SMB - Windows share over vlans
-
@solaris81 So return traffic shouldn't be a problem, unless you SMB server doesn't have a default gateway configured.
It's better to sniff as john suggested. -
@mcury said in SMB - Windows share over vlans:
@solaris81 Does that SMB server have two NICs?
It's possible that you don't have a return route to the correct NIC, packet could be going through your default route.The server points to its own gateway, the 10.0.0.1 address. Diff from LAN
-
@solaris81 So probably nothing related to return traffic.
Check if the packets from the other network are hitting the server, you should sniff as john suggested.
You could do it using tcpdump, wireshark, also pfsense packet capture to confirm if it's delivering the packets to the server. -
So here are 2 different examples...
First is me hitting a box where smb not running the 2.11 and it telling me to F off with RST..
Second is me accessing my nas via vpn connection and you can see the smb connecting..So lets see what you get when you try and connect.
-
I am using packet capture in pfsense and then opening it with wireshark. Is there a good way to filter within packet capture so I can get rid of all the other traffic?
-
In order to get real time capture, you could use tcpdump directly in pfsense cli.
tcpdump -i INTERFACE tcp and port 445 and host HOST_IPWhere, interface is the interface name you want to sniff, ifconfig lists all the interfaces.
HOST_IP would be the client IP, if you filter by the server IP, you would get a lot of stuff too.The filter "tcp and port 445 and host HOST_IP" could be modified as you wish, you can use OR instead of AND too.
Second method is to wireshark directly to the pfsense, but that would require ssh keys.
In case you want this method, just let me know and I will paste here a procedure for you. -
@mcury said in SMB - Windows share over vlans:
tcpdump -i INTERFACE tcp and port 445 and host HOST_IP
I did a capture capture from the 10.0.0.0/24 network where the Win system resides. Here are my findings. First attempted to connect to the Windows machine and then did a ping to show I am able to reach it.
Followed with another attempt to connect to the share.
-
Good, as we can see, your server never replied the SYN request from the client.
Can you set the capture now in the interface that has the IP 10.0.0.1 ?
Let's confirm if your pfsense is sending this SYN to the server. -
The capture was from the em1_vlan10 interface where the 10.0.0.1 exists. Are you talking about running a capture on the 10.0.0.51 interface/ Windows machine?
-
Yes, run in the server, or in pfsense interface connected to the server.
I presume those 10 networks are /27, /28 /29 right?A /26 or less would give you routing issues due to network overlap.
-
No, they are all /24. 10.0.0.0/24..... Where the Windows host lives and 10.0.3.0/24, is where my Android is.
The images above are taken from a capture on the 10.0.0.1 interface
-
Well then your server never answered at all, he didn't send a RST he just ignored your connection attempt that pfsense sent.. Not a pfsense problem..
BTW - good idea to send the pings inbetween!! That is very helpful in showing you can talk to the IP... But as you can see from the sniff, the sync is sent - just no answer.
-
@johnpoz said in SMB - Windows share over vlans:
Well then your server never answered at all, he didn't send a RST he just ignored your connection attempt that pfsense sent.. Not a pfsense problem..
BTW - good idea to send the pings inbetween!! That is very helpful in showing you can talk to the IP... But as you can see from the sniff, the sync is sent - just no answer.
So if the firewall is off, as well as other services, Defender and whatnot...Any idea why the machine would ignore the connection attempt? It works fine if both devices are in the same subnet
-
Your firewall or security software is not off like you think is the answer..
The only other logical step here to prove that to yourself, is sniff on .51 - does it see that smb syn? But just not answer.. Then something on the server 100% positive!!
Normally windows would send back RST if not listening.. So that you just don't get anything back points to firewall/security software for sure.
-
I just double checked the firewall on the Win box... Firewall was back on again...Not sure how it turned itself on... But I had double checked earlier. Once I disabled it, I was able to connect. Just need to set a rule that allows SMB-in from private network.
thanks for the help
-
No problem... glad you got it sorted... But from a sniff its real quick to figure out where the problem is.
-
@mcury said in SMB - Windows share over vlans:
Yes, run in the server, or in pfsense interface connected to the server.
I presume those 10 networks are /27, /28 /29 right?A /26 or less would give you routing issues due to network overlap.
Just realized that the networks are different, my mistake, disregard the quoted info.
Nice, good that is now working.
Even better, now you have more tools to troubleshoot problems in the future.
