Make Remote Windows Server appear to be on LAN
-
I have an unusal tunneling requirement that I need some help with.
Network setup:
Raspberry Pi [eth0 - 10.0.9.10/24][eth0:1 - 10.0.9.150/24][Openvpn tun0 - 10.0.100.2/30|---<WAN>---| pfSense [WAN - 10.0.9.91][Openvpn tun0 - 10.0.100.1/30][LAN - 10.0.8.8/24] |---<LAN>---| Windows Server [eth0 - 10.0.8.250/24]
I want the 'Windows Server' to appear to be on the same LAN as the Raspberry Pi so that all services on the Windows Server are available to LAN users as if the server was locally connected.
Note:Openvpn is bound to 10.0.9.10. I have configured a Virtual IP [eth0:1] so that the Raspberry Pi can be managed via SSH even if all traffic is forwarded on eth0.
What currently works is that the Windows Server is accessible from the Raspberry Pi on 10.0.8.250.
I have set up a NAT rule on pfSense to forward all traffic arriving on 10.0.100.1 (the Openvpn gateway on pfSense) to 10.0.8.250 (the windows server) but when I nmap the gateway address I'm not seeing the Windows share ports open, only the pfSense ports (22,80,443)
How can I setup forwarding from the Pi to the server? Is this approach (Openvpn tun) valid or do I need to move to a tap/bridge to get what I want?
Pointers to existing recipes gratefully received.
-
Normally, Windows uses broadcasts to announce it services on the local LAN. Broadcasts don't normally pass thorugh routers. For devices off the local LAN, you need to directly map the server. The alternative is to use a directory server, such as Active Directory, which you then log into.
-
Use a TAP connection if you need it to be broadcast discoverable.
That will introduce delays on the subnet though. That is usually not an issue but it depends what traffic you have there.
Steve
-
@stephenw10 OK, I'll set it up again, this time with a tap connection. I'll report back with results. Thank you
-
Not sure what broadcast discoverable be it netbios via smbv1 (being phased out finally by ms) or say a multicast type WSD has to do with services being available.
Make sure you have no firewall rules blocking and users on your lan can access this server on any port they want via simple FQDN or IP..
What specific service are you trying to access that you feel is not working unless on the same Layer 2?
-
@johnpoz
Yeah I somewhat plucked some words out of the air there to imply 'on the same layer 2'.
I would have thought you could have this work using different subnets but I don't do Windows if I can help it.
Either way the TAP setup will put those things on the same layer 2 if that's the only way to make it work.
Steve
-
I have had to use windows since the beginning.. And just at a loss to what service(s) would require that your server and client be on the same layer 2. Pretty impossible for enterprise to even function if that was the case..
Other than the completely pointless network neighborhood nonsense..
-
@stephenw10 said in Make Remote Windows Server appear to be on LAN:
Yeah I somewhat plucked some words out of the air there to imply ‘on the same layer 2’.
I would have thought you could have this work using different subnets but I don’t do Windows if I can help itDifferent subnets implies different layer 2. To be on the same layer 2, there can't be any routers in between.
-
Yes. I expect this to work at layer 3 with different subnets, OpenVPN in TUN mode. But if Windows isn't playing ball for whatever reason using TAP mode with one subnet should work.
Steve
-
And what I am saying is there is NO services on a windows box that requires the client to be on the same layer 2 other then stupid network neighborhood which is nothing more than stupid eye candy that serves zero purpose in doing anything other than seeing a computer name in a list.
Unless the user is running some service on the server, that would require this there is zero reason to use tap to make the server look like its on the same network. Not from a windows service point of view.
My guess is not adjusting the server firewall to allow the access from different network could be their problem? For example windows firewall will not answer ping if not on same network, or file sharing, etc.
-
More info needed @OP
What exactly are you trying to make work that is not working across subnets?Not really a pfSense question at this point.
Steve
