Path MTU Discovery
also called PMTUD
The mechanism by which a sender discovers the largest packet size a path supports, and a common cause of connections that establish and then hang.
Different links support different maximum packet sizes. A sender starts large and relies on routers returning an ICMP "fragmentation needed" message to learn the limit.
When those ICMP messages are blocked — which firewalls frequently do by default — discovery fails silently. Small packets pass, so the TCP handshake succeeds and the connection appears healthy; large packets are dropped with no notification, so the transfer hangs the moment a full-size packet is sent.
The signature is distinctive: connections that establish fine, small requests that work, and larger requests or responses that hang and time out. It appears most often over VPN and tunnelled links, where encapsulation reduces the effective MTU.
The fixes: permit the relevant ICMP types rather than blocking all ICMP, or clamp the TCP maximum segment size on the tunnel so both ends negotiate a size that fits.