MTU & TCP MSS Clamping Guide: Fix PPPoE, 5G & VPN Stalls

Updated 2026-11-12 • By Marcus Vance, CCNA (Senior Network Engineer)

When websites load small text headers yet stall forever loading images, or when SSH and TLS handshakes freeze over WireGuard or PPPoE, you likely have an MTU Path Blackhole. Subtracting encapsulation overhead correctly (1492 MTU / 1452 MSS for PPPoE; 1420 MTU / 1380 MSS for WireGuard) and enabling TCP MSS Clamping prevents dropped oversized packets immediately.

Why Path MTU Blackholes Break TLS, HTTPS & VPNs Silently

Standard Ethernet frames on your home LAN carry up to 1500 bytes of Layer 3 IP payload (known as the Maximum Transmission Unit, or MTU). However, once packets enter an ISP PPPoE session, a 5G cellular 464XLAT tunnel, or an encrypted WireGuard/OpenVPN/IPsec tunnel, outer wrapping headers consume 8 to 80 bytes of that 1500-byte Ethernet envelope.

Normally, Path MTU Discovery (PMTUD) handles this automatically: an upstream router sees a 1500-byte packet marked Don't Fragment (DF) that cannot squeeze into a 1420-byte tunnel, drops it, and replies with an ICMP Type 3 Code 4 (Fragmentation Needed) message asking your computer to shrink future packets. Unfortunately, over-aggressive cloud firewalls and misconfigured ISPs silently block ICMP unreachable packets.

The result is a classic PMTU Blackhole:

• Tiny DNS queries (60 bytes), ICMP pings (64 bytes), and initial TCP handshakes work cleanly, making your connection look “online.”
• Large packets carrying TLS certificates, SSH directory outputs, banking portals, or chunked HTTP downloads silently vanish at the bottleneck link, leaving browsers stuck spinning endlessly on “Establishing TLS connection...”

Step-by-Step: Measure Your Exact Path MTU with DF Ping Tests

You do not have to guess what your ISP or VPN tunnel supports—you can measure your exact bottleneck down to the single byte in 30 seconds from any Windows, macOS, or Linux terminal. Remember that ping flags measure ICMP payload only, so add 28 bytes (20B IPv4 + 8B ICMP) to convert your winning ping size into IPv4 MTU (or run our interactive MTU & TCP MSS Calculator):

1. Windows PowerShell / Command Prompt (-f -l):

   ping -f -l 1472 1.1.1.1

   If you see “Packet needs to be fragmented but DF set” (or silent 100% timeouts inside a tunnel), lower 1472 in binary steps: try 1464 (PPPoE 1492), then 1400, then 1392 (WireGuard 1420), then 1352 (5G / 1380 VPN). Add 28 to the largest passing number to get your true Path MTU.
2. Linux Terminal (-M do -s):

   ping -M do -s 1472 -c 3 1.1.1.1

   On IPv6 paths, probe with ping -6 -M do -s 1452 2606:4700:4700::1111 and add 48 bytes (40B IPv6 header + 8B ICMPv6 header).
3. macOS Terminal (-D -s):

   ping -D -s 1472 -c 3 1.1.1.1

   BSD/macOS uses uppercase -D to set the Don't Fragment bit. Note that macOS ICMP failures print ping: sendto: Message too long with the local interface's current MTU hint.

Configuring TCP MSS Clamping Across Popular Router Firmwares

Lowering MTU on individual phones and laptops is an administrative nightmare (and resets whenever a client moves networks). Instead, enable TCP MSS Clamping on your router so it inspects TCP SYN handshake packets traversing your bottleneck interface and rewrites the advertised Maximum Segment Size option cleanly:

• OPNsense & pfSense: Navigate to Interfaces > [WAN / WireGuard / PPPoE], scroll to the MSS field (separate from MTU!), and enter 1452 for PPPoE or 1380 for WireGuard (or 1372 for WireGuard over PPPoE). Notice OPNsense automatically calculates MTU - 40 in pf scrub rules when left matched to interface MTU.
• MikroTik RouterOS v7 (Firewall Mangle): Add two forward rules clamping MSS dynamically to the outbound path MTU so both PPPoE and WireGuard interfaces self-adjust without hardcoding every tunnel:

  /ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn tcp-mss=1453-65535 action=change-mss new-mss=clamp-to-pmtu passthrough=yes comment="Clamp TCP MSS to PMTU"

• Linux OpenWrt / GL.iNet (fw4 nftables): Open Network > Firewall and enable MSS clamping on your WAN and WireGuard firewall zones, which injects tcp flags syn tcp option maxseg size set rt mtu automatically in kernel netfilter.
• Ubiquiti UniFi Gateways: Go to Settings > Security > Traffic & Firewall Settings (or Gateway Device Settings > MSS Clamping) and change MSS Clamping from Auto to Custom (for example, set 1452 on CenturyLink PPPoE or 1380 when running site-to-site WireGuard/IPsec).

