Well I believe the issue is that 1420 is not the best MTU to use at
least when you control all the peers. OpenBSD pads[^1] the plaintext so
that its length is a multiple of 16 per the spec. Since ChaCha20 is a
stream cipher, the ciphertext length will be the same. In my case the
MTU of the physical connection is 1500 and IPv6 is used to establish the
tunnel, so this give an MTU of 1408 due to the following equation:
M = P + IP header + UDP header + WireGuard message header + Poly1305 tag
1500 = P + 40 + 8 + 16 + 16 = P + 40 + 40 = P + 80
where M is the MTU of the physical connection and P is the length of the
ciphertext.
This then gives:
P = max{16q | 16q <= 1420} = 1408.
Apparently there are some WireGuard implementations that don't perform
this padding, and 1420 is the common default. In summary if you control
all the peers and you know the underlying WireGuard implementation
correctly pads the plaintext to have length that is a multiple of 16,
then you may want to reduce the MTU to 1408. If you use IPv4 to
establish the tunnel and 1500 is the MTU of the physical connection,
then the above equation gives an MTU of 1440.
[^1]: https://github.com/openbsd/src/blob/master/sys/net/if_wg.c#L1594
