FreeBSD 14 – WireGuard Tunnel Flaps Under Load – MTU and Keepalive Tuning

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

VPN sessions flap and packet loss rises, breaking private service connectivity.

Environment & Reproduction

Typically seen with path MTU mismatch or NAT idle timeout on peers.

wg show
ifconfig wg0

Root Cause Analysis

Tunnel keepalive/MTU values do not align with transit network characteristics.

Quick Triage

Check peer handshake age and packet counters for reset patterns.

wg show all latest-handshakes
wg show all transfer

Step-by-Step Diagnosis

Validate route symmetry, MTU path, and firewall/NAT state timeouts.

ping -D -s 1372 
tcpdump -ni  udp port 51820 -c 100

Solution – Primary Fix

Set conservative MTU and persistent keepalive, then reload tunnel config.

wg set wg0 peer  persistent-keepalive 25
ifconfig wg0 mtu 1420
service wireguard restart

Solution – Alternative Approaches

Move VPN endpoint behind stable static NAT or dedicated tunnel appliance.

Verification & Acceptance Criteria

Handshake remains fresh and packet loss remains within expected thresholds.

watch -n 5 wg show

Rollback Plan

Revert to previous wg config if changed MTU causes throughput regression.

Prevention & Hardening

Document tunnel baseline values and monitor handshake age continuously.

Related Errors & Cross-Refs

handshake timeout, no route to host over tunnel, intermittent packet loss.

Related tutorial: View the step-by-step tutorial for freebsd-14.

View all freebsd-14 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

WireGuard on FreeBSD and network MTU tuning references.