MTU on the interface — the most misunderstood setting on a router

MTU is the maximum packet size, in bytes, that an interface can transmit without fragmentation. The default of 1500 works for unencrypted Ethernet. Tunnels, MPLS, and jumbo frames change the calculation. This lesson covers what MTU is, how to configure it on VyOS, and the verification path that catches MTU mismatches before they break traffic.

What MTU actually controls

flowchart LR
  A[Packet arrives<br/>at ingress] --> B{Packet size<br/>> MTU?}
  B -->|yes| C[Fragment<br/>OR drop with ICMP]
  B -->|no| D[Forward to egress]
  D --> E{Egress MTU<br/>< packet size?}
  E -->|yes| F[ICMP fragmentation needed<br/>sent back]
  E -->|no| G[Forward]

The default of 1500

The default MTU on a VyOS Ethernet interface is 1500. This is the standard Ethernet frame size for IPv4 unicast. It works for:

• Plain Ethernet frames
• IPv4 unicast between two hosts on the same L2 segment

It does not work for:

• IPv6 (minimum MTU 1280 for the path)
• Tunnels (WireGuard, IPsec, GRE) — the tunnel wrapper adds 50-80 bytes of overhead
• MPLS — labels add 4 bytes per label
• Jumbo frames — capable switches and NICs support 9000 bytes

Configuring MTU

[edit]
vyos@vyos# set interfaces ethernet eth0 mtu '9000'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

The MTU is set to 9000 bytes. Both ends of the link must support jumbo frames; otherwise the larger frames are silently dropped.

Tunnel MTU

[edit]
vyos@vyos# set interfaces wireguard wg0 mtu '1420'
[edit]
vyos@vyos# commit
[edit]
vyos@vyos# save

WireGuard over IPv4 adds 32 bytes of overhead (8 bytes UDP, 20 bytes IP, 4 bytes WG). The standard MTU for WireGuard over IPv4 is 1420 (1500 - 80, leaving margin). The standard for WireGuard over IPv6 is 1400 (1500 - 100, leaving more margin).

For IPsec, the overhead depends on the encryption algorithm:

• AES-GCM-128: 50-58 bytes overhead
• AES-GCM-256: 58-66 bytes overhead
• ChaCha20-Poly1305: 50-58 bytes overhead

The standard MTU for IPsec is 1400-1438 depending on the algorithm and the path MTU.

Path MTU Discovery (PMTUD)

vyos@vyos:~$ tracepath 8.8.8.8
 1?: [LOCALHOST]                      pmtu 1500
 1:  192.0.2.1                                         0.412ms
 1:  192.0.2.1                                         0.380ms
 2:  10.0.0.1                                          0.521ms
 ...

tracepath probes each hop with increasing packet sizes and reports the MTU at each hop. The operator can identify where the path MTU drops.

Verifying with ping

vyos@vyos:~$ ping -M do -s 1472 192.0.2.10
PING 192.0.2.10 (192.0.2.10) 1472(1500) bytes of data.
1480 bytes from 192.0.2.10: icmp_seq=1 ttl=64 time=0.421 ms

-M do sets the don’t-fragment bit; -s 1472 sets the payload to 1472 bytes; the total packet size is 1500 (1472 + 28 ICMP header). If the peer responds, the path supports 1500-byte packets.

vyos@vyos:~$ ping -M do -s 8972 192.0.2.10
PING 192.0.2.10 (192.0.2.10) 8972(9000) bytes of data.
From 192.0.2.1 icmp_seq=1 Frag needed and DF set (mtu = 1500)

A response with Frag needed and DF set indicates the path MTU is smaller than the packet size. The ICMP error includes the MTU the router expects.

How the result is validated

show interface ethernet eth0
ip link show eth0
tracepath <peer>
ping -M do -s <size> <peer>

The first two confirm the MTU; the third finds the path MTU; the fourth verifies a specific size.

How it fails

The production failure modes the engineer must recognise:

• MTU mismatch on a link. One end at 1500, the other at 9000. Jumbo frames from the 9000 end are dropped at the 1500 end.
• Tunnel MTU too large. WireGuard at 1500 with IPv4 underlying = packets up to 1550, larger than the underlying Ethernet can carry. Packets are dropped or fragmented.
• PMTUD broken. A firewall that drops ICMP fragments-needed messages breaks PMTUD. The operator must set MTU manually.
• MSS clamping not configured. TCP peers send segments larger than the path MTU. The kernel’s MSS clamping (in the firewall rule) limits segments to MTU - 40.
• IPv6 over a small-MTU tunnel. IPv6 requires MTU 1280. A tunnel with MTU < 1280 is broken for IPv6.

Rollback

The recovery from a bad MTU configuration:

• delete interfaces ethernet eth0 mtu; commit; save reverts to the default 1500.
• A tunnel MTU fix: set interfaces wireguard wg0 mtu 1420; commit; save.
• PMTUD broken: configure MSS clamping in the firewall or set MTU manually on every interface in the path.

Production discipline

Cross-course references

The Linux course’s XLII-Linux-NetPerf covers MTU and TCP performance. The OPNsense course’s VII-OPNsense-Interfaces covers the equivalent configuration on the firewall side. The Observability course’s LX-Observability-NetworkObs covers how to alert on PMTUD failures.

Quiz