Make Samba shares auto appear when connected to VPN

flexmcmurphy

Hello,

Client: OpenVPN GUI v2.5 on Windows 7
Server: OpenVPN 2.4 running on a Raspberry Pi at my home.

I got OpenVPN server working using this install script from GitHub. I'm slowly understanding how to use it, what it can do and cannot.

I have several Raspberry Pis around the house and each one has Samba on it and is sharing out Samba shares. When I am at home and not connected to the VPN I can see a list of these Raspberry Pis with their hostnames (or Netbios names) listed under the "Network" list in the left column of Windows File Explorer.

When I connect to the VPN however that list of hosts disappears from the Windows File Explorer Network list. I am able to get access to those Samba shares using Map Network Drives. When I do that the share appears under the "Computer" label in File Explorer along with my C: and D: drive etc.

But is it possible to configure my VPN so when connected to it the list of other hosts on my LAN stays there under the "Network" label in the File Explorer Window so I can just keep using them?

Do I need to make a config setting in /etc/samba/smb.conf and make Netbios work over the VPN or something like that?

All the Raspberry Pis on my home LAN have ip addresses: 192.168.1.X
I have got this line in my server.conf

push "route 192.168.1.0 255.255.255.0"

There are more instructions here: "Including multiple machines on the server side when using a routed VPN (dev tun)" however I don't know how to

"...set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server"

My OpenVPN is running on a Pi that is attached to my ISP Modem/Router. I suppose this is the server-side LAN gateway? It is a closed device I could not install iptables rules on. I have enabled IP forwarding on the Pi running OpenVPN but I don't know how to enable TUN/TAP forwarding?

local 192.168.1.124
port 1194
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 1.0.0.1"
# This line: push "route 192.168.1.0 255.255.255.0" was added in the hopes that
# it would make Samba shares on the Home LAN appear in the Network section of
# Windows File Explorer. It did NOT do that... I can still Map to Network drive
# them which I always could anyway so you could really just delete this line!
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
crl-verify crl.pem
# Enable Logging
verb 4
status openvpn-status.log
log-append /etc/openvpn/server/openvpn.log

client
dev tun
proto tcp-client
remote mydomain.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
ignore-unknown-option block-outside-dns
block-outside-dns
verb 4
#log-append openvpn-client.log
#machine-readable-output

<ca>
--STRIPPED--
</ca>
<cert>
--STRIPPED--
</cert>
<key>
-----BEGIN PRIVATE KEY-----
--STRIPPED--
-----END PRIVATE KEY-----
</key>
<tls-crypt>
-----BEGIN OpenVPN Static key V1-----
--STRIPPED--
-----END OpenVPN Static key V1-----
</tls-crypt>

Cheers,

Flex

TinCanTech

flexmcmurphy wrote is it possible to configure my VPN so when connected to it the list of other hosts on my LAN stays there under the "Network" label in the File Explorer Window

This is dependent on Windows Networking which does not work over a tunnel without help.

https://community.openvpn.net/openvpn/wiki/WindowsBrowsing

300000

TinCanTech wrote
flexmcmurphy wrote is it possible to configure my VPN so when connected to it the list of other hosts on my LAN stays there under the "Network" label in the File Explorer Window
This is dependent on Windows Networking which does not work over a tunnel without help.

https://community.openvpn.net/openvpn/wiki/WindowsBrowsing

it not depent on windows or linux to make it appear on windows networking , basic samba or window file sharing running on non routing protocol so when you connect it over vpn it will never appear over file explorer but if you config it correct you can use to connect to file sharing folder

on the windows pc click on my computer and right click mouse so you can "add network location" and add your share that will have icon so you dont need type it it will appear auto every time

TinCanTech

flexmcmurphy wrote Client: OpenVPN GUI v2.5 on Windows 7
When I am at home and not connected to the VPN I can see a list of these Raspberry Pis with their hostnames (or Netbios names) listed under the "Network" list in the left column of Windows File Explorer.

300000 wrote it not depent on windows or linux to make it appear on windows networking

This is explicitly dependent on Windows networking.

flexmcmurphy

@300000
Are you talking about "Map Network Drive" and ticking the box to "reconnect at logon"? IF so.. yes I can do that and that makes the shares appear under "Computer" in File Explorer. In fact I can also type in \\ip-address to the address bar and that makes the machine/Pi appear under Network but I don't want to have to do it that way. I want the Raspberry Pis on my home LAN to appear as Computers in the Network list of Windows File Explorer just as they always do when I'm not connected to the VPN.

@TinCanTech
I tried setting up WINS. I added...

wins support = yes

To smb.conf on the Pi running OpenVPN
This Pi has local ip = 192.168.1.124

I added...

wins server = 192.168.1.124

To the smb.conf files on all the other Pis on the LAN

I also added that ip addr to the WINS tab in ipv4 section of my laptops Wireless Network adapter (not sure if I need to do that to the OpenVPN TAP Adapter as well?

I restarted Samba on all the Pis and now I reconnect to the VPN and still those Pis aren't appearing in Network on the Win 7 client when I connect to the VPN. Actually I also lost internet access! I had to disconnect from the VPN and undo the WINS server IP addition to the Network adapter to get internet back so I could post this..

Any suggestions to try wrt WINS? Or would this be easier to do with dnsmasq? I also have dnsmasq running on the same Pi OpenVPN server is on.

