Access to a site from the Internet not working, but is for other sites on the same SP

Question

Greetings,
My environment:
SP 2013 Enterprise w/ SP1 installed
2 servers in the farm, 1 for SQL, 1 for SP
Both servers are VMs running on Hyper-V, SQL is a bit underpowered when it comes to memory, SP is fine
5 web applications running, including a MySites web app and Central Admin (I've seen where separate web apps isn't the recommended configuration any more, but, this is how it was done when setup)
All sites run using SSL (443), same NIC, using host headers, pretty standard stuff (I think)
Claims authentication on all but Central Admin
Central Admin is firewalled off to all but a select few
1 to 1 correspondence between web apps and content databases
Other than MySites, all sites have either 1 or 2 site collections (search is in a separate site collection on 2 of the sites); MySites has many more site collections
So, site A, site B, site C, and site M are all supposed to be available from the Internet (with SSL and authentication) and also from the internal network. For site A, C, and M, this is true, no problem. Site B however doesn't work when coming in from the
Internet, just internally. I've received multiple reports of this from some of my users around the country, and I've been able to replicate it on my computers.
IIS just gives a blank page, no messages, no login. Chrome does present a login box, and will log into the site and work. This is from a laptop that is a part of our domain with cached credentials, but not directly connected to our network or using
our VPN. A non-domain laptop without cached credentials prompts me to login, as it should, and seems to work. The domain laptop will use the cached credentials to auto-authenticate to A, C, and M, but not B.
I'm using IE 11. I've tried putting the site into Compatibility mode, no joy. I've added the site to the Trusted Sites list, no joy. I don't have IE 10 available for testing (or 9 or 8 or ... just 11 :-(  ) I've flushed the browser cache, emptied the
cookies, etc.
So, 3 of 4 sites work fine on the same machine, same Internet connection, same browser, same SP. I'm thinking it's something with IE, but, what? Seems like IE should be sending the same creds to all the sites, as they're all in the same Internet domain.
Does IE or Windows cache different creds somewhere? Or is there something in SP? I could see where one person's settings could get hosed somehow, but numerous people around the country with different h/w, different Internet connections, different credentials?
ARGH! HELP!!! Point me at something to look at, because I'm drawing a blank (and getting permanent dents in my forehead from banging it on my keyboard)...
Thanks much,
Steven

Answer 1

It seems that the difference between the sites that will open and the one that won't is the Default Authentication provider is set to NTLM on those that open, and Negotiate (Kerberos) on the one that won't. The Authentication Provider for the Default zone
is Claims Based Authentication on all the sites, just site B (which won't open) is set to Negotiate (Kerberos), the others are set to NTLM.
Short term: can I change the provider to NTLM without destroying the site?
Long term: point me in the direction for setting up Kerberos correctly on my server/farm, as from what I can tell Kerberos is the recommended path forward. I'll setup a non-production test site and get it figured out.
Thanks much.
Steven