Is your VPN connected, but some websites take longer to load? Then two settings worth understanding are MTU (Maximum Transmission Unit) and MSS (Maximum Segment Size).
Adjusting them may help resolve certain connection problems, but changing them unnecessarily can also create new issues. In this guide, we’ll explain how these settings work.
What are MTU and MSS?
Although they work together, MTU and MSS control different parts of network communication.
| Setting | What it means | What it controls |
| MTU | Maximum Transmission Unit | Maximum IP packet size on a network interface |
| MSS | Maximum Segment Size | Maximum TCP data payload in a segment |
For example, a typical Ethernet connection uses an MTU of 1500 bytes. With standard IPv4 and TCP headers, the corresponding TCP MSS is commonly 1460 bytes.
VPN encapsulation also adds overhead you must consider. Actual requirements depend on the VPN protocol, IP version, and network path.
Why can packet size affect VPN performance?
A VPN encrypts data and sends it through a tunnel between your device and a VPN server. This process adds information to each packet, which increases its overall size.
Every network path has a maximum packet size it can carry. If a packet exceeds that limit, the protocol may fragment it, resize it, or discard it, depending on the network configuration.
As a result, misconfigured packet sizes can cause connection stalls, failed transfers, or inconsistent performance. These problems are particularly noticeable if the network cannot properly handle packet-size discovery.
How to test your network’s MTU
Before changing anything, measure your connection and record its current performance. Use packet-size tests to investigate potential MTU problems.
Step 1. Run a packet-size test
On Windows, open Command Prompt and enter:
ping -4 -f -l 1472 8.8.8.8
For Linux, use:
ping -4 -M do -s 1472 8.8.8.8
For macOS, use:
ping -D -s 1472 8.8.8.8
These commands test IPv4 packets without allowing normal fragmentation. The 1472-byte payload plus 28 bytes of standard IPv4 and ICMP headers produces a 1500-byte packet.
Step 2. Review the results
If the test reports that fragmentation is required, try a smaller payload such as 1400 bytes. Continue adjusting until you identify a size that works consistently.
For example, if a 1464-byte payload succeeds, the corresponding IPv4 packet size is 1492 bytes.
Also, remember that some destinations block or limit ping requests. A failed test doesn’t always indicate an MTU problem, and testing your regular connection doesn’t automatically reveal the VPN tunnel’s usable MTU.
How to adjust MTU and MSS settings
Change these values only if troubleshooting suggests a packet-size problem. Many modern VPN applications already manage them automatically.
1. OpenVPN
OpenVPN supports configuration options such as tun-mtu and mssfix. These help control tunnel packet sizes and TCP segment handling.
For example, mssfix can help certain UDP-based OpenVPN connections experiencing MTU-related stalls.
2. WireGuard
WireGuard configurations managed through wg-quick can include an optional MTU value under the [Interface] section.
The tool normally calculates a suitable value automatically. If your network requires a manual adjustment, test the change carefully before keeping it.
3. Router-based VPN connections
Some routers support MSS clamping, which adjusts TCP segment sizes to fit network requirements.
For example, OpenWrt and other configurable routers may provide related settings. Consult the router’s documentation before modifying them.
Commercial VPN applications may not expose these controls. In that case, contact your provider rather than editing managed configuration files.
How to check if your changes helped
After making an adjustment, reconnect your VPN and test the activities that previously caused problems.
- Compare download and upload performance.
- Open websites that previously stalled.
- Check whether connections remain stable.
- Test video calls or streaming quality.
- Compare results before and after each change.
In addition, test under similar network conditions to make the comparison meaningful. If performance becomes worse, restore the previous setting.
Final thoughts
Understanding VPN MTU and MSS settings can help you troubleshoot connection problems caused by packet-size limitations. These adjustments are most useful when testing identifies a specific issue.
Start with your VPN’s default configuration and measure performance before changing anything. If problems continue, consult your VPN provider for settings appropriate to your connection.
Common questions about VPN MTU settings
No. Although 1420 is a common WireGuard configuration value, the appropriate MTU depends on your network and tunnel setup.
Sometimes. Mobile hotspots, home networks, and PPPoE connections may have different packet-size limits. Test your actual connection instead of assuming one value works everywhere.
It may resolve packet-size issues that affect connection stability. It doesn’t guarantee lower gaming latency or faster network routing.
MTU changes don’t directly alter the VPN’s encryption algorithm. Still, an incorrect configuration can disrupt connections, so test all changes carefully.