A service reached through a VPN tunnel answers small requests fine, but connections hang whenever a response is large, and TLS handshakes sometimes stall. What is a likely network cause?

This is the classic sign of an MTU problem. The MTU (Maximum Transmission Unit) is the largest packet a link can carry. It is usually 1500 bytes on Ethernet. Tunnels and VPNs add their own headers, so their real MTU is smaller. Small packets fit. Full-size packets don't.

Normally Path MTU Discovery (PMTUD) handles this:

• The sender marks packets as "don't fragment".
• A router that can't forward a too-big packet drops it.
• The router sends back an ICMP "fragmentation needed" message ("packet too big" in IPv6).
• The sender then makes its packets smaller.

If a firewall blocks that ICMP message, the sender never learns about the problem. It keeps resending full-size packets, they keep getting dropped, and the connection hangs. This is called a PMTUD black hole. TLS handshakes stall because certificate chains usually fill full-size packets.

Fixes:

• Allow those ICMP messages through the firewall.
• Lower the interface MTU.
• Clamp the TCP MSS (Maximum Segment Size) at the tunnel, so the endpoints never send packets that are too big.