MTU, PMTUD & the DF Bit: Mid-Session SSH/SCP Stalls to Your Cloud Mac mini Across HK/JP/KR/SG/US (2026)

Teams rent Mac mini M4 hosts in HK, JP, KR, SG, or US because geography changes RTT—not magic. Yet the same engineers who happily ssh into banners suddenly watch SCP or git push over SSH crawl to zero bytes per second while CPU on both ends idles. One under-diagnosed culprit is path MTU discovery (PMTUD) failing across a chain of PPPoE, MPLS, GRE, or IPsec overlays that silently drop ICMP Fragmentation Needed while TCP still sets Don’t Fragment (DF). This 2026 guide separates lossy WAN from black-hole MTU, gives a symptom matrix, a tunnel overhead cheat sheet, and a seven-step runbook you can attach to tickets before asking operations to move regions. Cross-link with MTR path diagnostics, corporate VPN routing, and cross-region latency tuning once you know packets are not dying to DNS lies or captive portals.

The emotional failure mode is familiar: someone blames “the Singapore mini” because the symptom appears after a region switch, when in reality the laptop started routing through a new ZTNA profile that clamps MSS differently. Document both the region label and the encapsulation stack whenever you escalate—finance cares about the former, neteng cares about the latter.

Who actually sees MTU black holes on cloud Mac paths

Anyone stacking consumer VPN + corporate VPN + Wi‑Fi calling handoff is high risk. Developers who push large artifacts through scp while interactive shells stay tiny notice it first because keystrokes fit inside small MSS windows but bulk TCP tries to ramp. SRE teams that only test with curl --range against HTTPS may miss SSH entirely because TLS stacks sometimes pick different segment sizes or middleboxes treat 443 differently than TCP/22.

• Always-on ZTNA that hides effective MSS from users until they compare wired vs wireless.
• Cellular tethering with asymmetric MTU between uplink and downlink bearers.
• Legacy firewalls configured to drop all ICMP—even the ones PMTUD requires to survive.

Symptom matrix: MTU black hole vs loss vs DNS

What you observe	Likely layer	Quick proof	First mitigation
Shell works; multi-GB scp stalls at a fixed percent	Path MTU / DF	Try tiny file vs 500 MB; compare on wired bypass	Clamp MSS on tunnel interface or disable DF tests per policy
Packet loss climbs on last hops in MTR	WAN congestion	MTR guide	Change time-of-day or region after data, not guesses
Failure before TCP connect completes	DNS or ACL	DNS resolver article	Fix resolver or SG ACL—not MTU
HTTPS works but SSH fails only on guest SSID	Captive portal	Guest Wi‑Fi playbook	Complete portal first

Tunnel overhead cheat sheet (planning numbers, not guarantees)

Segment type	Typical extra headers	What to ask IT
PPPoE last mile	~8 bytes compared to straight Ethernet	Whether CPE enforces baby jumbo frames
GRE or IPIP site-to-site	24+ bytes depending on options	Whether MSS sync is enabled on tunnel endpoints
IPsec tunnel mode	Often 50–90 bytes after ESP/AH	If UDP encapsulation adds another outer IP header
WireGuard overlay	32-byte baseline + alignment	Allowed MTU field on interface vs underlay

Seven-step runbook before you blame the region

1. Reproduce with size: transfer 1 KB, 10 MB, and 1 GB files over the same SSH mux—note where throughput collapses.
2. Remove variables: unplug VPN once (with security approval) and retry; if speed returns, MSS hints belong in the IT ticket.
3. Log encapsulation: capture interface MTU on laptop and any utun interfaces from ifconfig or networksetup snapshots.
4. Run MTR after TCP is stable to prove it is not simple loss masquerading as MTU—use the linked guide.
5. Try conservative MSS: some teams temporarily set IPQoS throughput or lower TCP window caps in ~/.ssh/config while neteng validates ICMP policy.
6. Validate keepalives: combine with AutoSSH/Mosh patterns so idle sessions do not mask mid-transfer stalls.
7. Update the wiki with “known-bad VPN profiles + region pairs” so the next engineer does not burn a weekend re-proving physics.

SCP, Git over SSH, and rsync: why they hurt first

Bulk transfers open wide TCP windows quickly; interactive shells trick humans because echo traffic stays small. git packs and container layers amplify the effect. When partial fixes work, document whether compression (-C) helped—compression changes segment sizes and can accidentally dodge MTU cliffs, which is useful for triage but not a long-term policy.

Bridge to VPN policy, DNS, guest Wi‑Fi, and pricing

MTU sits beside—not above—Zero Trust routing, DNS resolver failures, and guest Wi‑Fi portals. Once the path is honest, pick the region that matches your measurement story using the pricing page and keep help center SSH recipes in the same Confluence space.

FAQ

Why does interactive SSH feel fine until I SCP a big file? Small segments stay under path MTU; bulk TCP hits black holes when ICMP is filtered and DF prevents fragmentation.

Is this the same as captive portal issues? No—portal problems usually break DNS first; use the dedicated guest Wi‑Fi article when SSIDs are untrusted.

Should I change region to fix MTU? Only after proving the path; local VPN encapsulation often dominates MSS more than ocean distance.

Why dedicated Mac mini on ProxyMac still helps after you fix MTU

Once MSS is sane, you still want predictable single-tenant CPU for long scp sessions, native macOS tooling, and placement in HK / JP / KR / SG / US that matches real users—not the cheapest ping from a single vantage point. ProxyMac’s rental model lets you park a mini next to the API region you measure, document it beside pricing, and recycle it when the integration sprint ends—without shipping laptops through customs just to prove a WAN argument.