Skip to main content

MikroTik WireGuard VPN MTU & MSS Calculator

Deploy site-to-site WireGuard VPN on RouterOS v7 with automatic TCP MSS Clamping to prevent tunnel web page freezes and PMTUD black holes.

Input Parameters

Try Example:
165535

Calculation Results

Link Encapsulation Type
pppoe
Effective MTU Size
1,480 Bytes
IP Protocol Version
ipv4
IP Header Size
20 Bytes
TCP Header Size
20 Bytes
ICMP Header Size
8 Bytes
Optimal TCP MSS Clamping Value
1,440 Bytes
Max DF Ping Test Payload
1,452 Bytes
Tunnel Encapsulation Overhead
20 Bytes
Protocol Overhead Breakdown
PPPoE Standar ISP Fiber / DSL (8–20 Byte Header)
Public WAN Interface
pppoe-out1
WireGuard UDP Listen Port
13231
WireGuard Tunnel Subnet
10.200.200.1/24
Peer Endpoint Public IP
10.200.200.2/32
Remote Site LAN Subnet
192.168.90.0/24
Want to compare 2 design options side-by-side (e.g., Scenario A vs Scenario B)?
⚡ Enterprise SMB Tier (150–800 Mbps)
MikroTik RB5009UG+S+IN / L009UiGS
RouterOS v7 Level 5 • Marvell Armada Quad-Core 1.4 GHz (1GB RAM)

Handles Multi-WAN PCC mangle rules and FQ-CoDel queue trees with low CPU utilization.

DF Ping Test Command (Windows)
ping 1.1.1.1 -f -l 1452
DF Ping Test Command (Linux)
ping -M do -s 1452 1.1.1.1
DF Ping Test Command (macOS)
ping -D -s 1452 1.1.1.1
Terminal Configuration Script (CLI)
# =====================================================================
# KalkuNet — MikroTik RouterOS v7 MTU/TCP MSS Clamping & WireGuard VPN
# Jenis Link: PPPOE | MTU Optimal: 1480 | TCP MSS: 1440
# =====================================================================

# 1. Perbaikan Website Sering Loading Lama / Gagal Buka di PPPoE & VPN (TCP MSS Clamping)
/ip firewall mangle
add action=change-mss chain=forward in-interface=pppoe-out1 new-mss=1440 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1441-65535 comment="Clamp TCP MSS Inbound (pppoe-out1 -> 1440)"
add action=change-mss chain=forward out-interface=pppoe-out1 new-mss=1440 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1441-65535 comment="Clamp TCP MSS Outbound (pppoe-out1 -> 1440)"
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn comment="Auto Clamp PMTU All Tunnels"

# 2. Setup Interface WireGuard VPN (RouterOS v7 Native)
/interface wireguard
add listen-port=13231 mtu=1420 name=wg-infracalc comment="WireGuard VPN Site-to-Site / Remote"

/ip address
add address=10.200.200.1/24 interface=wg-infracalc comment="IP Gateway Tunnel WireGuard"

/interface wireguard peers
# Ganti PUBLIC_KEY_CABANG dengan Public Key dari router cabang / client
add allowed-address=10.200.200.2/32,192.168.90.0/24 interface=wg-infracalc public-key="ISI_PUBLIC_KEY_PEER_DISINI=" persistent-keepalive=25s comment="Peer Cabang / Remote Admin"

/ip firewall filter
add action=accept chain=input dst-port=13231 protocol=udp place-before=0 comment="Allow WireGuard Handshake UDP 13231"

/ip route
add dst-address=192.168.90.0/24 gateway=wg-infracalc comment="Route ke LAN Cabang via WireGuard"

# Cara Test Fragmentasi Paket dari CMD Windows: ping 1.1.1.1 -f -l 1452
Multi-Vendor CLI & Packet Flow

Multi-Vendor Config Translator & Interactive Packet Flow Visualizer

Interactive Packet Flow Pipeline (Click Stage to Inspect)WAN ➔ Prerouting/NAT ➔ Filter/QoS ➔ LAN
1. Client TCP SYNDefault MSS 1460B2. TCP MSS ClampingClamp MSS -> 1380B3. Tunnel EncapsulationTunnel MTU 1420B4. ISP WAN TransitNo PMTUD Blackhole
1. Client TCP SYN: LAN host initiates TCP 3-way handshake advertising standard 1460-byte MSS.
# =====================================================================
# KalkuNet — MikroTik RouterOS v7 MTU/TCP MSS Clamping & WireGuard VPN
# Jenis Link: PPPOE | MTU Optimal: 1480 | TCP MSS: 1440
# =====================================================================

