Discussion about this post

User's avatar
Raghav Mehta's avatar

The ICMP section undersells one failure mode. When a firewall drops all ICMP, it also drops the "packet too big" messages, so path MTU discovery breaks silently. The TCP handshake and small requests work fine, but anything larger than a tunnel's MTU just stalls. That's the classic VPN bug where ping works and ssh connects but git push hangs. The usual fixes are letting ICMP type 3 code 4 through, clamping TCP MSS at the tunnel edge, or packetization layer PMTUD (RFC 4821 and RFC 8899), which probes with real packets and doesn't depend on ICMP at all. QUIC can use that last approach too. Might be worth a line in a troubleshooting follow up.

3 more comments...

Ready for more?