Unable to set tun-mtu with openvpn2

[BerriJ]

Hi,
I followed this help page of the openvpn2 command and discovered that I can set --tun-mtu 1360. I tried that and the client did not complain about the argument, but the tun0 device is created using the default mtu of 1500.
I've also found this issue: https://codeberg.org/OpenVPN/openvpn3-linux/issues/92 this is likely what I'm running into, but it was closed a couple of month ago, stating that this is a problem with the core library. Thats why I opened this issue here.

Is this expected behavior?

Thanks and kind regards,
BerriJ

[schwabe]

Please include a full log at verb 3 or verb 4. Probably the server pushes a tun-mtu to have the same MTU on both sides. (Mismatched MTU is often problematic.

[BerriJ]

Thanks for your answer, you are right, the server pushes an MTU option: 16 [tun-mtu] [1500].

However, connected to one particular network I had problems where ssh and tls connections could not be initialized and I was only able to solve that by lowering the mtu of my tun0 device to 1360. I did that imperatively using sudo ip link set dev tun0 mtu 1360 and since that worked I thought I'd integrate that into my openvpn2 command invocation.

❯ openvpn2 --config ~/vpn.ovpn --tun-mtu 1360 --verb 6
Credentials needed
Auth User name: jonathan.berrisch
Auth Password:
Press CTRL-C to stop the connection

