index
- 8-byte nonce
- N-byte encrypted data
- 16-byte authentication tag

1420 for IPv6, 1440 for IPv4.