Fix Overlay Tunnel Fragmentation – Step-by-Step Guide

Quick Answer

Set the tunnel interface MTU to 1476 bytes (or lower if you have extra headers like IPSec). Then enable ICMP type 3 code 4 on all intermediate routers. That's it.

Why This Happens

Your overlay network (GRE, VXLAN, or VPN) wraps packets inside another packet. The outer header adds at least 24 bytes for GRE, 50+ for IPSec, or 50 for VXLAN. Your physical network still expects 1500-byte frames. When a 1500-byte inner packet hits the tunnel, it becomes 1524+ bytes – too big for the wire. The router fragments it, then the receiver has to reassemble. This kills performance. You see the error because the system detected a fragment crossing the tunnel. Real-world trigger: you copy a 64KB file over the VPN and it takes 3x longer than expected. That's fragmentation in action.

The real fix is to stop fragmentation before it starts. You do this by lowering the Maximum Transmission Unit (MTU) on the tunnel interface. The endpoint then chops packets at the source, not in the middle of the network.

Step-by-Step Fix

Find the tunnel interface MTU.
On Linux:
```
ip link show tun0
```
Look for mtu 1500. On Cisco:
```
show interface tunnel 1
```
It says MTU 1476 or similar. If it's 1500, that's wrong.
Calculate correct MTU.
Take your physical interface MTU (usually 1500). Subtract the overlay header size:
- GRE: 24 bytes (20 IP + 4 GRE)
- GRE + IPSec: 24 + 50-60 bytes
- VXLAN: 50 bytes (20 IP + 8 UDP + 8 VXLAN)
So GRE tunnel MTU = 1500 - 24 = 1476. VXLAN = 1500 - 50 = 1450.
Set the tunnel MTU.
Linux:
```
ip link set dev tun0 mtu 1476
```
For persistent change, edit /etc/network/interfaces or use netplan. On Cisco:
```
interface tunnel 1
ip mtu 1476
```
On Windows (if using VPN adapter):
```
netsh interface ipv4 set subinterface "Your VPN" mtu=1476 store=persistent
```
Enable ICMP unreachables on intermediate routers.
Set
```
ip unreachables
```
on all interfaces that carry the tunnel traffic. This lets Path MTU Discovery (PMTUD) work. Without it, the sender never learns the correct MTU – and you get more fragments.
Test.
Ping with don't fragment flag and different sizes. On Linux or Mac:
```
ping -M do -s 1472 10.0.0.1
```
(1472 payload + 28 IP/ICMP = 1500). If it fails, lower MTU by 8 until it passes. On Windows:
```
ping -f -l 1472 10.0.0.1
```

Alternative Fixes

MSS clamping. If you can't change the tunnel MTU (cloud provider restriction), clamp the TCP Maximum Segment Size at the firewall. On Linux iptables:

iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1436

This forces TCP to send smaller segments. It works for TCP traffic only. UDP and ICMP still fragment.

Jumbo frames. If your whole network supports jumbo frames (8992 bytes or more), set physical MTU to 9000 on all switches and routers. Then your tunnel MTU can be 8976. This avoids fragmentation but requires full infrastructure upgrade. Most offices don't have it.

Disable PMTUD on the tunnel (bad idea, but works in a pinch). Set

echo 1 > /proc/sys/net/ipv4/conf/tun0/disable_pmtu_discovery

This stops ICMP errors. Fragmentation still happens, but the sender doesn't know. Performance suffers quietly.

Prevention Tip

Plan your MTU from the start. On any tunnel, set MTU to 1476 for GRE, 1436 for GRE+IPSec, or 1450 for VXLAN. Then set ICMP unreachables on every router in the path. Test with ping -M do -s 1472 before you deploy. This takes 10 minutes and stops fragmentation for good.