# 1. Perbaikan Website Sering Loading Lama / Gagal Buka di PPPoE & VPN (TCP MSS Clamping)
/ip firewall mangle
add action=change-mss chain=forward in-interface=pppoe-out1 new-mss=1440 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1441-65535 comment="Clamp TCP MSS Inbound (pppoe-out1 -> 1440)"
add action=change-mss chain=forward out-interface=pppoe-out1 new-mss=1440 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1441-65535 comment="Clamp TCP MSS Outbound (pppoe-out1 -> 1440)"
add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn comment="Auto Clamp PMTU All Tunnels"

# 2. Setup Interface WireGuard VPN (RouterOS v7 Native)
/interface wireguard
add listen-port=13231 mtu=1420 name=wg-infracalc comment="WireGuard VPN Site-to-Site / Remote"

/ip address
add address=10.200.200.1/24 interface=wg-infracalc comment="IP Gateway Tunnel WireGuard"

/interface wireguard peers
# Ganti PUBLIC_KEY_CABANG dengan Public Key dari router cabang / client
add allowed-address=10.200.200.2/32,192.168.90.0/24 interface=wg-infracalc public-key="ISI_PUBLIC_KEY_PEER_DISINI=" persistent-keepalive=25s comment="Peer Cabang / Remote Admin"

/ip firewall filter
add action=accept chain=input dst-port=13231 protocol=udp place-before=0 comment="Allow WireGuard Handshake UDP 13231"

/ip route
add dst-address=192.168.90.0/24 gateway=wg-infracalc comment="Route ke LAN Cabang via WireGuard"

# Cara Test Fragmentasi Paket dari CMD Windows: ping 1.1.1.1 -f -l 1452
Share to WhatsApp
ℹ️

Technical Accuracy Note: Calculation results are engineering estimates based on standard RFC/IEEE/ITU-T models. Actual field performance may vary due to protocol overhead, hardware specifications, and environmental factors.

🚀 Share Calculation Results or Embed on Your Site

Deep-link automatically preserves your current inputs — ideal for WhatsApp, Telegram, Reddit, or engineering docs.

How to Use This Tool

  1. Select your underlying WAN connection type (PPPoE 1480, Ethernet 1500, or LTE 1428) and specify your WAN interface name.
  2. Specify your WireGuard UDP listen port (default 13231), local tunnel gateway IP, remote peer IP, and remote branch LAN subnet CIDR.
  3. Review the comprehensive RouterOS v7 script featuring TCP MSS Clamping, WireGuard interface setup, UDP handshake firewall rules, and static route generation, then copy it to your terminal.

Worked Example: PPPoE Fiber WAN (MTU 1480 → WireGuard 1420)

Computed example: An underlying PPPOE WAN link (MTU 1480) with TCP MSS 1440. Configures a WireGuard interface on UDP port 13231 with tunnel IP 10.200.200.1/24, peer 10.200.200.2/32, and static route to remote LAN 192.168.90.0/24 alongside automated MSS Clamping.

