Hey people,
Having a bit of a headache with a current setup I'm trying to achieve. I'm trying to create a openvpn access server within vCloud director. Here is the topology of network.
CLIENT vCloud behaviour public IP vCloud internal networking Debian virtual machine
Public IP; 89.89.89.0 -------------> Public IP; 213.44.44.0 ----------------------> Internal NAT; 10.10.5.0 ----------------------------> local IP; 192.168.2.0
No firewall (for testing) Firewall only UDP:1194 No firewall (for testing No firewall (for testing)
allowed.
This is a simple diagram and we do have other services running but that is so I've setup a tunnel with a standard configuration and everything connects up fine. I'm using a routed configuration over UDP and pushing the routes from the server. I can ping everyone I need to and it seems as it connected as it should but here's where it gets strange. When connected from behind the DMZ (Office VPN) everything works as expected and very fast. I can connect to the VM's via the VPN ip and the local.
But when I connect from the DMZ, I'm getting connected fine but can only ping machines ? I've sniffed the connection through tcpdump & tshark and UDP packets work fine (Tested via nc pipe) and the lengths are correct to the size of data coming in. But when I try and connect to a service via TCP everything times out. When sniffing the connection @ both ends packets come in and out but are all failing header checksums and have a zero length ?
I've tried measuring the MTU with pings and setting, disabling compression, swapping to TCP, mssfix and much more but nothing changes this behavior ? It cannot be a routing issue as if I connect to a service from the client to the server or vice versa I can see packets streaming through but all fail checksum and are zero. Wireshark flags them as bad packets.
Here's a few links to packet dumps connecting to various services.
TCP SSH connection dump
http://pastebin.com/p4NU5HnB
UDP test dump
http://pastebin.com/UF01PSAg
TCP manual connection test.
http://pastebin.com/NaupuYPk
I'm no network engineer just a system admin so getting out of my realm of knowledge so would appreciate any pointers on how to get this fixed.
Thank you in advance for any help received !!
