Key takeaways
Connected does not mean every packet size can pass
A VPN wraps the original traffic in additional protocol headers. The inner packet therefore needs enough room so the encapsulated result still fits the physical path. Normal networking can discover a smaller Path MTU or fragment traffic where the protocol allows it.
A black-hole condition appears when an oversized packet is dropped but useful feedback about the required smaller size never reaches the sender. The tunnel can remain established. DNS and small requests may work while a larger page, image, or repository transfer stops progressing.
Separate MTU symptoms from DNS and general loss
MTU failure is often size-dependent. Small packets remain stable and failures begin only beyond a threshold. DNS issues usually occur before a connection reaches the intended address, while general packet loss tends to affect a broader range of sizes.
Compare the same destination with and without the VPN, then use controlled packet sizes and a do-not-fragment style test when the operating system supports it. The goal is not to discover a magic MTU value. The goal is to prove that reducing payload size consistently removes the failure.
Change the smallest necessary layer
After confirming the diagnosis, lower the VPN interface MTU in measured steps or use TCP MSS clamping on a router you control when that is the appropriate layer. Do not copy one value to every user. PPPoE, mobile access, nested tunnels, and different VPN protocols have different overhead.
Repeat the same sites, a sustained transfer, and reconnect after every change. If MTU adjustment does not affect the symptom, restore the original value and continue with DNS, IPv6, and routing checks instead of stacking unrelated workarounds.
Continue reading