Example Input
Router WAN Connection Type
PPPoE Fiber ISP (MTU 1480 -> MSS 1440)
Router WAN Interface Name
pppoe-out1
WireGuard UDP Listen Port
13231
WireGuard Tunnel Gateway IP
10.200.200.1/24
Branch Peer Tunnel IP
10.200.200.2/32
Remote Branch LAN Subnet
192.168.90.0/24
Calculated Output
Link Encapsulation Type
pppoe
Effective MTU Size
1,480 Bytes
IP Protocol Version
ipv4
IP Header Size
20 Bytes
TCP Header Size
20 Bytes
ICMP Header Size
8 Bytes
Optimal TCP MSS Clamping Value
1,440 Bytes
Max DF Ping Test Payload
1,452 Bytes
Tunnel Encapsulation Overhead
20 Bytes
Protocol Overhead Breakdown
PPPoE Standar ISP Fiber / DSL (8–20 Byte Header)
Public WAN Interface
pppoe-out1
WireGuard UDP Listen Port
13231
WireGuard Tunnel Subnet
10.200.200.1/24
Peer Endpoint Public IP
10.200.200.2/32
Remote Site LAN Subnet
192.168.90.0/24
DF Ping Test Command (Windows)
ping 1.1.1.1 -f -l 1452
DF Ping Test Command (Linux)
ping -M do -s 1452 1.1.1.1
DF Ping Test Command (macOS)
ping -D -s 1452 1.1.1.1
Terminal Configuration Script (CLI)
# ===================================================================== # KalkuNet — MikroTik RouterOS v7 MTU/TCP MSS Clamping & WireGuard VPN # Jenis Link: PPPOE | MTU Optimal: 1480 | TCP MSS: 1440 # ===================================================================== # 1. Perbaikan Website Sering Loading Lama / Gagal Buka di PPPoE & VPN (TCP MSS Clamping) /ip firewall mangle add action=change-mss chain=forward in-interface=pppoe-out1 new-mss=1440 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1441-65535 comment="Clamp TCP MSS Inbound (pppoe-out1 -> 1440)" add action=change-mss chain=forward out-interface=pppoe-out1 new-mss=1440 passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=1441-65535 comment="Clamp TCP MSS Outbound (pppoe-out1 -> 1440)" add action=change-mss chain=forward new-mss=clamp-to-pmtu passthrough=yes protocol=tcp tcp-flags=syn comment="Auto Clamp PMTU All Tunnels" # 2. Setup Interface WireGuard VPN (RouterOS v7 Native) /interface wireguard add listen-port=13231 mtu=1420 name=wg-infracalc comment="WireGuard VPN Site-to-Site / Remote" /ip address add address=10.200.200.1/24 interface=wg-infracalc comment="IP Gateway Tunnel WireGuard" /interface wireguard peers # Ganti PUBLIC_KEY_CABANG dengan Public Key dari router cabang / client add allowed-address=10.200.200.2/32,192.168.90.0/24 interface=wg-infracalc public-key="ISI_PUBLIC_KEY_PEER_DISINI=" persistent-keepalive=25s comment="Peer Cabang / Remote Admin" /ip firewall filter add action=accept chain=input dst-port=13231 protocol=udp place-before=0 comment="Allow WireGuard Handshake UDP 13231" /ip route add dst-address=192.168.90.0/24 gateway=wg-infracalc comment="Route ke LAN Cabang via WireGuard" # Cara Test Fragmentasi Paket dari CMD Windows: ping 1.1.1.1 -f -l 1452

Core Concept & Engineering Notes

WireGuard is a state-of-the-art, high-performance VPN protocol implemented natively in MikroTik RouterOS v7. Because WireGuard encapsulates IP datagrams inside UDP packets, it introduces unavoidable overhead: 20 to 40 bytes for the outer IP header, 8 bytes for the outer UDP header, 16 bytes for the WireGuard transport header, and a 16-byte Poly1305 authentication tag (totaling 60 to 80 bytes of crypto overhead). Consequently, WireGuard interfaces running over standard IPv4 networks default to an optimal MTU of 1420 bytes rather than 1500 bytes. The primary operational obstacle encountered in site-to-site WireGuard deployments is the sudden stall or freeze of large TLS handshakes, HTTPS portal logins, or SMB file transfers between office locations. This occurs because internal workstations on 1500-byte Ethernet segments send maximum-sized packets with the Don't Fragment (DF) bit set into the 1420-byte WireGuard tunnel. If Path MTU Discovery is broken by upstream firewalls discarding ICMP 'Fragmentation Needed' packets, intermediate routers silently drop the frames, generating a debilitating PMTUD black hole. This calculator generates an end-to-end RouterOS v7 deployment script that resolves MTU negotiation errors permanently. In addition to creating the WireGuard interface, tunnel IP addressing, peer configuration, and static routing to remote branch subnets, it embeds active TCP MSS Clamping rules on both the WAN and tunnel interfaces. Clamping MSS during the TCP SYN handshake forces endpoints to negotiate segment sizes that fit seamlessly into the encapsulation envelope without packet fragmentation.

How It Was Calculated (Formulas & Steps)

Frequently Asked Questions (FAQ)

Why is the default WireGuard MTU 1420 bytes in RouterOS v7?

Standard Ethernet supports a 1500-byte MTU. WireGuard encapsulation adds up to 80 bytes of overhead (20/40-byte outer IP, 8-byte UDP, 32-byte WireGuard header & Poly1305 MAC). Subtracting 80 from 1500 yields 1420 bytes, guaranteeing zero fragmentation even over IPv6 backbones.

What is the difference between setting a specific `new-mss=1440` versus `new-mss=clamp-to-pmtu`?

