I can ping through the tunnel, but any real work causes it to lock up. Is this an MTU problem?

Probably. It's best to change the mssfix parameter rather than directly changing the MTU of the TUN/TAP adapter. For example:

mssfix 1200

You could also combine this with:

fragment 1200

Note however that fragment will exact a performance penalty.

Common values to try for mssfix/fragment: 1200, 1300, or 1400.

Note that while mssfix only needs to be specified on one side of the connection, fragment should be specified on both.

Return to FAQ