EsXi device experiencing issues with VPN, tunneling and SYN-ACK protocols.
EsXi device experiencing issues with VPN, tunneling and SYN-ACK protocols.
Details: Dell Precision Tower 5810 with Xeon ® E5-1620 processor. Hyperthreading and virtualization features activated. 16GB ECC DDR4 memory at 2133MHz, 450W power supply, BIOS version A13. Connected using an Intel 1GB Ethernet NIC with ESXi stock driver. ESXi image 7.0U3g-20328353-standard. Problems encountered: Attempted to apply a tutorial involving Cloudflare and Kemp Loadmaster for port forwarding to access web interfaces and ESXi portal. Encountered error 522 from Cloudflare due to timeout issues, likely a SYN-ACK failure. Various workarounds tried—Parsec, Wireguard, Zerotier, Open VPN—but none resolved the issue. Successful alternatives: Local web GUIs, Plex server via local IP and plex.com/web, Kemp VIP redirection with local IP. Tested pinging 1.1.1.1, 8.8.8.8, plex.com using Ubuntu VM; successfully reached those sites. Installed Parsec (Linux app limitations), Wireguard (Windows client couldn't connect to server), Zerotier (both Ubuntu and Windows devices connected but access still blocked). Set up Open VPN per installation guide, logged into host and client devices. Downloaded Windows client file, connected via tunnel, but no internet access or ping functionality. Used tcpdump on Kemp VM to capture data, though unable to establish FTP connectivity on Windows device. Summary: Host remains online intermittently; troubleshooting steps focus on network configuration, firewall rules, and VPN setup.
It appears the firewall is likely handling the handshake ports or key issues, or there may be a routing problem. To clarify, you should enable logging on your firewall/router to observe the actual behavior. If you need internet access via VPN, configure it as the default route on the connected device.
Currently I'm just using the router, only port 443 is forwarded to the Kemp VM. It might be a handshake or something important, but I’m not familiar with it. How can I investigate this? The router is old and logs are limited to outgoing traffic. I tried reaching the site I set up in Cloudflare, but it only logged traffic from my gaming rig, Plex server, and the VPN server I haven’t turned off yet. The Windows client showed it as connected, Task Manager displayed data going out, and the app and ping command both worked. The internet troubleshooter reported success. Updated November 9, 2022 by ZplcKnave
Well, there are several aspects to understand about a VPN. You can install it on the device itself, or configure it through an ESXi host running on the virtual machine, or via a router/firewall. The setup depends on your needs and connection type. A VPN connecting to another network would link to another firewall or router, using the public IPs of both ends, defining which IP ranges must be accessible within the tunnel, and ensuring internet access has its own default route out. To establish a connection, you can either use digital certificates or simple text-based keys that match exactly on both sides. VPNs that route traffic from a server or PC to a firewall or another location require specific ports to be open. For example, PPTP uses port 1723 TCP, L2TP uses 1701 TCP, 500 UDP, and 4500 UDP, IPSec uses 500 UDP and 4500 UDP, SSTP uses port 443 TCP, and OpenVPN uses ports 1194 UDP and 443 TCP.
Reviewing the details again, it seems you're planning a reversed VPN consentrator on your ESXi... Do you need a VPN server for remote access or to reach other networks? Essentially, decide whether you want to go in or out. If using OpenVPN, you'll have to forward specific ports like UDP 1194 and TCP 443 from your outside IP to the dedicated VPN server address. To ensure it functions properly, consider this example: for an inside-out approach, add routes in your router's internal table directing traffic on the other side of the VPN to the VPN server's IP. Alternatively, configure devices that will use the VPN to route through the server as their IP address. There are multiple paths to Rome, and various methods exist—choosing the right one depends on your needs. Setting up the VPN directly in the router simplifies things, making a point-to-point VPN the simplest option.