# Wireguard MSS issue **URL:** \ **Category:** Pritunl VPN\ **Created:** [February 7, 2024, 11:39am UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803 "2024-02-07T11:39:37Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![fmalykh](https://forum.pritunl.com/user_avatar/forum.pritunl.com/fmalykh/32/252_2.png) [@fmalykh](https://forum.pritunl.com/u/fmalykh)\ **Post date:** [February 7, 2024, 11:39am UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/1 "2024-02-07T11:39:37Z")
Hi, Pritunl server: v1.32.3732.84 c5d79a | wireguard 1.0.20200513-1~18.04.2 Pritunl client: MacOS v1.3.3785.81 | wireguard-tools 1.0.20210914\_1 Problem: MSS fix doesn’t work for Wireguard connections resulting in random sites being inaccessible. Connection MTU: 1280 (setting a lower value results in `[winter-plains-2389] 2024-02-07 10:22:39 ERROR Management socket exception` error preventing server to start Client-side packet capture while connected with OpenVPN: ```auto No. Time Source Destination Protocol Length Total Length Version Info 1 0.000000 172.20.0.4 3.68.175.98 TCP 68 64 53425 → 443 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=64 TSval=1881480190 TSecr=0 SACK_PERM 2 0.070784 3.68.175.98 172.20.0.4 TCP 64 60 443 → 53425 [SYN, ACK] Seq=0 Ack=1 Win=32200 Len=0 MSS=1190 SACK_PERM TSval=4179559107 TSecr=1881480190 WS=4096 3 0.070968 172.20.0.4 3.68.175.98 TCP 56 52 53425 → 443 [ACK] Seq=1 Ack=1 Win=131904 Len=0 TSval=1881480261 TSecr=4179559107 4 0.073844 172.20.0.4 3.68.175.98 TLSv1.3 388 384 TLS 1.0 Client Hello (SNI=3.68.175.98) 5 0.142993 3.68.175.98 172.20.0.4 TCP 56 52 443 → 53425 [ACK] Seq=1 Ack=333 Win=32768 Len=0 TSval=4179559178 TSecr=1881480264 6 0.143120 3.68.175.98 172.20.0.4 TLSv1.3 1234 1230 TLS 1.2,TLS 1.2 Server Hello, Change Cipher Spec 7 0.143278 172.20.0.4 3.68.175.98 TCP 56 52 53425 → 443 [ACK] Seq=333 Ack=1179 Win=130752 Len=0 TSval=1881480333 TSecr=4179559179 8 0.150327 3.68.175.98 172.20.0.4 TCP 1234 1230 443 → 53425 [PSH, ACK] Seq=1179 Ack=333 Win=32768 Len=1178 TSval=4179559179 TSecr=1881480264 [TCP segment of a reassembled PDU] 9 0.150564 3.68.175.98 172.20.0.4 TCP 1234 1230 443 → 53425 [ACK] Seq=2357 Ack=333 Win=32768 Len=1178 TSval=4179559179 TSecr=1881480264 [TCP segment of a reassembled PDU] 10 0.150624 3.68.175.98 172.20.0.4 TLSv1.3 972 968 TLS 1.2 Application Data ``` Client-side packet capture while connected with Wireguard: ```auto No. Time Source Destination Protocol Length Total Length Version Info 94 70.808145 172.20.24.4 3.68.175.98 TCP 68 64 53465 → 443 [SYN] Seq=0 Win=65535 Len=0 MSS=1380 WS=64 TSval=2192964412 TSecr=0 SACK_PERM 95 70.849315 3.68.175.98 172.20.24.4 TCP 64 60 443 → 53465 [SYN, ACK] Seq=0 Ack=1 Win=32200 Len=0 MSS=1300 SACK_PERM TSval=468270415 TSecr=2192964412 WS=4096 96 70.849405 172.20.24.4 3.68.175.98 TCP 56 52 53465 → 443 [ACK] Seq=1 Ack=1 Win=131328 Len=0 TSval=2192964454 TSecr=468270415 97 70.853667 172.20.24.4 3.68.175.98 TLSv1 388 384 TLS 1.0 Client Hello (SNI=3.68.175.98) 98 70.913961 3.68.175.98 172.20.24.4 TCP 56 52 443 → 53465 [ACK] Seq=1 Ack=333 Win=32768 Len=0 TSval=468270459 TSecr=2192964457 99 70.985517 3.68.175.98 172.20.24.4 SSL 642 638 [TCP Previous segment not captured] , Continuation Data 100 70.985697 172.20.24.4 3.68.175.98 TCP 68 64 [TCP Dup ACK 96#1] 53465 → 443 [ACK] Seq=333 Ack=1 Win=131328 Len=0 TSval=2192964590 TSecr=468270459 SLE=3865 SRE=4451 253 73.324809 172.20.24.4 3.68.175.98 TCP 44 40 53465 → 443 [RST, ACK] Seq=333 Ack=1 Win=131328 Len=0 ``` ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [February 8, 2024, 10:06am UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/2 "2024-02-08T10:06:51Z")
If the option in the server settings is labeled MSS Fix that is an older release that does not support setting the WireGuard MTU. This should work in newer releases. Run `sudo ip a` and check the MTU of the WireGuard adapters on the server. ---
