diff --git a/net/tstun/constants.go b/net/tstun/constants.go
new file mode 100644
index 000000000..c93148e2b
--- /dev/null
+++ b/net/tstun/constants.go
@@ -0,0 +1,16 @@
+// Copyright (c) 2022 Tailscale Inc & AUTHORS All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package tstun
+
+// DefaultMTU is the Tailscale default MTU for now.
+//
+// wireguard-go defaults to 1420 bytes, which only works if the
+// "outer" MTU is 1500 bytes. This breaks on DSL connections
+// (typically 1492 MTU) and on GCE (1460 MTU?!).
+//
+// 1280 is the smallest MTU allowed for IPv6, which is a sensible
+// "probably works everywhere" setting until we develop proper PMTU
+// discovery.
+const DefaultMTU = 1280
diff --git a/net/tstun/tun.go b/net/tstun/tun.go
index 286c5f754..bdf8d465a 100644
--- a/net/tstun/tun.go
+++ b/net/tstun/tun.go
@@ -20,15 +20,7 @@ import (
 	"tailscale.com/types/logger"
 )
 
-// tunMTU is the MTU we set on tailscale's TUN interface. wireguard-go
-// defaults to 1420 bytes, which only works if the "outer" MTU is 1500
-// bytes. This breaks on DSL connections (typically 1492 MTU) and on
-// GCE (1460 MTU?!).
-//
-// 1280 is the smallest MTU allowed for IPv6, which is a sensible
-// "probably works everywhere" setting until we develop proper PMTU
-// discovery.
-var tunMTU = 1280
+var tunMTU = DefaultMTU
 
 func init() {
 	if mtu, ok := envknob.LookupInt("TS_DEBUG_MTU"); ok {
diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go
index 0a427e8db..34c8656fc 100644
--- a/wgengine/netstack/netstack.go
+++ b/wgengine/netstack/netstack.go
@@ -131,7 +131,7 @@ type Impl struct {
 var handleSSH func(logger.Logf, *ipnlocal.LocalBackend, net.Conn) error
 
 const nicID = 1
-const mtu = 1500
+const mtu = tstun.DefaultMTU
 
 // Create creates and populates a new Impl.
 func Create(logf logger.Logf, tundev *tstun.Wrapper, e wgengine.Engine, mc *magicsock.Conn, dialer *tsdial.Dialer, dns *dns.Manager) (*Impl, error) {
@@ -1018,7 +1018,7 @@ func startPacketCopy(ctx context.Context, cancel context.CancelFunc, dst net.Pac
 	}
 	go func() {
 		defer cancel() // tear down the other direction's copy
-		pkt := make([]byte, mtu)
+		pkt := make([]byte, 1500)
 		for {
 			select {
 			case <-ctx.Done():