What MTU Is Safe Across a NAS, VPN, and Mixed Home Network?

Eva Wong

IceWhale author

Eva Wong is the Technical Writer and resident tinkerer at ZimaSpace. A lifelong geek with a passion for homelabs and open-source software, she specializes in translating complex technical concepts into accessible, hands-on guides. Eva believes that self-hosting should be fun, not intimidating. Through her tutorials, she empowers the community to demystify hardware setups, from building their first NAS to mastering Docker containers.

What MTU Is Safe Across a NAS, VPN, and Mixed Home Network?

Use MTU 1500 on a mixed Ethernet and Wi-Fi home LAN unless every device on an isolated storage path supports the same larger value. For WireGuard over a normal 1500-byte underlay, 1420 is a common safe tunnel starting point, but PPPoE or nested tunnels may require less.

The safe value is limited by the smallest path after encapsulation. Jumbo frames on only the NAS and one computer do not help if a switch, router, VPN, Wi-Fi bridge, or remote ISP path cannot carry them. This distinction sets the measurement method, safety margin, and stop condition. This distinction sets the measurement method, safety margin, and stop condition. This distinction sets the measurement method, safety margin, and stop condition.

Separate LAN MTU from tunnel MTU

Keep ordinary clients, smart devices, and Wi-Fi on 1500 unless the network is deliberately segmented. Configure the VPN interface lower so its encrypted outer packet still fits the underlay.

WireGuard overhead varies with outer IPv4 or IPv6; other VPNs add different headers. PPPoE commonly reduces the WAN path, and nested tunnels reduce payload further.

Jumbo MTU such as 9000 is suitable only on a verified end-to-end storage segment. It is not a universal speed switch and will not increase a 1GbE link’s line rate.

Test the path without fragmentation

Use do-not-fragment pings with descending payload sizes from each relevant client to the NAS and VPN endpoint. Account for IP and ICMP headers when converting payload size to path MTU.

Then test SMB directory listing, large transfer, small-file copy, and remote access through the tunnel. MTU faults often appear as stalls or one-way failures rather than a clean disconnect.

Use the table below to choose the baseline.

Observed state	Verdict	Next action
Mixed LAN and Wi-Fi	1500 LAN MTU	Safest baseline
WireGuard over 1500 underlay	1420 starting tunnel MTU	Verify actual path
Isolated all-jumbo storage path	9000 may be valid	Require end-to-end support

Make the smallest path explicit

Set the VPN MTU on both ends consistently and use TCP MSS clamping only where appropriate. Avoid masking a broken path with random values copied from another protocol.

Document every interface allowed to use jumbo frames and keep routing between jumbo and mixed segments controlled. Recheck after changing an ISP, router, VPN protocol, or VLAN path.

ZimaSpace’s NAS network workload test keeps link changes tied to measured traffic.

Mayak Networks’ WireGuard MTU analysis explains why 1420 is a starting point rather than a universal answer.

Featured

ZimaCube 2 Personal Cloud Home NAS

ZimaCube2

Retest every transport that users depend on

Run the same tests on wired LAN, Wi-Fi, local VPN, and remote mobile or ISP paths. Confirm packets, SMB transfers, and interactive sessions remain stable.

Monitor retransmissions and tunnel errors during a sustained copy. A successful ping alone does not validate application traffic, offload behavior, or both packet directions.

Keep LAN MTU 1500 and a conservative tunnel value when the path is mixed or unknown. Use jumbo frames only after end-to-end proof; stop increasing MTU if any path requires fragmentation or develops intermittent stalls.