Bouygues Network Bug – WireGuard Disruption Between Public IPv6 and Fixed IPv4
Since a firmware update, Bouygues Wi-Fi 6 Bbox routers disrupt WireGuard tunnels: symptoms, likely cause (reduced MTU) and the MTU = 1380 fix.
Also available in Français
📅 Observations since mid-October 2025
A small French company that is a Horarys client, a consulting firm with about ten employees working partly remotely, contacted us: for roughly two weeks, several of its users connected via Bouygues Telecom Bbox Wi-Fi 6 or Wi-Fi 6E boxes had been experiencing significant instability on their WireGuard VPN connections. We helped them diagnose the problem.
The issue mainly affects the following configurations:
- Tunnel between a client on a public IPv6 address (Bbox) and a server on a fixed IPv4 address
- Access via a WireGuard bridge / routed local network
- UDP carrying TCP traffic (SMB, SSH, RDP, HTTPS)
🚨 Observed symptoms
- Ping works (ICMP not affected)
- RDP, SSH, SMB or web interfaces connect, then freeze or disconnect
- Heavy packet loss, abnormal latency on heavy TCP flows
- No apparent firewall blocking, and no TCP reset
- The problem is limited to clients behind Bouygues Bboxes, while other connections (Free, Orange, SFR, Bouygues 5G, etc.) remain stable
🔍 Probable cause
The network analyses carried out during the diagnosis indicate an effective reduction of the MTU on the WAN interfaces of Bouygues Bbox Wi-Fi 6 boxes since the latest firmware update.
This update also seems to force the activation of IPv6 (SLAAC / DHCPv6-PD), creating an IPv6/IPv4 mix that is not transparent for WireGuard tunnels.
As a result:
- WireGuard UDP packets exceeding ~1408 bytes are fragmented or lost
- Ping (small packets) continues to work
- Encapsulated TCP flows become unstable, especially on connections to fixed IPv4 servers.
🧰 Temporary workaround
Bouygues Telecom has not yet published any official communication, but the solution is simple and effective:
✅ On the WireGuard client (behind the Bbox)
Edit the configuration file:
[Interface]
MTU = 1380Then restart the tunnel.
This single line forces the maximum WireGuard packet size to a threshold compatible with the new Bouygues MTU (~1408 effective bytes), immediately eliminating the losses and slowdowns.
💡 In addition
- Disable IPv6 on the Bbox (or on the client) if possible (not possible on consumer Bboxes; no feedback on the business side)
- Check that the DNS used is IPv4
- Do not change the MTU on the server side (pfSense or Proxmox) if the other clients work correctly
🧩 Typical example
In this case, a client machine with the WireGuard address 10.61.0.10 behind a Bouygues Bbox trying to reach a Proxmox server at 10.172.41.1 saw:
- Stable ping
- but the web interface (
:8006) and SMB frozen.
After adding MTU = 1380, traffic immediately became smooth again.
🧠 Summary
| Element | Status |
|---|---|
| ISP concerned | Bouygues Telecom (Bbox Wi-Fi 6 / Wi-Fi 6E) |
| Impact | Heavy packet loss on WireGuard IPv6→IPv4 tunnels |
| Probable cause | MTU reduction and automatic IPv6 activation via firmware |
| Solution | Force MTU = 1380 on the WireGuard client |
| Bouygues fix | Not announced to date |
🛡️ Our recommendation
I advise all my clients using WireGuard tunnels on Bouygues infrastructure to:
- check tunnel stability with
ping -f -l 1472(Windows) orping -M do -s 1472(Linux), - adjust the MTU to 1380 if necessary,
- temporarily disable IPv6 if instability persists.
I’m keeping a close eye on this behavior and will update this note as soon as an official Bouygues fix or a firmware change is confirmed.
💬 Need assistance?
I can audit your WireGuard tunnel or your multi-site interconnection.
👉 Get in touch: Arthur Perrot, infrastructure & cybersecurity expert.