In short: VPN fragmentation is when a network packet is split into pieces because it exceeds the maximum size (MTU) allowed along its path. The tunnel adds its own headers to every packet, so the original easily crosses the limit and gets chopped up — causing extra overhead, packet loss and dropouts. It shows up as slow loading, heavy pages that hang and large downloads that break, even though the connection looks fine. The fix is lowering the MTU (usually to 1400–1420) and MSS clamping; for WireGuard the typical working value is 1420.
What is VPN fragmentation in plain terms?
Fragmentation is splitting one network packet into several smaller ones when the packet is larger than a network segment can carry. Every link can only pass a packet up to a certain length; anything bigger must be broken up or dropped. On an ordinary network this is a routine mechanism, but inside a VPN tunnel it becomes a source of delays and dropouts.
The reason is that a VPN wraps your traffic in an extra layer. The original packet is encrypted and given new tunnel headers, which increases its size. If after this wrapping the packet exceeds the network limit, it gets fragmented — one logical chunk of data now travels as two or three pieces, each of which can be lost or delayed. For how traffic moves inside the tunnel, see how a VPN works.
What MTU and MSS are, and how they relate to VPN
MTU (Maximum Transmission Unit) is the largest packet size in bytes that an interface passes whole, without splitting. For standard Ethernet and most home networks the MTU is 1500 bytes. As soon as a wrapped VPN packet exceeds that, fragmentation begins. MSS is usually mentioned alongside MTU — it's the maximum payload inside a TCP packet, i.e. MTU minus the IP and TCP headers.
The difference is simple: MTU describes the whole packet, MSS only its payload. Managing these two values is how tunnel fragmentation is solved.
| Parameter | What it describes | Typical value |
|---|---|---|
| MTU | Maximum size of the whole packet on an interface | 1500 (Ethernet), 1420 for WireGuard |
| MSS | Maximum payload in a TCP segment | MTU minus 40 bytes (IPv4) |
| Tunnel overhead | Encryption headers the VPN adds | 60–100 bytes depending on protocol |
Why a VPN specifically causes fragmentation
A VPN causes fragmentation because every encrypted packet gets an extra wrapper and grows larger. Think of putting a letter into a new envelope: the text is unchanged, but the envelope with its address and stamp takes up more room. The tunnel likewise adds encryption and encapsulation headers, and if the base packet was already close to the 1500-byte limit, the final size crosses it.
The size of this overhead depends on the VPN protocol. That's why the same site can open fine on one network and hang on another: different protocols leave a different margin before the fragmentation threshold. If you want to understand the protocols themselves, start with an overview of how a VPN works.
| Protocol | Approx. overhead | Behaviour under fragmentation |
|---|---|---|
| WireGuard | ~60 bytes | Compact headers, recommended MTU 1420 |
| OpenVPN (UDP) | ~70–100 bytes | Sensitive to MTU, often needs manual tuning |
| IKEv2/IPsec | ~60–80 bytes | Can negotiate MTU, but not on every network |
How fragmentation shows up: symptoms
The main sign of fragmentation is a connection that is technically up but works unevenly and selectively. The VPN is connected, light sites open, but heavy pages, video and file downloads hang or break halfway. This distinguishes an MTU problem from a total connection failure, where nothing works at all.
Typical symptoms pointing to fragmentation:
- pages load partially — text appears while images and heavy elements hang;
- small sites open instantly, large ones take a long time or error out;
- uploads and downloads break before finishing;
- video starts but constantly stalls on buffering;
- speed over the VPN is far lower than without it, even though ping is normal.
If the VPN simply won't connect at all, the cause is probably different. General slowdown without dropouts is more often about server load and distance — but when the connection is up and only heavy transfers break, fragmentation is the prime suspect. After tuning, confirm the tunnel is stable and leak-free the same way you would on a flaky Wi-Fi network.
How to confirm fragmentation is the cause
You can test the fragmentation theory manually with a ping that forbids splitting. The idea is to send a fixed-size packet with the Don't Fragment flag and shrink it until it passes. The largest size that gets through without loss reveals your real MTU.
- Windows: run
ping -f -l 1472 8.8.8.8. The-fflag forbids fragmentation,-lsets the size. If you see "Packet needs to be fragmented but DF set", the size is too big. - macOS and Linux: the flags differ —
ping -D -s 1472 8.8.8.8(macOS) orping -M do -s 1472 8.8.8.8(Linux). - Lower the value (1472 → 1400 → 1380) until packets start passing without an error.
