Architecture

Routing through several networks

When you send packets between the Internet and the client, they pass through two networks — the private network and the public network.

As explained in the FAQ about technical details, the MTU of Hetzner cloud servers is different in private and public interfaces.

In the example above, an incoming packet with an MTU of 1500 bytes should be able to reach the cloud server router without any issues. However, if the router cannot perform IP fragmentation, it cannot forward the packet through the private interface and the packet is dropped.

You can run ip link show to check the MTUs of all interfaces on your system.

Routing from network-isolated environments

If you have a network-isolated environment on your system (e.g. Docker container or LXC), it will usually have its own interface settings.

In the example below, the network-isolated environment and the underlying host can exchange packets with an MTU of 1500 bytes:

If the network-isolated environment uses the underlying host as a router, the host from the example above will forward the packet via the private interface with an MTU of 1450 bytes.

If the network-isolated environment sends a packet with an MTU of 1500 bytes, it should be able to reach the underlying host without any issues. However, if the host cannot perform IP fragmentation, it cannot forward the packet through the private interface and the packet is dropped.