MTU settings for wireguard through mobile connection

[FredFresh]

My setup has an lte modem - opnsense - wireguard connections (road warrior settings, more or less)

The opnsense guide tells you to lower the MTU value from 1500 to 1420 in the wireguard peer configuration (because of headers).

An official guide on openwrt tells me that the mobile connections ALSO have 80 bytes of headers.

If my assumption is correct I should:

set the MTU of wireguard instances to 1500-80-80 = 1340
set the MTU of the WAN interface to 1500-80 = 1420 (under "interfaces/overview/wan interface")
leave the lte modem to 1500

Some expert can kindly confirm if this is correct or wrong?

[userfw]

I'm not an expert, but I've used 1380 for the past few years and I can easily fill my 4G connection bandwidth (100 Mbps).

[FredFresh]

Where you used that mtu value? I am capable to get also 180 Mbps, but I'd prefer to have a slower connection bit more stable.

Only today I found that there is an mtu setting also inside the interface setup page.

[OPNenthu]

Also not an expert but I am a WG user and this is what works for me.

I think everything hinges on what your WAN MTU is, as that is the basis for WG MTU and MSS clamping.  If your modem wants MTU 1500 then you don't need to touch MTU settings anywhere (in theory) as the defaults are already 1500 for WAN and 1420 (= 1500 - 80) for WG instances.  I suspect that's where the 80 bytes for the "mobile connections" comes from; they are probably referring to the road warrior peers.

The thing you need to set is MSS clamping for TCP traffic.  You can do it in the interface settings if you are using separate "wgX" interfaces, but for the default "WireGuard (group)" you should use a Normalization rule as per https://docs.opnsense.org/manual/how-tos/wireguard-client.html#step-5a-create-normalization-rules.  1360 is a safe default MSS value that covers both IPv4 and IPv6.

If you instead set the MSS value in the "wgX" interface settings then use 1420 there.  As the helptext explains, it automatically deducts 40 for IPv4 and 60 for IPv6.  I think you may not need to even set it manually in that case because the interface should inherit the correct value already from the WG instance.

If I'm wrong about something then I hope to be corrected and learn something new as well.