Policy routing works for small flows but larger sessions die

A firewall and router pair pass small health checks, but file transfers or TLS handshakes break only on some sessions.