Samba is inaccessible from VPN

Nas · February 15, 2016, 7:54am

It was ME

Nas · February 15, 2016, 8:07am

@giacomo as for Samba it is a known issue with Tun interface, that samba can not bind to it, but on TAP it should bind. maybe some port forward or port tunnel from VPN can be a workaround. It should be tested.

Nas · February 15, 2016, 8:09am

Hi @stephdl maybe You have some thoughts regarding this ?

mark_nl · February 15, 2016, 2:29pm

Workaround could be IP forwarding, :

iptables -t nat -A POSTROUTING -s <your.vpn.network.0>/24 -o <ethX> -j MASQUERADE
service iptables save

in /etc/sysctl.conf add:

net.ipv4.ip_forward = 1

apply sysctl:

sysctl -p

(in the case of @Nas <your.vpn.network.0> = 10.10.1.0)

samba share shoud be found at

\\<static ip server>\<share>

Nas · February 15, 2016, 2:38pm

As we use Shorewall, it can be done through masq file But it could cause another issues with other services

mark_nl · February 15, 2016, 2:57pm

Still have to read in to Shorewall… (and Nethserver/Centos as a mather of fact);

Nas · February 15, 2016, 5:51pm

Hw about this ?

github.com

samba-team/samba/blob/master/lib/tdb/test/tap-interface.h

/* 
   Unix SMB/CIFS implementation.
   Simplistic implementation of tap interface.

   Copyright (C) Rusty Russell 2012
   
     ** NOTE! The following LGPL license applies to the talloc
     ** library. This does NOT imply that all of Samba is released
     ** under the LGPL
   
   This library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 3 of the License, or (at your option) any later version.

   This library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.

This file has been truncated. show original

stephdl · February 15, 2016, 8:16pm

Sorry @Nas not enough time to play at the minute, I’m changing my main server (aubrac-medical.fr) and reconfiguring my build machine for el7.

Nas · February 15, 2016, 8:21pm

@stephdl it is not a matter of minutes, but we should make some research regarding this.

stephdl · February 15, 2016, 8:39pm

Out of topic, but aubrac-medical.fr is like a a good friend that I’m leaving after an adventure of six years about free software ( smeserver, stephdl, nethserver, archlinux repositories) and a lot of (old) scripts everywhere. Today I’m a bit sad

But the new server is a monster (comparatively from the old) -> https://www.soyoustart.com/fr/offres/e3-sat-3.xml

Nas · February 15, 2016, 8:43pm

Yep, Xeon + DDR3 = Rocket

craaaft · February 16, 2016, 9:12am

Could you show how this can be done through shorewall? I am just familiar with iptables and I would like to check this workaround.

dz00te · February 16, 2016, 9:32am

sorry I’m in a hurry … but i want to report my configuration
FW/GW with openvpn server - multiple green - ns6.7
mail/file server - ns6.7
other file server: qnap
my desktop os: fedora23

i can connect with openvpn, mount share on qnap ad on file server on ns67 (after adding my ovpn network in trusted network)
no special config added if i remember correctly…

how can i reproduce the bug? what is your config?

Nas · February 16, 2016, 9:32am

HI @craaaft
You can add in masq file , source tapX and dest intermal lan interface ethX

vi /etc/shorewall/masq
eth0  tap0

and run

service shorewall restart

craaaft · February 16, 2016, 10:35am

Thanks! It worked. I did it with the tun0. Are there any disadvantages to this method? I understand that the network tunnell address is just translated into the local network address.

filippo_carletti · February 16, 2016, 11:20am

I think that this is a workaround going against the idea that vpn traffic should retain original ip addresses.
You’re hiding all ip addresses connected through vpn.
I’d prefer to discover why samba doesn’t answer to requests from the vpn and fix samba configuration.

craaaft · February 16, 2016, 12:24pm

I am using Windows 7 Client that connects through OpenVPN with Nethserver. The Nethserver is behind a router (Port 1194 is open). The VPN (routed mode) is established without a problem, but when I try to mount the shared folder I get the connection build up message but after a while it shows an error.

I didn’t change any of the config files - I just added the networks to the hosts and interfaces lines in smb.conf.

If you need more information don’t hestitate to ask.

Nas · February 16, 2016, 12:40pm

Try to make Bridged mode VPN.

Nas · February 16, 2016, 12:53pm

One month ago I tried to make samba works. Unfortunately, Samba did not work on TUN neither TAP.
I tried to remove

bind interfaces only = yes

with adding my local and VPN networks.

After @craaaft ask about the same things, i have found on GIT samba TAP library.
Maybe Samba package should be rebuilt with this library.

zamboni · February 16, 2016, 1:22pm

rebuilding pur own rpms is not an option