Matti Andreas Kähäri <[email protected]> writes: > Just a tiny data point: Setting the MTU to osmething slightly lower than > 1280, for example 1200, on the tun0 interface in NetBSD seems to avoid > the issue. I don't really see this as a "solution". It's a work-around.
That's hugely helpful in figuring things out. Basically, fragmentation is bad and setups should avoid it. Packets send on tun0 will be encapsulated with wireguard headers, and then they will traverse the network, which could have further tunneling. In theory whenever a packet is processed and the output doesn't fit then the input should get an ICMP fragmentation required message (speaking very loosely; read the RFCS!) and then send smaller packets. But often this does not work, buggy code, firewalls that block ICMP. You'll need to trace the packets and follow sizes across the entire path, and that may let you understand where the problem is.
