Odd failures from an MTU mismatch
A classic: ping works, ssh logs in, but scp stalls halfway through a large file, or HTTPS loads and downloads fail.
Usually the path MTU is below the interface MTU and something in the middle drops ICMP fragmentation needed, so PMTUD is blind. Small packets pass; large ones are silently discarded.
ping -M do -s 1472 1.2.3.4 # 1472 + 28 = 1500Work down from 1472; the largest size that passes plus 28 is the real MTU. Typical values are 1400 for PPPoE, 1420 for WireGuard, 1450 for some tunnels.
Lower the interface MTU, or set tcp_mtu_probing=1 so the kernel probes. The latter is easier but only applies when a connection is established.