Load balancer health checks are green but clients time out

A new load balancer, LB1, was installed in one-arm mode on the server VLAN 10.20.0.0/24. Its self IP is 10.20.0.5 and the new virtual server listens on 10.20.0.100:443 as a layer 4 TCP service (TLS passes through to the servers). The pool is SRV1 10.20.0.11:443 and SRV2 10.20.0.12:443, both shown up by their TCP health monitor. The servers' default gateway is R1 at 10.20.0.1. Users in VLAN 50 (10.50.0.0/24) time out when they browse to the VIP. Browsing directly to 10.20.0.11 works.