How to Find and Fix MTU Problems on VPN and PPPoE Links

Step by step

1. Recognise the symptoms

   Small requests work but large ones hang: web pages half load, email with attachments stalls, SSH logs in but freezes on large output. This usually happens over VPN tunnels, PPPoE or GRE links.

2. Find the path MTU

   Send pings that must not be fragmented and lower the size until they pass. Payload + 28 bytes = the MTU.

   # Linux
   ping -M do -s 1472 10.2.10.1
   # Windows
   ping -f -l 1472 10.2.10.1
   # macOS
   ping -D -s 1472 10.2.10.1
   

3. Read the result

   1472 passing means a full 1500-byte path. If only 1452 passes, the path MTU is 1480; with PPPoE it is usually 1492, with IPsec often 1400–1438.

4. Clamp TCP MSS on the gateway

   Set the TCP maximum segment size on the WAN or tunnel interface to path MTU minus 40 bytes. Most gateways have a 'clamp MSS to PMTU' option; on Linux:

   iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
   

5. Allow ICMP 'fragmentation needed'

   Path MTU discovery needs ICMP type 3 code 4 (and ICMPv6 'packet too big'). Firewalls that block all ICMP break it.

6. Re-test

   Repeat the don't-fragment ping and the failing application. Large transfers should now complete.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.