diff --git a/ostp-client/src/bridge.rs b/ostp-client/src/bridge.rs
index 30c25e9..e2c85f5 100644
--- a/ostp-client/src/bridge.rs
+++ b/ostp-client/src/bridge.rs
@@ -103,7 +103,7 @@ impl Bridge {
             stealth_sni: config.transport.stealth_sni.clone(),
             stealth_port: config.transport.stealth_port,
             wss: config.transport.wss,
-            mtu: config.ostp.mtu,
+            mtu: config.ostp.mtu.saturating_sub(48).max(500),
             reality_enabled: config.reality.enabled,
             reality_pbk: config.reality.pbk.clone(),
             reality_sid: config.reality.sid.clone(),
@@ -936,7 +936,7 @@ impl Bridge {
         self.reality_enabled = cfg.reality.enabled;
         self.reality_pbk = cfg.reality.pbk.clone();
         self.reality_sid = cfg.reality.sid.clone();
-        self.mtu = cfg.ostp.mtu; // Fix: mtu was never updated on hot-reload
+        self.mtu = cfg.ostp.mtu.saturating_sub(48).max(500); // Fix: mtu was never updated on hot-reload
         self.keepalive_interval_sec = cfg.ostp.keepalive_interval_sec; // Fix: keepalive was never updated on hot-reload
     }
 
diff --git a/ostp-client/src/config.rs b/ostp-client/src/config.rs
index e9db5df..61fbfbe 100644
--- a/ostp-client/src/config.rs
+++ b/ostp-client/src/config.rs
@@ -58,7 +58,7 @@ pub struct OstpConfig {
 
 fn default_keepalive() -> u64 { 5 }
 
-fn default_mtu() -> usize { 1140 }
+fn default_mtu() -> usize { 1280 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct LocalProxyConfig {
diff --git a/ostp-client/src/tunnel/native_handler.rs b/ostp-client/src/tunnel/native_handler.rs
index 2350f0e..7387045 100644
--- a/ostp-client/src/tunnel/native_handler.rs
+++ b/ostp-client/src/tunnel/native_handler.rs
@@ -31,7 +31,7 @@ pub async fn run_native_tunnel(
            .address((10, 1, 0, 2))
            .netmask((255, 255, 255, 0))
            .destination((10, 1, 0, 1))
-           .mtu(config.ostp.mtu as u16)
+           .mtu(config.ostp.mtu.saturating_sub(48).max(500) as u16)
            .up();
 
     #[cfg(target_os = "linux")]
diff --git a/ostp-flutter/android/app/src/main/kotlin/com/ospab/ostp_client/OstpVpnService.kt b/ostp-flutter/android/app/src/main/kotlin/com/ospab/ostp_client/OstpVpnService.kt
index 09cbdf1..0837a58 100644
--- a/ostp-flutter/android/app/src/main/kotlin/com/ospab/ostp_client/OstpVpnService.kt
+++ b/ostp-flutter/android/app/src/main/kotlin/com/ospab/ostp_client/OstpVpnService.kt
@@ -161,7 +161,9 @@ class OstpVpnService : VpnService() {
                 .addRoute("0.0.0.0", 0)
                 .addRoute("::", 0)
                 .addDnsServer(dnsServer)
-                .setMtu(json.optJSONObject("ostp")?.optInt("mtu", 1140) ?: 1140)
+
+            val configuredMtu = json.optJSONObject("ostp")?.optInt("mtu", 1280) ?: 1280
+            builder.setMtu(configuredMtu - 48)
                 
             try { builder.addDnsServer("8.8.8.8") } catch (e: Throwable) {}