Special Cases: 5G Home Internet, Starlink & Jumbo Frames

Three modern home and office topologies break naive 1500-byte assumptions immediately:

• T-Mobile & Verizon 5G Home Internet (464XLAT / CLAT): Native IPv6 cellular backbones translate legacy IPv4 packets inside a 464XLAT encapsulation header, dropping usable IPv4 WAN MTU to roughly 1420 to 1440 bytes. If you run WireGuard or OpenVPN over 5G home internet, set WireGuard MTU to 1340–1360 bytes and clamp TCP MSS to 1300 so cloud VPN logins never hang.
• RFC 4638 Baby Jumbo Frames on PPPoE Fiber: Some fiber ISPs (and modern ONTs wired directly to OPNsense or MikroTik routers) support raising the underlying physical Ethernet WAN interface MTU to 1508 bytes. That extra 8 bytes accommodates the PPPoE header cleanly while leaving your effective IPv4 Internet MTU at a full unclipped 1500 bytes (MSS 1460)!
• LAN Jumbo Frames (9000 MTU) Warning: Never enable 9000-byte Jumbo Frames on a subnet that mixes NAS storage with Wi-Fi laptops or printers unless your router supports strict Layer 3 MSS clamping cleanly; otherwise, SMB/iSCSI hosts negotiating 9000-byte frames will blackhole when talking to 1500-byte Wi-Fi clients unless every switch along the path also handles 9000+ byte frames.

Production MTU, IPv4/IPv6 TCP MSS & DF Ping Probe Reference Table

MTU & TCP MSS Fragmentation Troubleshooting Checklist

1. Run ping -f -l 1472 1.1.1.1 (Windows) or ping -M do -s 1472 1.1.1.1 (Linux) to check native WAN MTU.
2. Subtract encapsulation overhead: -8B for PPPoE, -60B/-80B for WireGuard, -73B for OpenVPN UDP.
3. Calculate exact TCP MSS clamp using our interactive MTU & MSS Calculator (MTU - 40 for IPv4, MTU - 60 for IPv6).
4. Enable automatic TCP MSS Clamping (clamp-to-pmtu) in your router's WAN or VPN firewall policy.
5. Update WireGuard [Interface] MTU = 1412 (over PPPoE) or 1340 (over 5G cellular) in client .conf profiles.
6. Verify HTTPS banking sites, Git pulls, and large SSH directory outputs load instantly without stalling after TLS handshake.

Frequently Asked Questions

What is the difference between MTU and MSS?

MTU (Maximum Transmission Unit) is the largest total IP packet size (including IP and TCP/UDP headers) that can cross a network link without fragmentation, typically 1500 bytes. MSS (Maximum Segment Size) is only the TCP application payload inside that packet, calculated by subtracting the IP header and TCP header (Path MTU minus 40 bytes on IPv4, or Path MTU minus 60 bytes on IPv6).

Why do I add 28 to ping -f -l results to find my MTU?

The ping utility size parameter (-l on Windows, -s on Linux/macOS) specifies only the ICMP data payload bytes, excluding the 20-byte IPv4 header and 8-byte ICMP header. Adding 28 converts your maximum unfragmented ping payload (such as 1472) into the true IPv4 link MTU (1500).

What should my WireGuard MTU be if my home fiber uses PPPoE?

PPPoE reduces standard 1500 Ethernet MTU to 1492 bytes. Subtracting WireGuard's conservative 80-byte dual-stack encapsulation overhead gives a recommended WireGuard interface MTU of 1412 (and an IPv4 TCP MSS clamp of 1372). Leaving WireGuard at 1420 over PPPoE frequently causes packet fragmentation and TLS stalls.

Should I change the MTU on every PC and phone on my home network?

No. Manually overriding device NIC MTUs breaks roaming when laptops leave your house. Instead, leave client devices at standard 1500 Ethernet MTU and configure TCP MSS Clamping directly on your router's WAN and VPN interfaces so the router transparently instructs both sides of every TCP connection to negotiate the right segment size.

Related Router Troubleshooting & Engineering Guides

• How to Fix Double NAT on Home and Office Networks — Diagnose and fix Double NAT from chained ISP modem-routers and mesh WiFi systems using Bridge Mode, IP Passthrough, or AP Mode, vs ISP CGNAT (100.64.x.x).
• How to Check for CGNAT (100.64.0.0/10) & Port Forward Fixes — Learn how to detect Carrier-Grade NAT (CGNAT 100.64.0.0/10) on USA fiber, 5G, and satellite ISPs, plus 4 proven IPv6, VPN, and tunnel port forwarding fixes.
• How to Reset a Router Safely Without Losing Internet — Reset your WiFi router safely without losing internet by backing up PPPoE credentials, ISP VLAN IDs, MAC clones, and DHCP reservations before pressing Reset.
• How to Fix a Router Login Page Not Opening — Can't open 192.168.1.1 or 192.168.0.1? Find your true Default Gateway IP, bypass VPN and HTTPS browser blocks, clear ARP cache, and connect to your router UI.