VPN MTU in Plain English: Why a Cafe Path Plus a Tunnel Can Stall

Picture a truck and a tunnel with a height limit. The truck was fine on the surface street. Wrap it in another truck and it clips the underpass. MTU is that limit for packets. The cafe AP, the hotel concentrator, a cheap LTE hop, a home ISP that already wrapped you in their own tunnel: any of those can be shorter than the 1500 you assumed. Add WireGuard or OpenVPN headers and the inner payload has to shrink or the packet has to fragment. Fragmentation is messy. A lot of paths refuse it. Then the fat packet dies quietly.

You do not need a lab to use the idea. You need to stop treating 'VPN is slow' as one disease. Throughput can be fine. Latency can be fine. A particular site still hangs because that site wanted a large segment and the path dropped it. Speed-test servers often use sizes and paths that survive. Your bank's upload, a VoIP burst, a game update, a WebRTC turn: different sizes. Different leftover.

Farms will still rank 'best VPN MTU setting 2026' as if a consumer slider were a personality. Some self-hosted WireGuard users do set an MTU. That is a lab they run. Klox consumer is an app with two protocols. I will not invent a third SKU named MTU so we look like a router firmware page. The lever that exists is WireGuard versus OpenVPN on the download apps' advanced settings. Use it as that.

HTTPS sits on top either way. RFC 8446 does not pick segment size for you. The padlock on a hanging site means the cafe is not reading the body. It does not mean the body arrived. Two locks, still. This post is the underpass, not the padlock essay.

The useful picture is split. Small HTTPS pages load. A form submit hangs. A call starts and then the other person sounds underwater on your side only. Steam sits at a percent. A video tile in a meeting freezes while chat still types. Those are size-shaped. Everything crawling, including ping and DNS, is usually radio, CPU, or a node a continent away. That leftover belongs to the speed-test essay and the WireGuard-speed essay. Do not bring an MTU story to a congested cafe AP.

You notice MTU when the failure is picky. One host. One direction. One app that sends larger writes. Browsers retry. Some stacks Path-MTU-Discover and recover. Some black-hole: the packet with Don't Fragment set hits a short link, ICMP 'too big' never comes back, the sender never shrinks, the session waits until it gives up. Cloudflare's fragmentation notes are blunt about ICMP getting filtered. Cafe gear filters ICMP for sport. VPN paths add another place for that ICMP to die.

I will not perform ping -M do -s theater. If you already live in packet captures, you know the test. If you do not, you do not need to start now. Trust the split: picky hang versus whole-path slowness. Protocol switch is the consumer lever. A slider I invent in JSON is not.

Five devices share an account, not a packet-size budget I made up. Each connected client is a seat. Two laptops on the same rude AP will fight the radio long before they fight Klox headers. Test one machine. Leave the rest alone for two minutes. Then interpret.

NordVPN's slow-VPN post is a competitor specimen of the mash: speed, servers, protocol, and sometimes a hidden network tweak in one ranking costume. Use it as a specimen. Do not import a winner. There is no winner. There is a height limit, a wrap, and a protocol you can change.

IPv4 can fragment. In practice a lot of senders set Don't Fragment and expect Path MTU Discovery. IPv6 forbids routers to fragment. If the packet is too big, it dies unless the sender already knew to shrink. A VPN is a tunnel: inner packet plus outer headers. The outer packet has to fit the cafe path. If the inner assumed 1500 and the outer ate 60 to 80 bytes, you are over. Some stacks clamp. Some do not on that OS, that protocol, that minute.

Home fiber often looks like a clean 1500. The stall shows up on the trip: hotel concentrator, airplane thin pipe, a phone hotspot that already wrapped you, LTE that lives closer to 1428 or 1280 depending on the carrier's own tunnel. You did not change Klox. The underpass changed. That is why a setting you never touched 'broke Steam' on Tuesday and was fine on the couch. Protocol switch is still the first consumer move. Re-testing at home tells you whether the leftover was the cafe.

I will not print 'we clamp MTU to N.' That would be an SLA we did not write. Client and server and path all participate. A blog number becomes a ticket when the path is 1280 on LTE and 1500 at home. Operators who run their own WireGuard pick a number for their lab. You are using an app. The app's documented knob is protocol.

ICMP is the control message that says 'too big, try smaller.' Middleboxes drop ICMP because someone told them it was an attack surface. Then PMTUD goes blind. Classic black hole. Symptoms look like a broken site, not like a missing ICMP. You cannot fix the hotel's ICMP policy from Klox Settings. You can try the other protocol, which encapsulates differently and sometimes takes a path that already learned a smaller size.

Do not disable IPv6 as a personality because an MTU blog mentioned v6. IPv6 leak protection is a different leftover: a home v6 that walked around a v4 tunnel. Size limits can happen on v4 alone. Mash them and you will file two tickets as one.

Klox ships four protocols. WireGuard is UDP, light, the default I want. OpenVPN can run UDP or TCP, including the spare-tire mode when a rude AP blocks WireGuard's UDP. That is the lever on download advanced settings. Confirm the rows in the live app. I will not invent a third row named MTU.

Why a protocol change can fix a size-shaped stall: different header tax, different inner MSS behavior, different code path for clamping, sometimes TCP which changes how loss looks. Why it can fail to fix one: the underpass is still short, ICMP is still dead, the app you care about still writes large. Then you are in 'this network is hostile' territory, not 'I need a slider.' Try a phone on cellular. Try home. Seven days on first purchase if the product cannot live on the network you actually have.

This is still not the TCP-versus-UDP course. That URL owns reliability layers and firewalls. Here the only point is: the documented consumer move is protocol, not a number you typed from a forum. Forum numbers are someone else's lab. 1280, 1420, 1380: those are folklore until you measured. We are not measuring for you in this post. We are refusing a fake SKU.

