Tunnel MTU Calculator
Derive the inner MTU and TCP MSS clamp for any tunnel type from the underlay path MTU.
About Tunnel MTU Calculator
Every tunnel steals bytes from the inner MTU, and TCP only learns about it through path-MTU discovery, which is frequently blocked by firewalls dropping ICMP. Clamping MSS on the tunnel interface removes the dependency by telling both endpoints the true segment size during the handshake. This is the single most common cause of 'the ping works but the website hangs' — small packets pass, full-size segments are silently dropped.
Formula
Tunnel MTU
tunnel MTU = path MTU − encapsulation bytes; MSS = tunnel MTU − 40 for IPv4 or − 60 for IPv6.
- path MTU
- Smallest MTU on the underlay between the two tunnel endpoints
- MSS
- Largest TCP segment payload that fits without fragmenting
Worked example
With the default values below, Tunnel MTU Calculator returns Tunnel MTU of 1,444. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Underlay path MTUaccepts 576–9,216 bytes
- 1,500 bytes
- Tunnel typeone of GRE (24 B), VXLAN (50 B), Geneve with 16 B options (66 B), IPsec ESP tunnel, AES-GCM (56 B), IPsec ESP tunnel, AES-CBC + SHA (73 B), IPsec ESP + NAT-T UDP (64 B), GRE over IPsec transport (61 B), WireGuard (60 B)
- IPsec ESP tunnel, AES-GCM (56 B)
- Extra 802.1Q tags on the pathaccepts 0–2 tags
- 0 tags
- Inner IP versionone of IPv4 + TCP (40 B), IPv6 + TCP (60 B)
- IPv4 + TCP (40 B)
Results
- Tunnel MTU
- 1,444 bytes
- TCP MSS to Clamp
- 1,404 bytes
- Total Overhead
- 56 bytes
- Fragments for a 1500 B Packet
- 2
- MSS Clamping Required
- Yes
Step by step
- 1Values used
- 2Tunnel MTU
- 3Tunnel MTU= 1,444 bytes
- 4TCP MSS to Clamp= 1,404 bytes
- 5Total Overhead= 56 bytes
- 6Fragments for a 1500 B Packet= 2
- 7MSS Clamping Required= Yes
Assumptions and limits
- The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Tunnel MTU calculated?
tunnel MTU = path MTU − encapsulation bytes; MSS = tunnel MTU − 40 for IPv4 or − 60 for IPv6. Every tunnel steals bytes from the inner MTU, and TCP only learns about it through path-MTU discovery, which is frequently blocked by firewalls dropping ICMP. Clamping MSS on the tunnel interface removes the dependency by telling both endpoints the true segment size during the handshake.
Why does Tunnel MTU matter?
This is the single most common cause of 'the ping works but the website hangs' — small packets pass, full-size segments are silently dropped.
What values do I need to enter?
This calculator takes 4 inputs: Underlay path MTU, Tunnel type, Extra 802.1Q tags on the path, Inner IP version. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.