[resolved] File Sharing On DMZ

Abarai

Hello everyone,
I'm currently running pfsense 1.2.2 with the following network

LAN1 WAN1allowing
\ /
pfsense – DMZ
/
LAN2

I'm trying to access the various shared directories on my servers (running on XP Pro) on DMZ from LAN2 only (not from LAN 1). I tried allowing netbios through pfsense, but it doesn't work. I'm able to connect with remote desktop, but not file sharing. What are the exact steps to allow file sharing from LAN2 to DMZ?

Cry Havok

If you've allowed the right ports (more than one, some are UDP, some are TCP and some are both ISTR) through you should be fine. Unfortunately "doesn't work" doesn't tell us enough about what the problem is.

Abarai

Thanks for the quick Reply.
The shared directories are accessible from both servers on DMZ, but not from LAN2, which is why I ruled a file sharing configuration problem.
I created an alias with the following port: 135 through 139 and 445, and I created a rule from LAN2 to DMZ and DMZ to LAN2 allowing this alias on TCP and UDP.
Am I missing something else?

Cry Havok

Can you ping the hosts on the DMZ from the LAN? Are you using their NetBIOS name (which is broadcast and only works on the same subnet) or their DNS name or IP?

Abarai

I can successfully ping the host. I tried using both IP and DNS Name (this name is specified as a static host in my dhcp server).

Cry Havok

Time to drop Wireshark (or similar) on the DMZ server and check that you're getting the packets.

It may also be an issue with NAT, I'm not sure you can NAT SMB/CIFS.

Abarai

I'm trying wireshark right now. As for NAT, that could be a solution, but I'm not sure how to do it.

Abarai

From what I can understand of the log of wireshark, it seems the acknowledge doesn't work. Both in LAN2 and DMZ i have the following lines:

| Source | Destination | Protocol | Info |
| 192.168.3.25 | 192.168.4.9 | TCP | edm-stager > microsoft-ds [SYN] Seq=0 Win=65535 Len=0 MSS=1460 |
| 192.168.3.25 | 192.168.4.9 | TCP | edm-std-notify > netbios-ssn [SYN] Seq=0 Win=65535 Len=0 MSS=1460 |

I'm kind of lost now. What should I do?

danswartz

can you post your rules?

Abarai

Hello
Here are my rules.

On the DMZ:

On LAN2:

I use a number of Alias:

Internet, Internet_Securise, Mails and Mails_Secured group every port used to connect to the internet.
Managementports and managementpfsense group every port used to work on pfsense.
Filesharing is the specific alias created for filesharing, using the following: 135, 136, 137, 138, 139, 445

Abarai

Ok,
Resolved.
It was the windows Firewall on the aimed server. It should have been deactivated, but apparently was not (wonder why?).