Commit 53638d8f7ce8

Vincent Demeester <vincent@sbr.pm>
2026-07-17 09:05:26
fix(wireguard): lower client MTU to 1340 for encapsulated paths
Default WireGuard MTU of 1420 caused silent packet drops on networks with extra encapsulation (DS-Lite, CGNAT, PPPoE), breaking SSH sessions that sent packets exceeding the real path MTU (~1392).
main
1 parent 8f5f4c1
Changed files (1)
systems
common
services
wireguard.nix
systems/common/services/wireguard.nix
@@ -23,6 +23,9 @@ in
       ips = libx.wg-ips machine.net.vpn.ips;
       endpoint = globals.net.vpn.endpoint;
       endpointPublicKey = globals.machines.${vpnServer}.net.vpn.pubkey;
+      # Conservative MTU for paths with extra encapsulation (mobile, PPPoE, DS-Lite).
+      # Default 1420 causes silent packet drops on some networks (e.g. Vodafone DE).
+      mtu = 1340;
     };
   };
 }