WireGuard is stupid and refuses to do PMTUD or similar because that's a security vulnerability or something.
Work VPN has a New and Exciting issue where it does PMTU discovery and sets the MTU accurately, but WireGuard doesn't actually send the MTU on the wire and instead the other end sets it based upon the size of received packets rounded _up_ to the next 16B multiple because of how the size-obfusfcation padding works and then nothing on the other end loads because packets back keep getting dropped for exceeding MTU. (The VPN coordinator software needs to round it down to the next-lowest 16B before setting the tunnel MTU...)
I hate WireGuard, it's a completely ass protocol.
erincandescent 💜
npub1g6…ajrjv
2026-10-08 14:44:55 UTC
in reply to nevent1q…s8nd
Author Public Key
npub1g6y83jgazvwv7dyjaxdhujq7sg5walvn0j273z5r2v8rwdh32pdqrajrjvPublished at
2026-10-08 14:44:55 UTCEvent JSON
{
"id": "c8d95f006d2842b29d85445a41df69738c27dbce636e9b2f09f8579741240852",
"pubkey": "468878c91d131ccf3492e99b7e481e8228eefd937c95e88a83530e3736f1505a",
"created_at": 1791470695,
"kind": 1,
"tags": [
[
"e",
"3252488aafa9ac7e2987abf2ebdfc91a2c5815c5cf40daae162229fdfb8da1f6",
"",
"root",
"7e435ed95d91220862792504d31f4f12c2b7b29a70c9540e70de12c23af32078"
],
[
"p",
"2ba475a1340ebd9f8ec27d9173cd47f78bde6f58760f13854303ba6bd6f3a930"
],
[
"p",
"a5cb6cdbf0e9f9ea36b15463761b2f8181028f63d6150ef29484c2b3007553c3"
],
[
"p",
"678aa400e038fe63eb2e7bee78a1e649b2a71e7837371808ec6f453c484b6cf7"
],
[
"e",
"dbc719272322f89010cdda3425b512d2c867563fd5da00a4716346cd05c0e160",
"",
"reply",
"a5cb6cdbf0e9f9ea36b15463761b2f8181028f63d6150ef29484c2b3007553c3"
],
[
"p",
"7e435ed95d91220862792504d31f4f12c2b7b29a70c9540e70de12c23af32078"
],
[
"proxy",
"https://akko.erincandescent.net/objects/933bf5b4-85ca-458d-a053-a7624e64aaa7",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://akko.erincandescent.net/objects/933bf5b4-85ca-458d-a053-a7624e64aaa7",
"pink.momostr"
],
[
"-"
]
],
"content": "WireGuard is stupid and refuses to do PMTUD or similar because that's a security vulnerability or something. \r\n\r\nWork VPN has a New and Exciting issue where it does PMTU discovery and sets the MTU accurately, but WireGuard doesn't actually send the MTU on the wire and instead the other end sets it based upon the size of received packets rounded _up_ to the next 16B multiple because of how the size-obfusfcation padding works and then nothing on the other end loads because packets back keep getting dropped for exceeding MTU. (The VPN coordinator software needs to round it down to the next-lowest 16B before setting the tunnel MTU...)\r\n\r\nI hate WireGuard, it's a completely ass protocol.",
"sig": "ca73d7af650b52048b1112825d33c0600d6b8089826901d03d2f6145f22ee367c15eb4747e671498bb55a14f484b3b0ff98aceb665a19def47335b074a339cfe"
}