IPsec MTU Calculator
IPsec adds about 73 bytes to every packet, so over a normal 1500-byte link the inner MTU is 1427.
- Free
- No Sign-Up
- Runs in Your Browser
Encapsulation in the Path
Inner MTU
1500 − 73 bytes of headers
TCP MSS (IPv4)
TCP MSS (IPv6)
Largest Ping (IPv4)
Clamp MSS (nftables)
nft add rule inet filter forward tcp flags syn tcp option maxseg size set 1387
MTU & MSS Calculator
IPsec on a 1500-byte link
Overhead73 bytes
Inner MTU1427
TCP MSS (IPv4)1387
TCP MSS (IPv6)1367
Over PPPoE (1492)1419
Testping -M do -s 1399 <host>
If the inner interface keeps an MTU of 1500, packets larger than 1427 bytes are fragmented or dropped. The usual symptom: ping and small requests work, large downloads and TLS handshakes hang.
Set the IPsec interface's MTU to 1427, or clamp TCP MSS to 1387 on the router.
MTU by Tunnel
Questions
What MTU should I use for IPsec?
1427 over a standard 1500-byte link; 1419 over PPPoE.
How much overhead does IPsec add?
About 73 bytes per packet, varying with cipher and padding.
Free Tools
More tools
MTU & MSS CalculatorWork out MTU and TCP MSS through VLANs, PPPoE, VXLAN and VPN tunnels.Subnet CalculatorNetwork, broadcast, usable range and mask for any IPv4 or IPv6 CIDR.Bandwidth CalculatorConvert Mbps to TB per month, and time a transfer at any speed.Firewall Rule GeneratorGenerate iptables, nftables and UFW rules for common server set-ups.
Watch every VM interface
Frabs reads traffic on every guest interface, VXLAN and VLAN included, and stops abuse without touching your firewall.