Smart Connect, if the row exists, is untrusted Wi-Fi. It starts a hop. It does not probe Path MTU as a product feature I will advertise. If handshake hangs, you may not have a route yet. Splash page first. Garden essay owns that. Size leftover comes after you have a tunnel that actually passed packets.

Yearly from $2.83 a month does not buy a personal MTU engineer. It buys five seats and two protocols. Use the second protocol before you open a calculator.

If OpenVPN still hangs on the fat app, try the phone on cellular with WireGuard. Different radio, different path, often a different size limit. If cellular is clean and the hotel is not, you learned the chair. If both hang, you may have a device CPU leftover or an app that hates tunnels for its own reasons. Gaming lag and VoIP each have their own URLs. This page will not become those. DNS through the tunnel still has to work or you will misread a name failure as a size failure. One leftover at a time.

A nearby Ookla run is a lab. Distance, Wi-Fi, protocol tax, phone CPU, and the site you actually use: that honesty lives on How to Read a VPN Speed Test Without Lying to Yourself. I will point at it. I will not paste the table so this URL can rank for Mbps. MTU stalls can coexist with a pretty lab. That is the whole reason this page exists as a sibling, not a subsection.

Why WireGuard Is Faster Than OpenVPN is why the default protocol is quick: handshake, crypto, small codebase. A light protocol still adds headers. Light is not 'fits every underpass.' Do not uninstall WireGuard because a cafe dropped large segments. Switch to OpenVPN once. Switch back at home. Do not live in OpenVPN TCP because one hotel was rude.

We do not publish Mbps guarantees. We do not publish city counts on this blog so a 'fastest VPN' farm can scrape them. Nearby is usually enough when the job is 'hide this hop from the shop,' not 'pretend I live in a catalog.' Catalogs are a different article. Size limits are not a catalog problem.

If the speed-test tab and the real site disagree, believe the real site. If both are fine except one fat upload, you are in this essay. If both are bad, start with radio and protocol as speed, not as MTU folklore.

HTTP/3 rides QUIC over UDP and encrypts the web session. A VPN is a tunnel to a node you picked. The cafe still sees UDP to an IP. That mash is the HTTP/3 and QUIC vs a VPN in Plain English essay. MTU can still bite QUIC: UDP datagrams have a size, and a tunnel wrap still eats budget. Do not merge the tickets. Encrypted transport is not a hop wrap. A hop wrap is not an HTTP/3 toggle. We do not ship an HTTP/3 toggle.

WireGuard is also UDP. Different destination. Cafe graphs 'UDP to the VPN' when you are connected, not 'UDP to the site,' unless something leaked around the tunnel. Size limits apply to that outer UDP too. If a hotel hates UDP entirely, you will never get to the MTU conversation. OpenVPN TCP is the spare tire. That is transport. Then, if TCP is up and large posts still hang, you are back on this page.

I will not invent a consumer UI that disables QUIC inside the tunnel. The site and the browser still negotiate that. I will not invent a city so QUIC 'works better.' Protocol is the lever. Padlock stays on. RFC 8446 still encrypted the inner session after the hop.

DNS through the tunnel still matters. A hanging site can be a resolver leftover, not MTU. If names never resolve, fix DNS before you blame packet height. The DNS-on-a-VPN article owns that hop. Do not stack a public resolver as a vitamin. We are not selling a custom-DNS picker here.

I will say it again because farms screenshot sliders. Klox consumer, in this article, has no MTU picker. No advertised clamp-to-N. No 'set 1420 for Steam' support macro I am going to publish as product. White-label or a self-hosted lab can have different glass. Confirm with sales if you are that buyer. You are probably not. You have two protocols and five devices.

What a size-hide still cannot do: make the AP honest. Scan the attachment. Unlock a catalog I did not promise. Replace unique passwords. SOC 2 because a buyer likes logos. The What a VPN Cannot Do list owns the cape. An MTU stall is a path problem. Encryption of a path that drops large packets is still a path that drops large packets.

Cookies on klox.app live at /cookie. They are not an MTU setting. A tracker cookie plus a hanging upload is two chores. Fix the hang with protocol. Leave cookies to the cookie page.

If a competitor's Linux guide tells you to type an MTU into wg0, that is their lab. Mullvad and Proton and a pile of forum posts live there. Specimen, not a SKU. Importing their number into a consumer ticket is how L1 spends a day proving the app does not have the field.

Connect. Load a small site. Load the fat thing you actually care about: the call, the upload, the updater. If the small site works and the fat thing hangs, switch WireGuard to OpenVPN (or back) in advanced settings. Try the fat thing once more. Then stop. Daily protocol hopping is how people forget to live.

If you want proof the hop moved, that is the Leak Test After You Connect a VPN article. IP, DNS, WebRTC, IPv6. A leak test will not print MTU. Do not demand it. If the IP is the VPN and the fat app still hangs, you have a path-size leftover, not a leak leftover.

Do this once on a network you control, once on the cafe that hurt you. Different underpasses. A clean home test is not a clean hotel test. Splash first if there is a garden. Then tunnel. Then the fat app.

Yearly from $2.83 a month is not a reason to skip the padlock. It is a reason you can afford the hop without a farm's lifetime coupon. Seven days on first purchase if the product is not the hop you wanted. Refunds live on /refund. Store purchases follow the store.

If you only needed the English, stop here. If you needed why WireGuard is light, that URL exists. If you needed how to read a lab, that honesty post exists. If you needed TCP versus UDP, that guide exists. If you needed QUIC, that sibling exists. If you needed a slider, you wanted a forum.