Changing the mss in ip6tables didn't solve the problem.
I tried both ways:
-A FORWARD --proto tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1420
-A FORWARD --proto tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
I think the hypothesis about MTU issues has been disproved by now. At least it is not the only source of problems.
From what I have seen myself since the start of this thread, I can say for sure that I experience two different problems. One of them is related to the flash plugin and when that triggers, the problem persists until I kill the flash plugin and let the browser restart it. Sometimes I have noticed that sound disappears a few minutes before the flash plugin completely stops working.
One person in this thread did have an MTU issue, but it is unclear if that affected youtube. Clamping the MSS to 1220 on in- and outgoing SYN packets is pretty much guaranteed to eliminate MTU issues on TCP connections. I have been clamping the MSS on my tunnel the entire time, so the other problem affecting me is not an MTU problem.
As I looked through this thread again, the only other hypothesis I saw mentioned was this one:
What I think is happening is YouTube's security is throwing a wobbly, because Chrome is varying between requesting bits from IPv4 and IPv6.
That would explain why the problem goes away when running IPv4 only. If that theory holds, then it should be possible to avoid the problem by running IPv6 only. But when I have tried to access YouTube over IPv6 only connectivity, it wasn't working either. That seems to be a different problem though. Sometimes the AAAA records points to addresses that don't respond, and there is going to be a timeout.
One could log information about which hostnames are being accessed, which of those hostnames are dual stack, which of them are IPv4 only, and which of the IP addresses actually respond to HTTP requests. That might help identify why it sometimes works and why it sometimes doesn't.
If anybody want to run YouTube on IPv4 only, but still have dual stack connectivity for everything else. You either need to delete AAAA records from dual stack hostnames during DNS lookups, or block the TCP SYN packets. If you have a list of IPv6 addresses used by YouTube, you can use ip6tables to prevent outgoing SYN packets to those addresses by using --reject-with tcp-reset.