From: Zack Newman <zack@philomathiclife.com>
Subject: Should the default MTU of wg(4) be 1408?
To: tech@openbsd.org
Date: Mon, 7 Sep 2026 15:58:07 -0600

WireGuard pads plaintext such that its length is a multiple of 16[^1].
This means the default MTU should be based on the following equation:

M = P + IP header + UDP header + WireGuard message header + Poly1305 tag
   = P + 20/40 + 8 + 16 + 16 = P + 20/40 + 40 = P + 60/80

where M is the MTU of the physical connection and P is the length of the
ciphertext.

Since ChaCha20 is a stream cipher, P is also the length of the padded
plaintext which is a multiple of 16 as previously stated.

To play it safe, assume M is the standard Ethernet MTU of 1500 and IPv6
is used; then P = max{16q | 16q <= 1420} = 1408. If IPv4 were assumed,
then P = max{16q | 16q <= 1440} = 1440; so the default would be 1440 in
that situation.

I believe this is the cause of the recent issue[^2] I started
experiencing.

Is there something wrong with my reasoning?

[^1]: https://github.com/openbsd/src/blob/master/sys/net/if_wg.c#L1594
[^2]: https://marc.info/?l=openbsd-misc&m=178871489727665&w=2