Derive the inner MTU and TCP MSS clamp for any tunnel type from the underlay path MTU.
Every tunnel steals bytes from the inner MTU, and TCP only learns about it through path-MTU discovery, which is frequently blocked by firewalls dropping ICMP. Clamping MSS on the tunnel interface removes the dependency by telling both endpoints the true segment size during the handshake. This is the single most common cause of 'the ping works but the website hangs' — small packets pass, full-size segments are silently dropped.
Tunnel MTU
tunnel MTU = path MTU − encapsulation bytes; MSS = tunnel MTU − 40 for IPv4 or − 60 for IPv6.
tunnel MTU = path MTU − encapsulation bytes; MSS = tunnel MTU − 40 for IPv4 or − 60 for IPv6. Every tunnel steals bytes from the inner MTU, and TCP only learns about it through path-MTU discovery, which is frequently blocked by firewalls dropping ICMP. Clamping MSS on the tunnel interface removes the dependency by telling both endpoints the true segment size during the handshake.
This is the single most common cause of 'the ping works but the website hangs' — small packets pass, full-size segments are silently dropped.
This calculator takes 4 inputs: Underlay path MTU, Tunnel type, Extra 802.1Q tags on the path, Inner IP version. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.