Each shard must be able to talk to all config servers and at-least one member of each shard's replicaSet. If a user has overzealous firewall rules things will break and the only error will be 10276: "DBClientBase::findOne: transport error".

Perhaps we should have a background job try to connect to everyone once a minute and warn if it can't.