What do `ip mtu` and `ip tcp adjust-mss` on a tunnel interface actually do?
Show the answer
Say this first
ip mtu 1400 is the largest IP packet the router sends into the tunnel before encapsulation. A bigger
packet with DF clear is fragmented before encryption, so the far gateway does not have to reassemble
anything; one with DF set is dropped and the router sends an ICMP "fragmentation needed" message with
MTU 1400 so the sender can shrink its packets. ip tcp adjust-mss 1360 rewrites the MSS option in TCP
SYN and SYN-ACK packets crossing the interface, so TCP never sends segments larger than 1360 bytes of
data: 1360 plus 20 bytes of IP and 20 of TCP is 1400. MSS clamping keeps TCP working even when ICMP is
blocked.
Go deeper
The usual pair
interface Tunnel0
ip mtu 1400
ip tcp adjust-mss 1360Fragment before or after encryption
- Before: the inner packet is split, each fragment is encrypted on its own, and the destination host reassembles. Cheap for the VPN routers.
- After: the ESP packet is split, and the receiving gateway must reassemble before it can decrypt. Expensive, and some platforms do it in software.
Path MTU discovery black holes
Hosts send with DF set and wait for ICMP type 3 code 4. If a firewall drops those messages, large packets vanish silently: small requests work, big transfers hang. MSS clamping hides this for TCP.
Other platforms
- IPv6 inside the tunnel:
ipv6 tcp adjust-mss 1340(60 bytes of IPv6 and TCP headers). - Linux:
Shell iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
They will ask next
Why not raise the WAN MTU instead?
You do not control the internet path, and it is 1500 almost everywhere. Inside a private WAN or a data center you can raise the underlay MTU to 1600 or more, which is the clean fix and what VXLAN fabrics do.
Does adjust-mss help UDP?
No. It only edits TCP SYNs. Large UDP, such as DNS with big responses or video, still depends on
ip mtuwith fragmentation or on working PMTUD.
Traps
- Setting
ip mtuonly and assuming TCP is fine. Without MSS clamping, TCP depends on ICMP getting back to the sender.