Setting an explicit numeric MSS (e.g. 1440 on PPPoE) hardcodes a safe ceiling for traffic crossing that specific interface. The `clamp-to-pmtu` parameter dynamically derives the MSS from the router's egress interface MTU, acting as an optimal universal fallback.

Why is persistent-keepalive=25s essential for WireGuard peers?

When a branch peer is behind an ISP NAT or carrier CGNAT, upstream stateful firewalls flush inactive UDP mappings after 30 seconds. A 25-second keepalive sends a periodic ping to keep the NAT port binding alive, allowing the central office to initiate contact at any time.

Related Calculators

View All Network & Routing Tools →
MTU and TCP MSS Clamping Calculator

Calculate optimal MTU sizes, TCP MSS clamping (IPv4/IPv6), and Don't Fragment ping payloads to resolve web page freezes over PPPoE and VPN tunnels.

MikroTik Port Forwarding (DST-NAT) and Hairpin NAT Generator

Expose internal server/NVR ports to the public internet (DST-NAT) and eliminate local loopback timeouts using Hairpin NAT.

MikroTik QoS Priority and Anti-Lag Calculator

Prioritize WhatsApp calls, Zoom/Teams conferences, and gaming latency above bulk downloads using RouterOS v7 FQ-CoDel Queue Trees.

IPv4 Subnet and CIDR Calculator

Calculate IPv4 network address, broadcast, usable host range, netmask, wildcard, binary mask, and RFC address type (RFC 1918, /31, CGNAT).

IPv4 Subnet Split and VLSM Planner

Split an IPv4 network into N equal subnets or allocate boundary-aligned VLSM blocks by required host count with CSV and Markdown export.

IPv6 Subnet Calculator and Prefix Planner (/48, /56, /64)

Expand and compress IPv6 addresses per RFC 5952, calculate network prefix boundaries, /64 SLAAC subnet counts, and child prefix blocks.

Complete Network & Routing Directory →

References & Notes

Last updated: Technically Verified · Industry Standard

Note: Results above are mathematical estimates based on standard formulas. Always verify against official vendor documentation and site conditions before production deployment.

🔗Related Scenarios & Companion Calculators

Browse All 30+ Scenarios →

⚡ Ready-to-Use Scenario Presets:

/32 = Mask 255.255.255.255 • 1 Usable Hosts→
/32 Subnet Mask (255.255.255.255): Usable Hosts (1), Wildcard & IPv4 Range

Instant /32 CIDR reference: Subnet Mask is 255.255.255.255, Wildcard 0.0.0.0, Total IPs 1, and 1 Usable Hosts. Ideal for OSPF/BGP Router Loopback & Single Host Route.

/30 = Mask 255.255.255.252 • 2 Usable Hosts→
/30 Subnet Mask (255.255.255.252): Usable Hosts (2), Wildcard & IPv4 Range

Instant /30 CIDR reference: Subnet Mask is 255.255.255.252, Wildcard 0.0.0.3, Total IPs 4, and 2 Usable Hosts. Ideal for Point-to-Point Inter-Router WAN Link (2 Usable IPs).

/29 = Mask 255.255.255.248 • 6 Usable Hosts→
/29 Subnet Mask (255.255.255.248): Usable Hosts (6), Wildcard & IPv4 Range

Instant /29 CIDR reference: Subnet Mask is 255.255.255.248, Wildcard 0.0.0.7, Total IPs 8, and 6 Usable Hosts. Ideal for DMZ Public Server Sub-Block & BGP Peering (6 Hosts).

🛠️ Sibling Calculators in this Category:

IPv4 Subnet and CIDR Calculator

Calculate IPv4 network address, broadcast, usable host range, netmask, wildcard, binary mask, and RFC address type (RFC 1918, /31, CGNAT).

IPv4 Subnet Split and VLSM Planner

Split an IPv4 network into N equal subnets or allocate boundary-aligned VLSM blocks by required host count with CSV and Markdown export.

IPv6 Subnet Calculator and Prefix Planner (/48, /56, /64)

Expand and compress IPv6 addresses per RFC 5952, calculate network prefix boundaries, /64 SLAAC subnet counts, and child prefix blocks.

MikroTik Bandwidth Calculator (Simple Queue, Burst, PCQ, FQ-CoDel)

Calculate Limit-At (CIR), Max-Limit (MIR), Burst, PCQ, and FQ-CoDel for RouterOS v7 with automated configuration script generation.