- Add 28 bytes to the size that worked — that's your working MTU (28 bytes go to the IP and ICMP headers).
For example, if a packet passes at size 1372, your MTU is 1400.
How to fix fragmentation: setting the MTU
VPN fragmentation is fixed in two ways: lowering the MTU on the tunnel interface and MSS clamping. The first reduces the packet size itself, the second makes the remote side stop sending oversized TCP segments. For most users the first is enough — set a smaller MTU in the app.
- Find the MTU setting in the VPN app or connection config. In advanced clients it lives in the profile's extra parameters.
- Lower it from 1500 to 1420 — a safe starting point for most protocols and networks.
- Check stability: open a heavy page or start a download. If the dropouts are gone, the value is right.
- Go lower if needed — down to 1400 or 1380 if the problem persists on mobile networks or through some routers.
- No MTU option? Switch protocol: WireGuard's encapsulation is more compact and often runs more stably than OpenVPN on fussy networks.
If you manage the connection through a config file, the MTU is usually a line in the interface section (for example MTU = 1420 in a WireGuard config). You don't need to change anything on your home router — a client-side edit is enough in the vast majority of cases.
Optimal MTU values for WireGuard, OpenVPN and IKEv2
There is no single "correct" MTU — it depends on the protocol and network type — but there are proven starting points. For WireGuard the recommended value is 1420, and over IPv6 it is lowered further because of larger headers.
| Scenario | Recommended MTU | Comment |
|---|---|---|
| WireGuard over IPv4 | 1420 | Default for most clients |
| WireGuard over IPv6 | 1400 | IPv6 headers are larger, needs more margin |
| OpenVPN (UDP) | 1400 | Drop to 1380 if you see dropouts |
| IKEv2/IPsec | 1400 | Usually negotiates MTU itself, but not always |
| Mobile / unstable Wi-Fi | 1360–1380 | Extra margin against aggressive filtering |
Start high and lower the value if fragmentation persists. Don't set the MTU deliberately very low either: overly small packets raise the share of overhead and slightly reduce effective speed.
Does fragmentation affect security and privacy?
Fragmentation by itself does not expose your traffic: the data stays encrypted whether it travels as a whole packet or as fragments. Encryption is applied before splitting, so an eavesdropper sees only a set of encrypted pieces, not your data. For the confidentiality of messages and passwords, fragmentation is no threat.
It does have an indirect effect on reliability, though. Lost and retransmitted fragments create instability that can briefly drop the connection — and if a kill switch isn't active at that moment, some traffic can leak onto the open network outside the tunnel. So a properly set MTU is about stability of protection, not just speed. LiMP VPN is a data-protection service for iOS and Android billed by a Russian entity (LiMP LLC): it encrypts traffic, keeps no connection logs and lets you pick protocols for different networks. See what it does on the features page, and pricing on the LiMP VPN plans page. This article is for reference; menu labels may differ by app version.
FAQ
What is VPN fragmentation in plain terms?
It's splitting a network packet into several smaller pieces when it exceeds the maximum size (MTU) a network can pass. A VPN adds encryption headers to every packet, increasing its size, so packets in the tunnel fragment more often than usual — leading to delays, loss and dropouts.
What MTU should I set to stop fragmentation?
Start with 1420 for WireGuard and 1400 for OpenVPN or IKEv2. If dropouts on heavy pages and downloads persist, go down to 1380 or 1360 — especially on mobile networks. The exact value can be found with a ping using the Don't Fragment flag, adding 28 bytes to the size that worked.
Does fragmentation make a VPN slower?
Yes, indirectly. When packets split and some fragments are lost, they must be retransmitted, latency rises and effective speed drops. The symptom is heavy pages and downloads hanging while ping stays normal. Lowering the MTU usually restores stable speed.
Is fragmentation dangerous for data security?
No, the traffic content stays encrypted whether it travels as a whole packet or as fragments, because encryption happens before splitting. The only indirect risk is connection instability: with frequent dropouts, a working kill switch matters, or traffic could leak outside the tunnel.
How do I find my MTU?
Send a ping with fragmentation disabled: on Windows — ping -f -l 1472 8.8.8.8, on Linux — ping -M do -s 1472 8.8.8.8. Lower the size until packets pass without an error, then add 28 bytes — that's your real MTU.