Windows L2TP loads some sites: clear the DF bit on pfSense

The laptop connects, the intranet loads, and a handful of public sites hang. Authentication and routing are clearly working, which leaves packet size as the explanation. On an L2TP/IPsec tunnel the usable MTU is smaller than the adapter still advertises, and the client keeps sending full-size packets with the don't-fragment bit set. A pfSense gateway can be told to clear that bit, and that is the fastest way to confirm the diagnosis before fixing it properly.

Start with the pages that fail

Note which destinations fail and which succeed before touching any setting. Handshakes that stay under the tunnel limit complete normally, while transfers needing a full-size segment stall partway. That split is the signature of a size problem rather than a filter, because a blocked destination fails at connection setup instead of mid-page. Both observations cost nothing and they narrow the search immediately.

Probe with a ping that sets the bit and controls payload size. The largest payload that survives tells you the real path MTU, and the adapter's advertised value shows how far apart the two are.

Write both numbers down. The fix depends on which one is wrong, and the pair is what a capture later confirms.

What the DF bit does on the way out

Encapsulation is the reason the numbers differ. IPsec adds ESP, L2TP adds another header, and the tunnel therefore carries less payload than the physical link. Windows still reports 1500 bytes on the adapter and sets don't-fragment on what it sends. When such a packet cannot fit, the correct answer from the gateway is an ICMP message asking the sender to shrink. That is why a tunnel that passes small pings can still fail a file download.

That message often never arrives. A hop may filter ICMP, or nothing generates it, and the sender repeats the same size until the transfer gives up.

Silence is the normal presentation here, which is why the symptom reads as selective blocking. Nothing in the client log records a missing ICMP message.

The pfSense option, and what it does not do

The option sits on the System, Advanced, Firewall and NAT page, labelled Clear invalid DF bits instead of dropping the packets. Rather than discarding an oversized packet that carries the flag, the filter removes the flag and lets the packet be split downstream. A packet counts as invalid when it cannot cross the outgoing interface in one piece.

The option restores connectivity without touching the client, which is why it is popular. It is also a workaround: fragmentation costs CPU and makes each lost fragment more expensive.

It applies to forwarded traffic only, not to traffic the firewall itself originates. The same page offers Disable Firewall Scrub, which turns off normalization entirely, and that is a much broader change than this problem needs.

A narrower fix that keeps TCP unfragmented

Nearly all of the stalled flows are TCP, and TCP can negotiate a smaller segment instead of relying on fragmentation. Clamping MSS on the tunnel interface rewrites the advertised value during the handshake, so each side sends what actually fits. The path then behaves predictably and no packet needs splitting.

That leaves UDP to discovery or to the DF option. When the failing sites are ordinary web pages, the clamp is the change to prefer.

The client can report its own adapter MTU through netsh interface ipv4 show subinterfaces. Compare that figure with what the server believes it negotiated, because the two are not always the same. That value is the one the operating system will actually use, whatever the negotiation reported.

Confirm with a capture, then reset state

Capture on both sides before deciding: one trace where the tunnel runs, another where the WAN interface does. Packets leaving at full size with no ICMP returning point at the clamp as the right layer. Replies that arrive and then die on the way back point at the tunnel MTU instead.

Clear the state table before retrying, since existing flows keep their old segment sizes. Then load the page that failed and read the states view for two-way traffic rather than one-sided counters. If it still stalls, capture again rather than trying another checkbox.