Windows Share through OpenVPN

scolland

Hi all,

I am connecting from a Mac (Mavericks) using Viscosity connecting to my office through OpenVPN on pfsense.
I can connect through Remote Desktop to all clients on the local network and can access local web resources, but I cannot connect to the network shares (SMB).

It seems to find the shares - on OS X I connect to server SMB://192.168.0.4, I get a list of shares, choose one and get the authentication box, but no matter what credentials I use, I cannot successfully connect.

Using the latest pfsense (2.1.4)
Local (pfsense side) network is 192.168.0.X
VPN clients are assigned 192.168.2.X
Remote network (local to OS X) is 192.168.1.X
OpenVPN is set to TUN
IPv4 Tunnel network is set to 192.168.2.0/24
IPv4 Local Networks set to 192.168.0.0/24

Anyone any suggestions? I realise this may not be an OpenVPN issue and may relate to the Windows Server 2008 network share, but I can't find anything anywhere that would suggest how I fix it. Any ideas?

pisasalesgmbh

Do you use right credentials? ;)

e.g.

DOMAINNAME\username
"password"

or

username@DOMAINNAME
"password"

please test…

Regards,
David

scolland

Hi,

Yes I have tried all combinations, no domain, DOMAIN\ and @DOMAIN etc.

Nothing seems to authenticate.

mikeisfly

If there is no domain then your login would be \username .
Also make sure your firewall allows smb across different subnet or different networks for that matter.

johnpoz

Well I would look at the logs on the server to why you were denied or sniff the traffic to figure out what the server is sending back as deny reason, etc.

Are you using signed smb? smb3 ? What is the server - 2003, 2008, 2012 r2 not r2? etc.. Do window clients work?

scolland

Hi,

Thanks for your message. It is Windows Server 2008. I temporarily disabled the Windows Firewall all together to see if that helped, it did not.

I am not sure if there is something in pfsense I should be configuring? - I have a rule setup in Firewall Rules to forward everything from OpenVPN to LAN Net - is that correct?

How do I check if it is signed SMB or what version of SMB I am using?

Thanks in advance.

johnpoz

why would you have setup a "forward" You would not forward from you openvpn connection. You would allow the traffic on the firewall - but not a forward. A normally vpn connection into pfsense is like just another segment - just with a slower high latency connection.

http://support.microsoft.com/kb/2696547
How to enable and disable SMBv1, SMBv2, and SMBv3 in Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012

http://technet.microsoft.com/en-us/library/cc731957.aspx
Require SMB Security Signatures

A simple sniff on your client or on the server itself should give you some info to work with on why your auth is not working.

scolland

Thanks Johnpoz,

How do I sniff the traffic? - Client is OS X, router pfsense and server Server 2008?

Thanks

johnpoz

Well on 2k8 you could install wireshark. Same goes for your OS X client if does not have tcpdump or wireshark already installed. Or pfsense has the built in ability - I would sniff traffic on the interface that your 2k8 server is on. limiting traffic to just the 2k8 server IP.. Then try and auth, and then open the capture in wireshark.

Packet capture is under diag on pfsense web gui.

scolland

I have captured 13 packets going from 192.168.2.10 (VPN client) to 192.168.0.4 (Server) or vive versa, but I have no idea what they mean or how to use them to diagnose the issue.

What am I looking for?

Thanks

johnpoz

What does it show you for auth.. Send the capture to me and be happy to take a look. Email me and attach or email me or PM and will give you my personal email, etc.