2026-07-21 21:50:28.028012 [LOG] Session Manager change: DCO enabled
2026-07-21 21:50:28.028041 [LOG] Network configuration cleanup requested
2026-07-21 21:50:28.028056 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CFG_OK) config_path=/net/openvpn/v3/configuration/e53bb498x3cc2x4907xa473x5dee7d2ca5e0
2026-07-21 21:50:28.028070 [LOG] Starting connection
2026-07-21 21:50:28.028079 [LOG] Username/password provided successfully for 'jonathan.berrisch'
2026-07-21 21:50:28.028087 [LOG] Using DNS resolver scope: global
2026-07-21 21:50:28.028094 [LOG] [Connect] DCO flag: enabled
2026-07-21 21:50:28.028103 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTING)
2026-07-21 21:50:28.028114 [LOG] [Core] OpenVPN core 3.11.7 linux x86_64 64-bit OVPN-DCO
2026-07-21 21:50:28.028122 [LOG] [Core] Frame=512/2112/512 control-channel-payload=1170
2026-07-21 21:50:28.029928 [LOG] Resolving
2026-07-21 21:50:28.030969 [LOG] [Core] Contacting [2001:638:501:4ff0::4]:443 via UDP
2026-07-21 21:50:28.030994 [LOG] Waiting for server response
2026-07-21 21:50:28.032262 [LOG] [Core] Connecting to [portal.wiwi.uni-due.de]:443 (2001:638:501:4ff0::4) via UDP
2026-07-21 21:50:28.047249 [LOG] Connecting
2026-07-21 21:50:28.047284 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTING)
2026-07-21 21:50:28.047612 [LOG] [Core] Tunnel Options:V4,dev-type tun,link-mtu 1413,tun-mtu 1360,proto UDPv4,cipher BF-CBC,auth SHA256,keysize 128,key-method 2,tls-client
2026-07-21 21:50:28.047648 [LOG] [Core] Creds: Username/Password
2026-07-21 21:50:28.048063 [LOG] [Core] Sending Peer Info:
                                 IV_VER=3.11.7
                                 IV_PLAT=linux
                                 IV_NCP=2
                                 IV_TCPNL=1
                                 IV_PROTO=8094
                                 IV_MTU=1600
                                 IV_CIPHERS=AES-128-GCM:AES-192-GCM:AES-256-GCM:CHACHA20-POLY1305
                                 IV_GUI_VER=openvpn3-linux/v27.1
                                 IV_SSO=openurl,webauth,crtext
                                 IV_BS64DL=1
2026-07-21 21:50:28.078134 [LOG] [Core] SSL Handshake: peer certificate: CN=portal.wiwi.uni-due.de, 2048 bit RSA, cipher: TLS_CHACHA20_POLY1305_SHA256   TLSv1.3 Kx=any      Au=any   Enc=CHACHA20/POLY1305(256) Mac=AEAD
2026-07-21 21:50:28.078534 [LOG] [Core] Session is ACTIVE
2026-07-21 21:50:28.078544 [LOG] Retrieving configuration from server
2026-07-21 21:50:28.078973 [LOG] [Core] Sending PUSH_REQUEST to server...
2026-07-21 21:50:29.078656 [LOG] [Core] Sending PUSH_REQUEST to server...
2026-07-21 21:50:29.190552 [LOG] [Core] OPTIONS:
                                 0 [route] [remote_host] [255.255.255.255] [net_gateway]
                                 1 [route-gateway] [10.254.254.97]
                                 2 [sndbuf] [0]
                                 3 [rcvbuf] [0]
                                 4 [ping] [25]
                                 5 [ping-restart] [100]
                                 6 [redirect-gateway] [def1]
                                 7 [topology] [subnet]
                                 8 [route] [remote_host] [255.255.255.255] [net_gateway]
                                 9 [inactive] [3600] [30720]
                                 10 [dhcp-option] [DNS] [10.254.254.1]
                                 11 [dhcp-option] [DOMAIN] [wiwinf.uni-due.de]
                                 12 [ifconfig] [10.254.254.98] [255.255.255.0]
                                 13 [peer-id] [0]
                                 14 [cipher] [AES-256-GCM]
                                 15 [protocol-flags] [cc-exit] [tls-ekm]
                                 16 [tun-mtu] [1500]
2026-07-21 21:50:29.190607 [LOG] [Core] PROTOCOL OPTIONS:
                                   key-derivation: TLS Keying Material Exporter [RFC5705]
                                   data channel: cipher AES-256-GCM, peer-id 0
2026-07-21 21:50:29.190793 [LOG] tun_builder_teardown, no device available
2026-07-21 21:50:29.192859 [LOG] Virtual interface created at /net/openvpn/v3/netcfg/6389_ce4e25d8taf3et473ct962ctf1aec9d6a033
2026-07-21 21:50:29.193773 [LOG] [Core] exception parsing IPv4 route: [route] [remote_host] [255.255.255.255] [net_gateway] : addr_pair_mask_parse_error: AddrMaskPair parse error 'route': remote_host/255.255.255.255 : ip_exception: error parsing route IP address 'remote_host' : Invalid argument
2026-07-21 21:50:29.193821 [LOG] [Core] exception parsing IPv4 route: [route] [remote_host] [255.255.255.255] [net_gateway] : addr_pair_mask_parse_error: AddrMaskPair parse error 'route': remote_host/255.255.255.255 : ip_exception: error parsing route IP address 'remote_host' : Invalid argument
2026-07-21 21:50:29.195591 [LOG] Session name: 'portal.wiwi.uni-due.de'
2026-07-21 21:50:29.197097 [LOG] [Core] Connected via tun
2026-07-21 21:50:29.197366 [LOG] [Core] fixed mssfix=1320
2026-07-21 21:50:29.197401 [LOG] Connected: jonathan.berrisch@portal.wiwi.uni-due.de:443 (2001:638:501:4ff0::4) via /UDP on tun/10.254.254.98/ gw=[10.254.254.97/] mtu=1500
2026-07-21 21:50:29.197419 [STATUS] (StatusMajor.CONNECTION, StatusMinor.CONN_CONNECTED)

[cron2]

For TCP connections inside the tunnel, have a look at --mssfix 1360 mtu.

(With OpenVPN 2.x you could also use a pull-filter ignore mtu to ignore whatever the server pushes, but as @schwabe said, this might have problematic side effects - so --mssfix will do the right thing here, and ensure that TCP packets inside the tunnel are small enough. Caveat: does not work with Linux DCO as of today. @ordex is working on fixing that - until then, --disable-dco --mssfix 1360 mtu...)