WireGuard Configuration, Split-Tunnel & MTU Calculator
Build ready-to-import WireGuard `[Interface]` and `[Peer]` configuration templates, choose full-tunnel vs LAN split-tunnel `AllowedIPs`, and compute exact tunnel MTU.
Select your routing mode and WAN type above, then click Generate WireGuard Config & MTU.
Understanding WireGuard AllowedIPs & MTU Overhead
In WireGuard, the AllowedIPs line inside the [Peer] section acts simultaneously as an outbound routing table selector and an inbound source-IP access control list. Meanwhile, WireGuard encapsulates packets inside UDP with 60 bytes of overhead on IPv4 and 80 bytes of overhead on IPv6—which is why subtracting 80 bytes from your underlying WAN MTU prevents TLS handshakes and video streams from stalling.
WireGuard MTU & Routing Mode Reference Matrix
| Connection Scenario | Underlying WAN MTU | Recommended WireGuard MTU | Recommended Client AllowedIPs |
|---|---|---|---|
| Cable / Fiber Dynamic IP (IPoE) | 1500 bytes | 1420 | 0.0.0.0/0, ::/0 (Full) or 192.168.1.0/24 (Split) |
| PPPoE Fiber (CenturyLink / Frontier) | 1492 bytes | 1412 | Subtract 8 extra bytes for PPPoE framing header |
| 5G Home Internet / Mobile Hotspot (464XLAT) | 1428–1440 bytes | 1360 – 1380 | Prevents packet fragmentation over carrier IPv6 tunnels |
| Remote Access to Home NAS/NVR Only | Any | 1420 | 10.66.66.0/24, 192.168.1.0/24 (Keeps Zoom/streaming on local ISP) |