Question 1
Check your VPN MTU
Connect your normal work VPN or security software first. Then check the MTU of the route actually carrying your Internet traffic. This is the value that matters most when evaluating whether another VPN tunnel can be added underneath it.
Choose your operating system, copy/paste one command, then enter the MTU number it reports.
Advanced diagnostics: Public-endpoint path check
Automatic public-endpoint path check
checking availability…
Supplemental diagnostic. Our server sends ICMP probes to the public endpoint associated with this connection and finds the largest packet size confirmed across that external path. Behind a router, CGNAT, VPN, or exit node, the responder may be a gateway or VPN exit rather than your laptop. This does not measure your VPN interface, routed MTU, or inner tunnel MTU, and it does not determine compatibility by itself.
Confirmed external-path packet size
—
Supplemental public-endpoint result only; it may reflect a gateway or VPN exit, not your routed/VPN MTU.
Technical details
Advanced/manual MTU troubleshooting
For compatibility: enter the MTU of the route or VPN interface actually carrying your work traffic while your corporate VPN/security software is active. This verified local value drives the MTU compatibility assessment. Do not copy the public-endpoint result unless you independently verify both values are the same.
macOS: Copy/paste one command into Terminal:
route -n get 8.8.8.8
Look for interface and mtu. With VPN active, use route/interface carrying work traffic. For IPv6 traffic, also run route -n get -inet6 2606:4700:4700::1111.
Windows PowerShell: Find default route interface:
Get-NetRoute -DestinationPrefix '0.0.0.0/0' | Sort-Object RouteMetric | Select-Object -First 1 ifIndex
Then replace <ifIndex> with returned number:
Get-NetIPInterface -InterfaceIndex <ifIndex> | Select-Object InterfaceAlias,AddressFamily,NlMtu
Use MTU for VPN/tunnel interface carrying work traffic. For IPv6, use destination prefix '::/0' in first command.
Linux: Find route interface:
ip route get 8.8.8.8
Then inspect returned interface:
ip link show <interface>
Enter MTU for route/interface carrying work traffic. With VPN active, verify it is the VPN/tunnel route when applicable.
MTU is a tuning value, not a score. Lower values can improve compatibility on networks with extra encapsulation, while unnecessarily low values may reduce efficiency. The goal is to use the largest MTU that works reliably through the complete connection.
Note: Do not manually lower MTU unless necessary. Unusually low or stacked MTU overrides can cause compatibility issues and may expose an additional network characteristic.