From 2a804ecdb6bffb6fcca6fd69da596a1c3594a1df Mon Sep 17 00:00:00 2001 From: "Zvi \"Salynn\" Effron" Date: Wed, 15 Jul 2026 08:01:09 -0700 Subject: [PATCH] Set the QUIC InitialPacketSize to 1200 bytes quic-go defaults the `InitialPacketSize` to 1280 bytes. This is used for the size of the payload plus UDP header. When quic-go creates its initial handshake packet, it pads it to this size as an optimization for the anti-amplification limit (which does not really apply to Caddy's server connections). Tailscale uses an MTU of 1280 (the minimum IPv6 MTU) because it is a tunnel operating in unknown environments, possibly inside other tunnels. When wrapped in an IP header (either v4 or v6), the 1280 byte QUIC packet constructed by quic-go exceeds the Tailscale MTU and gets dropped. This makes it impossible to respond to an HTTP3 connection attempt over Tailscale when using the default `InitialPacketSize`. We explicitly set the `InitialPacketSize` to 1200 (its minimum) to support HTTP3 connections over Tailscale and other low MTU connections. Once the connection is established, quic-go can perform MTU discovery to increase the packet size to the maximum supported by the connection, so any throughput loss due to the lowered `InitialPacketSize` is short-lived. --- listeners.go | 5 +++-- modules/caddyhttp/server.go | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/listeners.go b/listeners.go index 6031f98e495..4d4a400b2e2 100644 --- a/listeners.go +++ b/listeners.go @@ -480,8 +480,9 @@ func (na NetworkAddress) ListenQUIC(ctx context.Context, portOffset uint, config earlyLn, err := tr.ListenEarly( http3.ConfigureTLSConfig(quicTlsConfig), &quic.Config{ - Allow0RTT: allow0rtt, - Tracer: h3qlog.DefaultConnectionTracer, + InitialPacketSize: 1200, + Allow0RTT: allow0rtt, + Tracer: h3qlog.DefaultConnectionTracer, }, ) if err != nil { diff --git a/modules/caddyhttp/server.go b/modules/caddyhttp/server.go index 391a0f41a44..2dc7506c614 100644 --- a/modules/caddyhttp/server.go +++ b/modules/caddyhttp/server.go @@ -825,8 +825,9 @@ func (s *Server) serveHTTP3(addr caddy.NetworkAddress, tlsCfg *tls.Config) error TLSConfig: tlsCfg, MaxHeaderBytes: s.MaxHeaderBytes, QUICConfig: &quic.Config{ - Versions: []quic.Version{quic.Version1, quic.Version2}, - Tracer: h3qlog.DefaultConnectionTracer, + Versions: []quic.Version{quic.Version1, quic.Version2}, + InitialPacketSize: 1200, + Tracer: h3qlog.DefaultConnectionTracer, }, IdleTimeout: time.Duration(s.IdleTimeout), }