🔬 Scientific Methodology & Normative Verification

Engineering Sensitivity Analysis, Response Curve & Technical Citation

✓ Calibrated to ISO/IEC/IEEE/TIA Clauses

1. 1. 3-Point Engineering Sensitivity & Tolerance Envelope

Comparative evaluation across theoretical laboratory bounds (0% loss), current nominal operating point, and conservative field safety bounds (±15% thermal/aging derating).

Evaluated Parameter Ideal Theoretical Bound Nominal Operating Point Conservative Safety Bound (±15%) Engineering Derating Rule
Effective MTU Size 1,332 1,480 1,702 Engineering Safety Margin (+15% Overhead)
IP Header Size 18 20 23 Engineering Safety Margin (+15% Overhead)
TCP Header Size 18 20 23 Engineering Safety Margin (+15% Overhead)
ICMP Header Size 7.2 8 9.2 Engineering Safety Margin (+15% Overhead)
Optimal TCP MSS Clamping Value 1,296 1,440 1,656 Engineering Safety Margin (+15% Overhead)

2. 2. Mathematical Function Curve & Operating Coordinate (x₀, y₀)

MATHEMATICAL RESPONSE CURVE: EFFECTIVE MTU SIZE VS WIREGUARD UDP LISTEN PORT Conservative Engineering Bound (+15% Safety Margin) 5,292 7,939 10,585 13,231 15,877 18,523 21,170 (x₀=13,231, y₀=1,480) Variabel Independen (x): WireGuard UDP Listen Port

3. 3. Physical Constants & Normative Standard Clauses

R_loop(Cat6, 20°C) = 14 Ω/100m ANSI/TIA-568.2-D & IEEE 802.3bt

DC Loop Resistance for 23 AWG Solid Copper Cat6

Clause 6.4.1 / Table 145-1 — Nominal 23 AWG solid copper loop resistance at 20°C is 14.0 Ω/100m (TIA maximum ceiling is 18.8 Ω/100m).

α_opt(1490nm) = 0.25 dB/km ITU-T Rec. G.652.D & G.984.2

Single-Mode Optical Fiber Attenuation Coefficient at 1490 nm

Table 1 / Class B+ & C+ Optical Path — Typical G.652.D attenuation at 1490 nm downstream is 0.22–0.25 dB/km (1310 nm upstream: 0.35 dB/km).

α_Cu(20°C) = 0.00393 °C⁻¹ IEC 60028

Temperature Coefficient of Resistance for Copper

International Annealed Copper Standard — Used in thermal derating equation: R(T) = R_20 × [1 + 0.00393 × (T - 20)].

4. 4. Independent Technical & Academic Citation (IEEE / APA 7th / BibTeX / LaTeX)

Use the standard citation formats below to reference this computational methodology in engineering specifications, audit reports, or academic papers.

Format IEEE & APA 7th Edition

[IEEE] KalkuNet Engineering Team, "MikroTik WireGuard VPN MTU & MSS Calculator — Standard Engineering Computational Instrument," KalkuNet Technical Suite, 2026. [Online]. Available: https://kalkunet.com/en/tools/mikrotik-wireguard-mtu-calculator. [Accessed: 2026-11-08].

[APA 7th] KalkuNet Engineering Team. (2026). MikroTik WireGuard VPN MTU & MSS Calculator (Production release 2026-11-08) [Engineering computational software]. KalkuNet. https://kalkunet.com/en/tools/mikrotik-wireguard-mtu-calculator

BibTeX & LaTeX Derivation Snippet
@software{kalkunet_mikrotik_wireguard_mtu_calculator_2026,
  author = {{KalkuNet Engineering Team}},
  title = {{MikroTik WireGuard VPN MTU & MSS Calculator --- KalkuNet Engineering Suite}},
  year = {2026},
  publisher = {KalkuNet.com},
  url = {https://kalkunet.com/en/tools/mikrotik-wireguard-mtu-calculator},
  urldate = {2026-11-08}
}

% LaTeX Engineering Derivation — Generated via https://kalkunet.com/en/tools/mikrotik-wireguard-mtu-calculator
\begin{equation}
  \text{Model: } WireGuard Interface MTU = 1420 bytes (1500 − 80 bytes overhead)
\end{equation}
% Parameter Input Terukur: linkType = pppoe, \; wanIface = pppoe-out1, \; wgPort = 13231, \; wgNet = 10.200.200.1/24
% Hasil Evaluasi Numerik : linkType = \mathbf{pppoe}, \; mtu = \mathbf{1480}, \; ipVersion = \mathbf{ipv4}