Skip to content

Commit f1cf963

Browse files
ranbelranbel
authored
[ZT] WARP PMTUD (#26296)
* new PMTUD page * add minimum warp version * update parameter reference * update system requirements * add warp_tunnel_protocol * how to check PMTU * update recommended MTUs * edit wording
1 parent 8126286 commit f1cf963

File tree

5 files changed

+149
-7
lines changed

5 files changed

+149
-7
lines changed

‎src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/parameters.mdx‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,17 @@ Identifies a Zero Trust organization in the WARP GUI when WARP is deployed with
101101

102102
**Value:** Organization nickname shown to users in the WARP GUI (for example, `Test environment`).
103103

104+
### `enable_pmtud`
105+
106+
[Path MTU Discovery (PMTUD)](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/path-mtu-discovery/) allows WARP to discover the largest packet size that can be sent over the current network and optimize connection performance.
107+
108+
**Value Type:** `boolean`
109+
110+
**Value:**
111+
112+
* `false` — (default) Disables PMTUD.
113+
* `true` — Enables PMTUD on the WARP tunnel interface.
114+
104115
### `enable_post_quantum`
105116

106117
<Details header="Feature availability">
@@ -120,7 +131,7 @@ Identifies a Zero Trust organization in the WARP GUI when WARP is deployed with
120131

121132
</Details>
122133

123-
WARP uses [post-quantum cryptography](/ssl/post-quantum-cryptography/) to secure connections from the device to Cloudflare's network. Post-quantum cryptography requires the [MASQUE protocol](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#device-tunnel-protocol) and is enabled by default on all devices using MASQUE.
134+
WARP uses [post-quantum cryptography](/ssl/post-quantum-cryptography/) to secure connections from the device to Cloudflare's network. Post-quantum cryptography requires the [MASQUE protocol](#warp_tunnel_protocol) and is enabled by default on all devices using MASQUE.
124135

125136
**Value Type:** `boolean`
126137

@@ -245,6 +256,17 @@ Assigns a unique identifier to the device for the [device UUID posture check](/c
245256

246257
**Value:** UUID for the device (for example, `496c6124-db89-4735-bc4e-7f759109a6f1`).
247258

259+
### `warp_tunnel_protocol`
260+
261+
Configures the protocol used to route IP traffic from the device to Cloudflare Gateway. For more information, refer to [Device tunnel protocol](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#device-tunnel-protocol).
262+
263+
**Value Type:** `string`
264+
265+
**Value:**
266+
267+
* `masque` — (default) [MASQUE](https://datatracker.ietf.org/wg/masque/about/) protocol
268+
* `wireguard` — [WireGuard](https://www.wireguard.com/) protocol
269+
248270
## Top-level parameters
249271

