I eventually took the time to figure out the OVPN setup and have been using that ever since. At some point I'll just have to make some time and "merge" the bridges again and hopefully it won't have the same effect.
The thing is that I've ran into the same issue in the meantime and realized what the reason was, but I was not able to google up this topic to update it earlier. I could only find it as you've popped up in another topic - I remembered the avatar, not the username.
The actual reason is that the MTU of a bridge interface adjusts to the smallest one of the MTUs of the member ports of the bridge. So once you make an L2 tunnel interface a member port of a bridge, the MTU of that bridge gets reduced, and if ICMP is blocked somewhere on the path from the bridge to the remote server and thus PMTUD cannot work properly, you end up with that kind of issues with TCP servers.
For L2TP with BCP, the remedy is easy, you have to configure the mrru
value at both the client (on the /interface l2tp-client
row) and at the server (in the /interface l2tp-server server
settings) to at least 1504. Doing so will activate use of MLPPP on the L2TP link, which in simple terms activates internal fragmentation of the frames which don't fit, so the MTU of the bridge stays at 1500 once you interconnect the bridges.
Something is telling me that for actual bridging, the mrru
has to be set to 1522 in order that vlan-tagged frames carrying 1500-byte IP packets would fit, but that's a step further, which is only interesting if you actually need to link the bridges. Since everything runs fine when you use separate bridges for the client connections, I assume you actually don't need L2-transparency of the tunnels at all as you don't need to extend the bridge in the central office to the clients. If my assumption is correct, just removing the bridge
parameter from the /ppp profile
rows could do the trick as well.
Adding an OpenVPN tunnel interface in TAP (ethernet) mode to a bridge doesn't reduce the MTU of that bridge, so I assume there is an internal fragmentation mechanism in OpenVPN in TAP mode too. In TUN (IP) mode, the MTU of the tunnel interface is lower than 1500, but that is not surprising.