Hello,
This issue has me a bit perplexed. I've been sifting around for any info that might have escaped my notice, but have not seen much else that has helped anyone else or sheds any light on my issue.
I have an ESXi 5.0 server being used as a firewall, with a CentOS 6.2 firewall server VM. It is connected directly to a Cable router set to not NAT or firewall the traffic.
I have moved an OpenVPN config I had working in the past on another server (Centos 5.8) and it leads me to view there might be an issue there, but I wanted to double check on each part.
I will establish a VPN connection and everything connects fine. I am able to ping and use web connections to various resources on the network, but the ESXi Client fails to connect with the "loading inventory" part just cycling out for a few minutes and then times out.
I've tried testing MTU, Fragment, and mssfix settings to no avail. Other sites I access work fine, but this is not working well. I'm mostly using the ESXi 5 and CentOS 6 as testing grounds to move others to later.
Server OpenVPN conf
port 1194
proto udp
dev tun
ca /xxx/ca.crt
cert /xxx/server.crt
key /xxx/server.key
dh /xxx/dh1024.pem
server x.x.x.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
client-config-dir /etc/openvpn/ccd
client-to-client
keepalive 5 45
tls-server
comp-lzo
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3
#tun-mtu 1500
#tun-mtu-extra 32
#fragment 1400
#mssfix 1400
ping-timer-rem
#mtu-test
Client Config
client
dev tun
proto udp
remote x.x.x.x 1194
nobind
persist-tun
persist-key
tls-remote xxxx
#user nobody
#group nobody
comp-lzo
#key-method 1
ca "xxx.crt"
cert "xxx.crt"
key "xxx.key"
status openvpn-status.log
verb 3
#tun-mtu 1500
#tun-mtu-extra 32
#fragment 1400
#mssfix 1400
ping-timer-rem
#mtu-test[
IpTables
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [45:4161]
-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -s 172.x.x.0/24 -i eth1 -j DROP
-A INPUT -s 127.0.0.0/8 -i eth1 -j DROP
-A INPUT -s 192.168.0.0/24 -i eth1 -j DROP
-A INPUT -s 127.0.0.1/32 -i eth1 -j DROP
-A INPUT -d 127.0.0.1/32 -i eth1 -j DROP
-A INPUT -s 192.168.0.0/16 -i eth1 -j DROP
-A INPUT -s 172.16.0.0/12 -i eth1 -j DROP
-A INPUT -s 10.0.0.0/8 -i eth1 -j DROP
-A INPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/min --limit-burst 3 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p udp -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 127.0.0.1/32 -i eth1 -j DROP
-A FORWARD -d 127.0.0.1/32 -i eth1 -j DROP
-A FORWARD -s 192.168.0.0/16 -i eth1 -j DROP
-A FORWARD -s 172.16.0.0/12 -i eth1 -j DROP
-A FORWARD -s 10.0.0.0/8 -i eth1 -j DROP
-A FORWARD -o eth1 -p tcp -m tcp --sport 137:139 -j DROP
-A FORWARD -o eth1 -p udp -m udp --sport 137:139 -j DROP
-A OUTPUT -o eth1 -p tcp -m tcp --sport 137:139 -j DROP
-A OUTPUT -o eth1 -p udp -m udp --sport 137:139 -j DROP
COMMIT
# Completed on Fri Mar 16 17:04:49 2012
# Generated by iptables-save v1.4.7 on Fri Mar 16 17:04:49 2012
*nat
:PREROUTING ACCEPT [1:229]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [1:76]
-A POSTROUTING -o eth1 -j MASQUERADE
COMMIT
I've been looking to re-write the iptables a bit, but its been working a while so far. Any insight would be greatly appreciated.
