BeGosV
This subject is covered in many posts along the internet but I still can't get it to work. I have the following setup:
Samba Client: Laptop "Quincy" on Windows 10, local LAN 192.168.178.100, VPN 10.8.0.50
OpenVPN Server: "Coleman" on Ubuntu 16.04, eth0 192.168.178.2, tun0 10.8.0.1
Samba Server: "Cannonball" on Ubuntu 16.04, eth0 192.168.1768.3
When I am inside the LAN everything works fine, but when I am outside the LAN I would like to access my Samba shares through the VPN but I am not able to do that. Windows reports that there is no access to \\192.168.178.3\user. Strangely enough when I try to connect from the laptop the following is logged in /var/log/samba/smbd.samba.log:
[2016/10/19 20:37:29.135523, 3] ../source3/lib/access.c:338(allow_access)
Allowed connection from 192.168.178.2 (192.168.178.2)
but /var/log/samba/quincy.samba.log reports:
[2016/10/19 20:37:46.116302, 3] ../source3/smbd/server_exit.c:252(exit_server_common)
Server exit (failed to receive smb request)
So my interpretation is that a request for access is received by the samba server from the windows client, but no actual samba request (e.g to browse or to access files) is received. More likely is that the samba client is not receiving the information from the server and therefore returns the access error.
So I tried almost everything what I could find in the forums and faqs for IP forwarding, firewall settings, etc. but still no solution was found.
Below you can find configuration files and stuff which can give more information.
I hope someone is able to help me with this. I am really at a loss with this one.
kind regards,
Berry
/etc/openvpn/server.conf on 192.168.178.2
#local a.b.c.d
port 1194
# TCP or UDP server?
;proto tcp
proto udp
;dev tap
dev tun
;dev-node MyTap
ca ca.crt
cert Coleman.crt
key Coleman.key # This file should be kept secret
dh dh2048.pem
;topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge
push "route 192.168.178.0 255.255.255.0"
;push "route 192.168.20.0 255.255.255.0"
push "dhcp-options DNS 10.8.0.1"
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8" ## Google DNS servers
push "dhcp-option DNS 8.8.8.4"
;client-to-client
;duplicate-cn
keepalive 10 120
tls-auth ta.key 0 # This file is secret
key-direction 0
;cipher BF-CBC # Blowfish (default)
cipher AES-128-CBC # AES
auth SHA256
;cipher DES-EDE3-CBC # Triple-DES
comp-lzo
;max-clients 100
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
;log openvpn.log
;log-append openvpn.log
verb 3
;mute 20
The UFW rules on 192.168.178.2
Naar Actie Van
---- ----- ---
OpenSSH ALLOW Anywhere
Postfix ALLOW Anywhere
Dovecot IMAP ALLOW Anywhere
Dovecot Secure IMAP ALLOW Anywhere
1194/udp ALLOW Anywhere
Apache ALLOW Anywhere
Apache Full ALLOW Anywhere
Apache Secure ALLOW Anywhere
8080 ALLOW Anywhere
1194 ALLOW Anywhere
139 ALLOW Anywhere
445/tcp ALLOW Anywhere
137/udp ALLOW Anywhere
138/udp ALLOW Anywhere
139/tcp ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
Postfix (v6) ALLOW Anywhere (v6)
Dovecot IMAP (v6) ALLOW Anywhere (v6)
Dovecot Secure IMAP (v6) ALLOW Anywhere (v6)
1194/udp (v6) ALLOW Anywhere (v6)
Apache (v6) ALLOW Anywhere (v6)
Apache Full (v6) ALLOW Anywhere (v6)
Apache Secure (v6) ALLOW Anywhere (v6)
8080 (v6) ALLOW Anywhere (v6)
445/tcp (v6) ALLOW Anywhere (v6)
137/udp (v6) ALLOW Anywhere (v6)
138/udp (v6) ALLOW Anywhere (v6)
139/tcp (v6) ALLOW Anywhere (v6)
/etc/samba/smb.conf on 192.168.178.3
[global]
netbios name = Cannonball
server string = Samba file server
domain master = yes
workgroup = BEGONET
security = user
hosts allow = 127. 192.168.178.
hosts deny = 192.168.178.20
interfaces = 127.0.0.1/8 192.168.178.0/24
remote announce = 192.168.178.255
remote browse sync = 192.168.178.255
log file = /var/log/samba/samba.log
max log size = 1000
encrypt passwords = true
unix password sync = yes
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
name resolve order = wins lmhosts bcast
wins support = yes
wins proxy = no
dns proxy = no
passdb backend = tdbsam
passwd program = /usr/bin/passwd '%u'
passwd chat = *New*password* %n\n *ReType*new*password* %n\n *passwd*changed*\n
add user script = /usr/sbin/useradd -d /dev/null -c 'Samba User Account' -s /dev/null '%u'
add user to group script = /usr/sbin/useradd -d /dev/null -c 'Samba User Account' -s /dev/null -g '%g' '%u'
add group script = /usr/sbin/groupadd '%g'
delete user script = /usr/sbin/userdel '%u'
delete user from group script = /usr/sbin/userdel '%u' '%g'
delete group script = /usr/sbin/groupdel '%g'
add machine script = /usr/sbin/useradd -d /dev/null -g sambamachines -c 'Samba Machine Account' -s /dev/null -M '%u'
machine password timeout = 120
template shell = /dev/null
smb ports = 139
[tmp]
comment = temporary files
path = /tmp
read only = yes
[printers]
comment = All Printers
browsable = yes
path = /var/spool/samba
printable = yes
guest ok = no
read only = yes
create mask = 0700
[print$]
comment = Printer Drivers
path = /var/lib/samba/printers
browsable = yes
read only = yes
guest ok = no
[Backups]
path = /home/Backups
writeable = yes
browseable = yes
valid users = berry
guest ok = no
No firewall is active on 192.168.178.3
