Can ping LAN hosts from VPN client, but cannot SMB browse?



  • I followed this guide to set up OpenVPN. Now, I can connect from the client and can ping our DNS servers and various LAN hosts. However, I cannot resolve hosts by DNS name, and I cannot access them via Windows Network share (\server\share).

    I noticed the OpenVPN adapter does not assign a default gateway. Am I doing something wrong?


  • LAYER 8 Global Moderator

    Well from that guide, your not handing out any dns - so how would your vpn clients be able to resolve anything?

    And you have netbios mode set to none - so not going to broadcast, if for example you were in bridge mode?  And you have netbios not even enabled.

    So for example I am currently connected to my home network via openvpn roadwarrior setup.  and I can resolve my fqdn of my hosts.

    And know you wouldn't have  default gateway on the vpn interface - here is mine

    Ethernet adapter ovpn:

    Connection-specific DNS Suffix  . : local.lan
           Description . . . . . . . . . . . : TAP-Win32 Adapter V9
           Physical Address. . . . . . . . . : 00-FF-79-1A-85-63
           Dhcp Enabled. . . . . . . . . . . : Yes
           Autoconfiguration Enabled . . . . : Yes
           IP Address. . . . . . . . . . . . : 10.0.200.6
           Subnet Mask . . . . . . . . . . . : 255.255.255.252
           Default Gateway . . . . . . . . . :
           DHCP Server . . . . . . . . . . . : 10.0.200.5
           DNS Servers . . . . . . . . . . . : 192.168.1.253
           Lease Obtained. . . . . . . . . . : Tuesday, July 17, 2012 1:56:01 PM
           Lease Expires . . . . . . . . . . : Wednesday, July 17, 2013 1:56:01 PM

    D:>ping i5-w7.local.lan

    Pinging i5-w7.local.lan [192.168.1.100] with 32 bytes of data:
    Reply from 192.168.1.100: bytes=32 time=147ms TTL=127

    And I can view it via \hostname once I auth for example

    D:>net view \i5-w7
    System error 5 has occurred.

    Access is denied.

    D:>net use \i5-w7\ipc$ /u:budman
    The password or user name is invalid for \i5-w7\ipc$.

    Enter the password for 'budman' to connect to 'i5-w7':
    The command completed successfully.

    D:>net view \i5-w7
    Shared resources at \i5-w7

    Share name   Type   Used as  Comment

    –----------------------------------------------------------------------------
    Deskjet6500  Print           HP Deskjet 6500 Series
    test         Disk
    The command completed successfully.

    here is what I see different in my openvpn config.




  • Hi Johnpoz, thanks for the very helpful reply.

    Using your suggestions, I made the following changes:

    • Added our DNS servers to the configuration (in the PFSense GUI)
    • Enabled NetBIOS support, h-node

    This seemed to partially solve the problem. I can now ping LAN hosts by their hostnames. However, I still cannot browse to any SMB/Samba shares, and a few select hosts will not resolve.

    
    C:\> ping BigServer
    
    Pinging BigServer.internal [172.16.1.5] with 32 bytes of data:
    Reply from 172.16.1.5: bytes=32 time=11ms TTL=63
    Reply from 172.16.1.5: bytes=32 time=13ms TTL=63
    
    Ping statistics for 172.16.1.5:
        Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 11ms, Maximum = 13ms, Average = 12ms
    Control-C
    
    C:\> net use \\BigServer\images
    System error 67 has occurred.
    
    The network name cannot be found.
    
    

    What am I missing here? The firewall is turned off on both BigServer and the Windows 7 client. Here is a screenshot of the config page:




  • This is just a self-answer in case anyone Google's this and has the same issue.

    I can now access everything normally. It turns out one of our Linux servers had a rule in the /etc/samba/smb.conf file that was blocking access from the VPN subnet (172.16.3.x). After I added the exception everything started working fine.

    Thanks again for your help.


  • LAYER 8 Global Moderator

    Great - just so you know, does not have to be h-node, you could set that to meet your resolution needs.  H is just hybrid will check wins first if one set, then broadcast.

    If you don't have any plans for wins, etc then you could just set it to B-node for broadcast only, etc.


Log in to reply