pfSense

By any chance you have net.inet.ipsec.filtertunnel set to something grater than 0?

on the one system of ours that was having this issue, it's better than it used to be (it used to be impossible to complete a TCP handshake), but it still drops TCP sessions like crazy. Somewhere around a month ago it got better. Currently on Feb 8 snap.

$ sysctl -a|grep filtertunnel
net.inet.ipsec.filtertunnel: 0
net.inet6.ipsec6.filtertunnel: 0

Can you try if setting net.inet.ipsec.filtertunnel: 0 to 1 makes it work correctly?

Setting net.inet.ipsec.filtertunnel=1 definitely seems to fix it. On a tunnel where I couldn't keep a TCP session going for more than a minute or two previously, after changing only that, I've had a RDP session up for over an hour and multiple SSH sessions up, with no problem at all.

Well, it fixed one problem and broke things that used to work. Incoming IPsec traffic from other connections that were working fine previously are now getting blocked in on em0 (WAN, where the IPsec terminates) where they should be hitting the rules for in on enc0.