250272
Top-level parameters determine how WARP manages device registrations.

‎src/content/docs/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/path-mtu-discovery.mdx‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
---
2+
pcx_content_type: concept
3+
title: Path MTU Discovery (PMTUD)
4+
sidebar:
5+
order: 5
6+
label: Path MTU Discovery
7+
---
8+
9+
import { Details, Render } from "~/components";
10+
11+
<Details header="Feature availability">
12+
13+
| [WARP modes](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-modes/) | [Zero Trust plans](https://www.cloudflare.com/teams-pricing/) |
14+
| --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
15+
| <ul><li> Gateway with WARP</li><li> Secure Web Gateway without DNS filtering </li></ul> | All plans |
16+
17+
| System | Availability | Minimum WARP version |
18+
| -------- | ------------ | -------------------- |
19+
| Windows | ✅ | 2025.9.173.1 |
20+
| macOS | ✅ | 2025.9.173.1 |
21+
| Linux | ✅ | 2025.9.173.1 |
22+
| iOS | ❌ | |
23+
| Android | ❌ | |
24+
| ChromeOS | ❌ | |
25+
26+
</Details>
27+
28+
The [Maximum Transmission Unit (MTU)](https://www.cloudflare.com/learning/network-layer/what-is-mtu/) is the largest data packet size that a device can send over a network without fragmentation. When you connect to services through WARP, your data is encapsulated, which adds extra headers and increases the overall packet size. On some networks, especially cellular or guest Wi-Fi networks, the network's MTU may be smaller than WARP's [default packet size](#recommended-mtu). This mismatch forces packets to be fragmented or dropped entirely, leading to connection instability or complete connection failures.
29+
30+
WARP's Path MTU Discovery (PMTUD) feature solves this problem by actively probing for the minimum MTU along the entire network path between the device and Cloudflare. WARP will then dynamically adjust its [tunnel interface](/cloudflare-one/team-and-resources/devices/warp/configure-warp/route-traffic/warp-architecture/#virtual-interface) MTU based on the probe results. This allows WARP to maintain a stable connection on low MTU networks and take advantage of higher MTUs when available.
31+
32+
:::note
33+
Certain features may be disabled or degraded at low MTU thresholds. For details, refer to [Minimum MTUs](#minimum-mtus).
34+
:::
35+
36+
## Prerequisites
37+
38+
- WARP must be configured to use the [MASQUE tunnel protocol](/cloudflare-one/team-and-resources/devices/warp/configure-warp/warp-settings/#device-tunnel-protocol).
39+
40+
## Enable Path MTU Discovery
41+
42+
To enable Path MTU Discovery on your devices, [deploy an MDM file](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/#windows) with the `enable_pmtud` key set to `true`. For example:
43+
44+
```xml
45+
<dict>
46+
<key>organization</key>
47+
<string>your-team-name</string>
48+
<key>warp_tunnel_protocol</key>
49+
<string>masque</string>
50+
<key>enable_pmtud</key>
51+
<true/>
52+
</dict>
53+
```
54+
55+
This configuration enables the PMTUD feature and explicitly configures the MASQUE tunnel protocol.
56+
57+
WARP will now send active probes to detect the network path MTU and will update its tunnel interface MTU accordingly. You can expect PMTUD probes to generate an extra 25 Mb/day of traffic coming from the device.
58+
59+
## Minimum MTUs
60+
61+
### Recommended MTU
62+
63+
WARP requires the following MTUs for full functionality and performance:
64+
65+
| Device tunnel protocol| IPv4 | IPv6 |
66+
| --- | --- | --- |
67+
| WireGuard | 1340 bytes | 1360 bytes |
68+
| MASQUE | 1361 bytes | 1381 bytes |
69+
70+
### Path MTU Discovery
71+
72+
For the PMTUD feature to work, the network path must support an MTU of at least 1281 bytes. The 1281 bytes consists of:
73+
74+
- 1200 bytes: Minimum QUIC datagram
75+
- 53 bytes: WARP MASQUE encapsulation
76+
- 28 bytes: WARP PMTUD probe
77+
78+
### IPv6
79+
80+
To send IPv6 traffic through WARP, the network path must support an MTU of at least 1333 bytes. The 1333 bytes consists of:
81+
82+
- 1280 bytes: Minimum IPv6 packet size
83+
- 53 bytes: WARP MASQUE encapsulation
84+
85+
If PMTUD is enabled and the MTU is less than 1333 bytes, then WARP will automatically disable IPv6 on the tunnel interface.
86+
87+
### WebRTC
88+
89+
To send WebRTC traffic through WARP, the network path must support an MTU of at least 1333 bytes. Below 1333 bytes, WebRTC connections will experience progressively degraded performance. This minimum MTU impacts [Cloudflare Browser Isolation](/cloudflare-one/remote-browser-isolation/) and any other website that uses WebRTC (such as video conferencing and media streaming services).
90+
91+
## Check your MTU
92+
93+
You can check your current network path MTU by collecting [WARP diagnostic logs](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/).
94+
95+
1. Run the `warp-diag` command on the device or [collect logs via the the dashboard](/cloudflare-one/team-and-resources/devices/warp/troubleshooting/warp-logs/#collect-logs-via-the-dashboard).
96+
2. Open the resulting `warp-debugging-info-<date>-<time>.zip` file.
97+
3. Open `connectivity.txt` and search for `PMTU`.
98+
99+
```txt title="connectivity.txt" {16-17}
100+
====================================================================
101+
H3 Quic Connect
102+
====================================================================
103+
104+
Testing H3 QUIC connectivity to 'https://cloudflare-quic.com/cdn-cgi/l4-stats' result: Successful
105+
IPv4:
106+
"
107+
Headers:
108+
server address=104.18.26.14:443
109+
...
110+
111+
Body:
112+
transport=TCP
113+
...
114+
115+
PMTU:
116+
1500 bytes
117+
"
118+
```
119+
120+
The example above shows an MTU of 1500 bytes, which meets the [recommended MTU requirements](#recommended-mtu) for WARP. If your MTU falls below the recommended threshold, consider [enabling Path MTU Discovery](#enable-path-mtu-discovery) to optimize connection performance.

‎src/content/partials/cloudflare-one/warp/system-requirements/linux.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,6 @@
1010
| **HD space** | 75 MB |
1111
| **Memory** | 35 MB |
1212
| **Network interface type** | WIFI or LAN |
13-
| **Minimum MTU** | 1360 bytes[^1] |
13+
| **MTU** | 1381 bytes recommended [^1] |
1414

15-
[^1]: WireGuard requires 1360 bytes for IPv6 and 1340 bytes for IPv4. MASQUE requires 1350 bytes for IPv6 and 1330 bytes for IPv4.
15+
[^1]: Minimum 1281 bytes with [Path MTU Discovery](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/path-mtu-discovery/)

‎src/content/partials/cloudflare-one/warp/system-requirements/macOS.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,6 @@
1010
| **HD space** | 75 MB |
1111
| **Memory** | 35 MB |
1212
| **Network interface type** | WIFI or LAN |
13-
| **Minimum MTU** | 1360 bytes[^1]|
13+
| **MTU** | 1381 bytes recommended [^1] |
1414

15-
[^1]: WireGuard requires 1360 bytes for IPv6 and 1340 bytes for IPv4. MASQUE requires 1350 bytes for IPv6 and 1330 bytes for IPv4.
15+
[^1]: Minimum 1281 bytes with [Path MTU Discovery](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/path-mtu-discovery/)

‎src/content/partials/cloudflare-one/warp/system-requirements/windows.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@
1111
| **HD space** | 184 MB |
1212
| **Memory** | 3 MB |
1313
| **Network interface type** | WIFI or LAN |
14-
| **Minimum MTU** | 1360 bytes[^1]|
14+
| **MTU** | 1381 bytes recommended [^1] |
1515

16-
[^1]: WireGuard requires 1360 bytes for IPv6 and 1340 bytes for IPv4. MASQUE requires 1350 bytes for IPv6 and 1330 bytes for IPv4.
16+
[^1]: Minimum 1281 bytes with [Path MTU Discovery](/cloudflare-one/team-and-resources/devices/warp/deployment/mdm-deployment/path-mtu-discovery/)

0 commit comments

Comments
 (0)