From c5b66cf8eae1e7a0d6f1b412a26de3fc11d73fc9 Mon Sep 17 00:00:00 2001
From: Salynn <154973586+Salynn@users.noreply.github.com>
Date: Sat, 25 Jul 2026 17:48:25 -0500
Subject: [PATCH] Set the QUIC InitialPacketSize to 1200 bytes (#7886)

quic-go defaults the `InitialPacketSize` to 1280 bytes. This is used for
the size of the payload plus UDP header. When quic-go creates its
initial handshake packet, it pads it to this size as an optimization
for the anti-amplification limit (which does not really apply to
Caddy's server connections).

Tailscale uses an MTU of 1280 (the minimum IPv6 MTU) because it is a
tunnel operating in unknown environments, possibly inside other
tunnels.

When wrapped in an IP header (either v4 or v6), the 1280 byte QUIC packet
constructed by quic-go exceeds the Tailscale MTU and gets dropped. This
makes it impossible to respond to an HTTP3 connection attempt over
Tailscale when using the default `InitialPacketSize`.

We explicitly set the `InitialPacketSize` to 1200 (its minimum) to support
HTTP3 connections over Tailscale and other low MTU connections.

Once the connection is established, quic-go can perform MTU discovery to
increase the packet size to the maximum supported by the connection, so
any throughput loss due to the lowered `InitialPacketSize` is
short-lived.
---
 listeners.go                | 5 +++--
 modules/caddyhttp/server.go | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/listeners.go b/listeners.go
index 6031f98e4..4d4a400b2 100644
--- a/listeners.go
+++ b/listeners.go
@@ -480,8 +480,9 @@ func (na NetworkAddress) ListenQUIC(ctx context.Context, portOffset uint, config
 		earlyLn, err := tr.ListenEarly(
 			http3.ConfigureTLSConfig(quicTlsConfig),
 			&quic.Config{
-				Allow0RTT: allow0rtt,
-				Tracer:    h3qlog.DefaultConnectionTracer,
+				InitialPacketSize: 1200,
+				Allow0RTT:         allow0rtt,
+				Tracer:            h3qlog.DefaultConnectionTracer,
 			},
 		)
 		if err != nil {
diff --git a/modules/caddyhttp/server.go b/modules/caddyhttp/server.go
index 391a0f41a..2dc7506c6 100644
--- a/modules/caddyhttp/server.go
+++ b/modules/caddyhttp/server.go
@@ -825,8 +825,9 @@ func (s *Server) serveHTTP3(addr caddy.NetworkAddress, tlsCfg *tls.Config) error
 			TLSConfig:      tlsCfg,
 			MaxHeaderBytes: s.MaxHeaderBytes,
 			QUICConfig: &quic.Config{
-				Versions: []quic.Version{quic.Version1, quic.Version2},
-				Tracer:   h3qlog.DefaultConnectionTracer,
+				Versions:          []quic.Version{quic.Version1, quic.Version2},
+				InitialPacketSize: 1200,
+				Tracer:            h3qlog.DefaultConnectionTracer,
 			},
 			IdleTimeout: time.Duration(s.IdleTimeout),
 		}