Can ping LAN hosts from VPN client, but cannot SMB browse?

HaburGate · Jul 17, 2012, 6:43 PM

I followed this guide to set up OpenVPN. Now, I can connect from the client and can ping our DNS servers and various LAN hosts. However, I cannot resolve hosts by DNS name, and I cannot access them via Windows Network share (\server\share).

I noticed the OpenVPN adapter does not assign a default gateway. Am I doing something wrong?

johnpoz · Jul 17, 2012, 6:57 PM

Well from that guide, your not handing out any dns - so how would your vpn clients be able to resolve anything?

And you have netbios mode set to none - so not going to broadcast, if for example you were in bridge mode? And you have netbios not even enabled.

So for example I am currently connected to my home network via openvpn roadwarrior setup. and I can resolve my fqdn of my hosts.

And know you wouldn't have default gateway on the vpn interface - here is mine

Ethernet adapter ovpn:

Connection-specific DNS Suffix . : local.lan
Description . . . . . . . . . . . : TAP-Win32 Adapter V9
Physical Address. . . . . . . . . : 00-FF-79-1A-85-63
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 10.0.200.6
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 10.0.200.5
DNS Servers . . . . . . . . . . . : 192.168.1.253
Lease Obtained. . . . . . . . . . : Tuesday, July 17, 2012 1:56:01 PM
Lease Expires . . . . . . . . . . : Wednesday, July 17, 2013 1:56:01 PM

D:>ping i5-w7.local.lan

Pinging i5-w7.local.lan [192.168.1.100] with 32 bytes of data:
Reply from 192.168.1.100: bytes=32 time=147ms TTL=127

And I can view it via \hostname once I auth for example

D:>net view \i5-w7
System error 5 has occurred.

Access is denied.

D:>net use \i5-w7\ipc$ /u:budman
The password or user name is invalid for \i5-w7\ipc$.

Enter the password for 'budman' to connect to 'i5-w7':
The command completed successfully.

D:>net view \i5-w7
Shared resources at \i5-w7

Share name Type Used as Comment

–----------------------------------------------------------------------------
Deskjet6500 Print HP Deskjet 6500 Series
test Disk
The command completed successfully.

here is what I see different in my openvpn config.

HaburGate · Jul 17, 2012, 8:36 PM

Hi Johnpoz, thanks for the very helpful reply.

Using your suggestions, I made the following changes:

Added our DNS servers to the configuration (in the PFSense GUI)
Enabled NetBIOS support, h-node

This seemed to partially solve the problem. I can now ping LAN hosts by their hostnames. However, I still cannot browse to any SMB/Samba shares, and a few select hosts will not resolve.


C:\> ping BigServer

Pinging BigServer.internal [172.16.1.5] with 32 bytes of data:
Reply from 172.16.1.5: bytes=32 time=11ms TTL=63
Reply from 172.16.1.5: bytes=32 time=13ms TTL=63

Ping statistics for 172.16.1.5:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 11ms, Maximum = 13ms, Average = 12ms
Control-C

C:\> net use \\BigServer\images
System error 67 has occurred.

The network name cannot be found.

What am I missing here? The firewall is turned off on both BigServer and the Windows 7 client. Here is a screenshot of the config page:

HaburGate · Jul 17, 2012, 9:48 PM

This is just a self-answer in case anyone Google's this and has the same issue.

I can now access everything normally. It turns out one of our Linux servers had a rule in the /etc/samba/smb.conf file that was blocking access from the VPN subnet (172.16.3.x). After I added the exception everything started working fine.

Thanks again for your help.

johnpoz · Jul 18, 2012, 12:27 PM

Great - just so you know, does not have to be h-node, you could set that to meet your resolution needs. H is just hybrid will check wins first if one set, then broadcast.

If you don't have any plans for wins, etc then you could just set it to B-node for broadcast only, etc.