diff --git a/backend/wireguard/device.go b/backend/wireguard/device.go
index 2ebc88e0bc..c5ed9c8cdf 100644
--- a/backend/wireguard/device.go
+++ b/backend/wireguard/device.go
@@ -128,7 +128,7 @@ func newWGDevice(devAttrs *wgDeviceAttrs, ctx context.Context, wg *sync.WaitGrou
 	// Create network device
 	la := netlink.LinkAttrs{
 		Name: devAttrs.name,
-		MTU:  devAttrs.MTU,
+		MTU:  devAttrs.MTU - overhead,
 	}
 	link := &netlink.GenericLink{LinkAttrs: la, LinkType: "wireguard"}