FULL AI ANALYSIS

WireGuard tunnel connects but large TCP transfers stall — small requests OK (likely PMTU / MSS black hole)

Generated Oct 3, 2026, 12:35:03 AM

Analysis summary

This is a classic PMTU black hole: large packets with DF set cannot be forwarded because an intermediate link cannot handle their size, and ICMP 'Fragmentation Needed' messages are being dropped (or not routed back) so the sender never reduces packet size. WireGuard encapsulation increases packet overhead so packets that previously fit now exceed MTU on some path. The fact that reducing MTU on the endpoint fixes the issue confirms a PMTU discovery failure. Common causes include ISP or home gateway filtering ICMP, NAT devices stripping ICMP messages, or not performing TCP MSS clamping on NAT devices.

Possible causes

An upstream NAT/firewall or ISP device is dropping ICMP 'fragmentation needed' responses, preventing PMTU discovery.

90%

The home router/modem does not correctly handle tunneled (WireGuard) DF packets, causing a black hole for larger encapsulated packets.

75%

TCP MSS not being clamped on the box that performs NAT for the WireGuard client, allowing endpoints to attempt too-large packets.

65%

Asymmetric routing where ICMP replies take a different return path and are filtered somewhere else.

30%

Suggested fixes

Diagnostic step 1

On the WireGuard server, add TCP MSS clamping to the PREROUTING/FORWARD chain so TCP SYNs get MSS reduced automatically: iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu. If using nftables, use equivalent inet mangle chain rules. This fixes most PMTU black hole cases without changing client configs.

Diagnostic step 2

If you control the gateway/router, enable or allow ICMP type 3/code 4 (Fragmentation Needed) through NAT and firewall. Consult router/modem documentation or ISP if no option is visible in the UI.

Diagnostic step 3

As an alternative, set a conservative MTU on the WireGuard server/interface (e.g., 1420 or 1380) and advertise it via AllowedIPs or client configuration; use PostUp/PostDown in wg-quick to set permanent rules. Changing MTU is reversible and low-risk.

Diagnostic step 4

Capture packet traces on both ends for a failing transfer (tcpdump -s0 -w file) and inspect for missing ICMP 'fragmentation needed' responses; if ICMP never arrives at one end, ask ISP or check upstream device logs.

Diagnostic step 5

If the home modem is a black-box ISP device that can't be configured, engage ISP support with a packet trace showing missing ICMP replies and requests to allow PMTU ICMP through. Escalate to network provider if device-level changes are required. Avoid workarounds that might drop traffic silently; prefer MSS-clamping or enabling ICMP. If you are uncertain about changing firewall rules in production, test on a temporary rule and confirm behavior before committing.

Contact • Help • API Docs • Careers • Terms • Privacy • Cookies • Ads