OpenVPN <-> Samba [Problem]

clemenlg

Hi,
I have one problem with my latest vpn configuration.
VPN works ok, but i can't see the computers/printers in the virtualized lan. I can access by IP, but not by wins.
I follow the OpenVPN HOWTO unsuccessfully.
I read the threads about it, as this one, but I can't solve my problem.
My scenario:
I have one lan: 1.1.1.0/255.255.255.0 (router: 1.1.1.254) and a GNU/Linux (Debian) that works as VPN server (OpenVPN) and works with samba, with 1.1.1.250.
In this machine I can see all the machines with:

smbtree -l

My config is:
server.conf:

[...]
port 1194
proto tcp
dev tun
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/server.crt
key easy-rsa/keys/server.key
dh easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 1.1.1.0 255.255.255.0"
push "dhcp-option DNS 1.1.1.254"
push "dhcp-option WINS 1.1.1.250"
keepalive 10 120
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
[...]

smb.conf:

[...]
workgroup = GRUPTEST
server string = %h server
domain master = yes
local master = yes
preferred master = yes
os level = 35
wins support = yes
wins server = 1.1.1.250
hosts allow = 1.1.1.0/24 10.8.0.0/24 127.0.0.1
name resolve order = wins lmhosts host bcast
dns proxy = no
interfaces = 1.1.1.0/24 10.8.0.0/24
[...]

I can't do it.
Regards

P.S.: Sorry for my english :S

brendan

i think you need to add a directive to you server config.

push "redirect-gateway ..."

you will need to see what is needed in your environment. i have had to use

push "redirect-gateway def1"

clemenlg

brendan wrotei think you need to add a directive to you server config.

push "redirect-gateway ..."

you will need to see what is needed in your environment. i have had to use

push "redirect-gateway def1"

Thanks for your reply brendan, but it didn't work, i try:

push "redirect-gateway def1"

push "redirect-gateway def1 bypass-dhcp"

I can access by IP, but nor by name (wins) :S

brendan

i think wins requires TUN, which you have. are there any iptables policies in the way? can you do a tcpdump on the openvpn box and see the wins traffic come across the vpn? can you do a tcpdump on the client or maybe use wireshark to get a packet capture? also, not sure if you have it set but dont allow split tunnelling to make sure all traffic is being routed through the vpn tunnel.

clemenlg

brendan wrotei think wins requires TUN, which you have. are there any iptables policies in the way? can you do a tcpdump on the openvpn box and see the wins traffic come across the vpn? can you do a tcpdump on the client or maybe use wireshark to get a packet capture? also, not sure if you have it set but dont allow split tunnelling to make sure all traffic is being routed through the vpn tunnel.

Hi, with wireshack ican see the NAME QUERY NB to the servername (netbios), and in the OpenVPN/Samba machine i can see:

17:55:02.382692 IP 10.8.0.6.netbios-ns > 10.8.0.1.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
17:55:03.883219 IP 10.8.0.6.netbios-ns > 10.8.0.1.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
17:55:05.385551 IP 10.8.0.6.netbios-ns > 10.8.0.1.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; UNICAST

10.8.0.6 is the Windows machine (OpenVPN client)
10.8.0.1 is the GNU/Linux machine (OpenVPN & Samba server)

I can resolv by IP but not by netbios name... :S

P.S.: I use TUN (tun0)

Regards

clemenlg

I solved the issue, the problem was that i didn't put the WINS server into the default section.
Thanks

brendan

do you mean wins proxy and wins support (or other) directives were missing from your smb.conf? what default section are you referring to?

clemenlg

brendan wrotedo you mean wins proxy and wins support (or other) directives were missing from your smb.conf? what default section are you referring to?

Hi, sorry, in [global] section, in smb.conf:

server.conf

push "route 1.1.1.0 255.255.255.0"
push "dhcp-option DNS 10.8.0.1"
push "dhcp-option WINS 10.8.0.1"

smb.conf:

[global]
domain master = yes
local master = yes
preferred master = yes
os level = 35
wins support = yes
wins server = 1.1.1.250
hosts allow = 1.1.1.0/24 10.8.0.0/24 127.0.0.1
name resolve order = wins lmhosts host bcast
dns proxy = yes
interfaces = 1.1.1.0/24 10.8.0.0/24
...
workgroup = GROUPTEST
...

brendan

good to see that you got it working. do you use SWAT to manage your samba instance? its the Samba Web Admin Tool. i find it to be helpful in a lot of ways and makes managing samba a bit easier.

clemenlg

brendan wrotegood to see that you got it working. do you use SWAT to manage your samba instance? its the Samba Web Admin Tool. i find it to be helpful in a lot of ways and makes managing samba a bit easier.

Ok, thanks.

valentinomoscow

Hi.

Sorry for being too late, 3 years already passed. But it's an actual problem for me now 😉

I didn't understand what an author changed in config file. You say changes in smb.conf WINS server string, but the first config you showed before is the same!
Besides you don't need that "WINS server =" string, because you use "WINS support = yes" string, which means you run WINS server on that device!!!
I see only changes in server.conf file. You changed ip addresses from 1.1.1.250 to 10.8.0.1 and DNS service now shows to your VPN server, not router as before.

Please, tell, what exactly did you change? If you remember anything from that time 🙂