**Author:** ![fmalykh](https://forum.pritunl.com/user_avatar/forum.pritunl.com/fmalykh/32/252_2.png) [@fmalykh](https://forum.pritunl.com/u/fmalykh)\ **Post date:** [February 8, 2024, 10:23am UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/3 "2024-02-08T10:23:08Z")
It is `Connection MTU` ![image](https://forum-static.pritunl.com/original/1X/e27e7726f135d80351c92ec096250feac16d1798.png) ```auto wg25: flags=209 mtu 1280 inet 172.20.24.1 netmask 255.255.252.0 destination 172.20.24.1 ``` ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [February 8, 2024, 10:11pm UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/4 "2024-02-08T22:11:39Z")
I have fixed this issue it will be included in the next Pritunl and Pritunl Client update. Currently the MTU is only be set on the server interface. Running `sudo networksetup -setMTU ` can be run on the client to set the MTU on the client side. ---
**Author:** ![fmalykh](https://forum.pritunl.com/user_avatar/forum.pritunl.com/fmalykh/32/252_2.png) [@fmalykh](https://forum.pritunl.com/u/fmalykh)\ **Post date:** [February 12, 2024, 12:30pm UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/5 "2024-02-12T12:30:10Z")
Hi, Is it fixed in `v1.32.3805.31` ? Would be nice to have a more detailed release notes section in github 🙂 ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [February 12, 2024, 8:40pm UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/6 "2024-02-12T20:40:22Z")
The server update only includes the MTU in the WireGuard connection data, the client update that isn’t released yet will be needed to apply the MTU. ---
**Author:** ![fmalykh](https://forum.pritunl.com/user_avatar/forum.pritunl.com/fmalykh/32/252_2.png) [@fmalykh](https://forum.pritunl.com/u/fmalykh)\ **Post date:** [February 16, 2024, 8:24am UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/7 "2024-02-16T08:24:19Z")
Why is the client update required if MSS fix is applied on a transit network device (VPN) ? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [February 16, 2024, 5:27pm UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/8 "2024-02-16T17:27:18Z")
It needs to be sent to the client by the server and then configured on the client. The client should automatically detect the lower MTU but it appears it also needs to be configured on the client. ---
**Author:** ![fmalykh](https://forum.pritunl.com/user_avatar/forum.pritunl.com/fmalykh/32/252_2.png) [@fmalykh](https://forum.pritunl.com/u/fmalykh)\ **Post date:** [February 19, 2024, 9:36am UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/9 "2024-02-19T09:36:28Z")
I’m still unclear about the explanation, MTU is a different thing. MSS is negotiated between client and server at a lowest value during TCP handshake. Pritunl being an intermediate device in the network flow will need to override MSS in the TCP SYN packet and server will either honour it or provide even a lower value. ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [February 20, 2024, 3:58am UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/10 "2024-02-20T03:58:27Z")
Once the MTU is configured on the client, the MSS will be correctly calculated. ---
**Author:** ![fmalykh](https://forum.pritunl.com/user_avatar/forum.pritunl.com/fmalykh/32/252_2.png) [@fmalykh](https://forum.pritunl.com/u/fmalykh)\ **Post date:** [April 24, 2024, 6:10am UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/11 "2024-04-24T06:10:14Z")
Hi, has this been fixed? ---
**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\ **Post date:** [April 25, 2024, 7:56pm UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/12 "2024-04-25T19:56:22Z")
This is fixed in the newer client and server releases. ---
**Author:** ![fmalykh](https://forum.pritunl.com/user_avatar/forum.pritunl.com/fmalykh/32/252_2.png) [@fmalykh](https://forum.pritunl.com/u/fmalykh)\ **Post date:** [April 26, 2024, 4:38am UTC](https://forum.pritunl.com/t/wireguard-mss-issue/1803/13 "2024-04-26T04:38:26Z")
Which versions of client and server releases should I use?