Understanding PMTU Discovery in Linux
PMTU Discovery is a mechanism that allows a host to discover the smallest Maximum Transmission Unit (MTU) along the path to a destination. In the context of a VPN tunnel, which often adds encapsulation headers, the effective MTU is smaller than the underlying physical network interface. If packets exceed this limit and PMTUD is disabled, they may be fragmented or dropped entirely, leading to connection stalls.
Linux implements PMTUD through the net.ipv4.ip_no_pmtu_disc sysctl parameter. When set to 0 (the default), the kernel actively probes for the path MTU and adjusts its behavior accordingly. However, certain firewall rules or misconfigured networks can interfere with the necessary ICMP "Fragmentation Needed" messages required for this process to work correctly.
Verifying Current PMTU Settings
Before making changes, you should verify the current state of PMTUD on your system. You can check the global setting using the following command:
sysctl net.ipv4.ip_no_pmtu_discIf the output is 0, PMTUD is enabled. If it returns 1, it is disabled, which can cause performance degradation. Additionally, you can inspect the routing cache to see if any MTU values have been cached for specific routes:
ip route show | grep mtuThis step is crucial because some VPN clients might override these settings locally. Ensure that your VPN software is not forcing a fixed MTU that bypasses the kernel's discovery mechanism.
Configuring PMTU Discovery Globally
To ensure consistent behavior across all connections, including your VPN tunnel, you can enable PMTUD globally via sysctl. Create or edit the file /etc/sysctl.d/99-pmtud.conf and add the following line:
net.ipv4.ip_no_pmtu_disc = 0Apply the changes immediately without rebooting by running:
sysctl -p /etc/sysctl.d/99-pmtud.confThis setting tells the Linux kernel to respect ICMP Fragmentation Needed messages. It is particularly important for UDP traffic, as UDP does not have built-in flow control like TCP. Without PMTUD, large UDP packets may be dropped by firewalls or routers that do not support fragmentation, resulting in silent data loss.
Adjusting MTU for the VPN Interface
While enabling PMTUD is essential, you must also ensure that the VPN interface itself is configured with an appropriate initial MTU. Most modern VPN protocols, such as WireGuard or OpenVPN, handle this automatically, but manual intervention may be required in complex setups.
For example, if you are using a custom script to bring up the interface, you might need to set the MTU explicitly. A common practice is to subtract 80 bytes from the physical interface's MTU to account for encapsulation overhead:
ip link set dev wg0 mtu 1420This value assumes a standard Ethernet MTU of 1500 bytes. Adjust this number based on your specific network environment. For more details on managing network interfaces, refer to our guide on Ubuntu server network interfaces.
Troubleshooting Connectivity Issues
If you experience intermittent disconnections or slow transfers despite having PMTUD enabled, check your firewall rules. The kernel requires ICMP Type 3 Code 4 (Fragmentation Needed) packets to reach the source IP. Ensure that your firewall allows inbound ICMP messages of this type.
You can test PMTUD functionality by pinging a remote host with the -M do flag, which sets the Don't Fragment bit:
ping -M do -s 1472 remote_hostStart with a payload size of 1472 (which results in a 1500-byte packet including headers). If this fails, reduce the size by 10 until it succeeds. This helps identify the actual MTU of the path. For further assistance with VPN-specific connectivity problems, see our article on Troubleshooting WireGuard no access to remote.
Frequently Asked Questions
Why does my VPN drop packets when PMTUD is enabled?
This usually occurs because intermediate firewalls block ICMP "Fragmentation Needed" messages. Ensure that your firewall permits inbound ICMP Type 3 Code 4 traffic to allow the kernel to adjust the MTU dynamically.
Can I disable PMTUD to fix stability issues?
Disabling PMTUD by setting ip_no_pmtu_disc=1 forces the kernel to fragment packets, which can prevent drops but significantly reduces throughput. It is generally recommended to keep PMTUD enabled and instead fix the underlying network or firewall configuration.
How do I find the correct MTU for my VPN interface?
Use the ping command with the -M do flag and vary the payload size until you find the largest packet that reaches the destination. Subtract the header overhead from this size to determine the optimal MTU for your interface.
Does PMTUD work with IPv6 VPN tunnels?
Yes, IPv6 uses similar mechanisms called Path MTU Discovery. The relevant sysctl parameter is net.ipv6.ip_no_pmtu_disc. Ensure this is also set to 0 for consistent behavior across both protocol versions.
What happens if the path MTU changes after connection establishment?
The Linux kernel updates the cached MTU for the route whenever it receives an ICMP Fragmentation Needed message. Subsequent packets will then use the new, smaller MTU, ensuring continued connectivity without manual intervention.