Thank you,

Flex

300000

I want the Raspberry Pis on my home LAN to appear as Computers in the Network list of Windows File Explorer just as they always do when I'm not connected to the VPN.

let say what I wrote , samba and windows file sharing using non routing protocol it mean it cant go from one subnet to other subnet so nobody ever can do that for you if you want to know , if you want that only inside your network can do vpn cant do that.

flexmcmurphy

@TinCanTech (input from others very welcome)

Can I confirm that post from @300000 please?

On my home LAN there are several computers each with Samba shares. When I am connected to that LAN they all appear automatically in my Windows Network Neighbourhood. I want that to also happen when connected to the VPN.

I did some reading and understand this is due to the NBNS and BROWSER packets, generated by Samba nmbd server, that are sent around the network and my Windows laptop client detects and uses to create an auto-populated network neighbourhood so I don't have to map a network drive to access shares on other computers on my LAN. But I also read that you can replace that host discovery and browsing function with the alternative Web Services Discovery (wsdd) which I tried out and it also auto populates my Win7 Network Neighbourhood with machines on my LAN even with Netbios switched off.

I followed the advice you sent me in above link: Windows Browsing and Shares. I have dnsmasq on my LAN and entered mappings for hostnames of local machines. I pushed that dns server over OpenVPN to the client as well explained here and here. Now when connected to the OpenVPN I can access hosts and shares from the explorer address bar like: \\hostname\share or just \\hostname and can also map network drives by hostname.

I didn't need to follow the instructions in Including multiple machines on the server side when using a routed VPN (dev tun) other than enabling IP forwarding on the OpenVPN server machine. I didn't understand how to enable TUN/TAP forwarding or how to set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server.. on my home LAN the OpenVPN server and the LAN gateway (my ISP router) are different machines.

However the Network Neighbourhood of my Win7 client is still not being auto-populated with hosts on my home LAN when connected over OpenVPN.

Is this just not possible then, over a routed OpenVPN? Only option would be to use a bridged VPN? Could you also please suggest how to complete those steps above that I didn't understand? (enabling Tun/Tap forwarding and setting up a route on the server-side LAN gateway..)

Sorry for this long post. I've spent days and days on this and I really want to understand it.

Thank you,

Flex

300000

if you want to network appear Network Neighbourhood so you need tap not tun and Network Neighbourhood need broadcast to make it work, so see what i wrote , it will never do that over vpn , it is underline how networking work so basic you have no choise to use map network or dont use it

push down dns not make it word anyway so dont try to chase that way , it is best for you try to tab so Network Neighbourhood may be work for you.

if you want to learn on networking so internet is full of lesson to learn

if you try co config minidlna on raspberry , minidlna only work on lan but not over vpn either

flexmcmurphy

Thanks @300000.

I think the support and instructions for OpenVPN could be geared with a little more verbosity to those who have less knowledge and experience than a network admin but who are nonetheless keen to learn.

As to my other unanswered questions about expanding the scope of the VPN, I still don't know what it means:

"to enable TUN/TAP forwarding"

The GitHub script I used to install OpenVPN on a linux OS has these iptables rules..

/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 192.168.1.124
/sbin/iptables -I INPUT -p tcp --dport 1194 -j ACCEPT
/sbin/iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
/sbin/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

Maybe rule 2-4 is enabling TUN/TAP forwarding?

Regarding the instruction:

"to set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server"

I think this is partly explained in this SuperUser thread

"If the LAN router absolutely doesn't support static route configuration, a common alternative is to enable SNAT on the OpenVPN server's firewall – make it masquerade all packets from VPN clients as if they were actually from 192.168.2.10 (the VPN server itself).

This will allow LAN hosts to reply back (because they think they're replying to another local LAN device)"

Basically, when a VPN client aims traffic at hosts on a remote LAN (other than the OpenVPN server that is also on that LAN) the traffic will appear to come from another device on the LAN so you need to give those packets a way to get back to the VPN client that sent them because it will have an ip address in the VPN subnet. At least that is my limited understanding.

The GitHub script I used to install OpenVPN uses a different approach to achieve the same aim, see around line 371. It's an alternative when you cannot put a static route in the "LAN gateway" (presumably your router?)

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 192.168.1.124

This only applies where the OpenVPN server is installed on a Linux machine with iptables firewall. 10.8.0.0/24 is the VPN subnet and 192.168.1.124 is the LAN local ip address of the machine that OpenVPN server is running on.

Cheers,

Flex

TinCanTech

Windows Browser does not work over a VPN tunnel OSI-L3, simple as that.

You need one of the solutions I posted above.

300000

As to my other unanswered questions about expanding the scope of the VPN, I still don't know what it means:

this is for site to site connection if you want to know this part of manual and there is nothing in here say you can make it work as windows file appear on file explore

"to enable TUN/TAP forwarding"

if not enable tun/tap how it work anyway?

/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to 192.168.1.124
/sbin/iptables -I INPUT -p tcp --dport 1194 -j ACCEPT
/sbin/iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
/sbin/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

all iptabpe in here do one thing making NAT and open iptable so can accept income connection from port 1194, without this rule when you make a openvpn connection you can only ping the virtual ip address op server and that is a lot question on here with ask why i cant go to internet and ping anything as expect

Basically, when a VPN client aims traffic at hosts on a remote LAN (other than the OpenVPN server that is also on that LAN) the traffic will appear to come from another device on the LAN so you need to give those packets a way to get back to the VPN client that sent them because it will have an ip address in the VPN subnet. At least that is my limited understanding.

The GitHub script I used to install OpenVPN uses a different approach to achieve the same aim, see around line 371. It's an alternative when you cannot put a static route in the "LAN gateway" (presumably your router?)

this part explain how site to site work when client connect to a router which dont support setting static route but the requirement all client on that lan can connect to client on openvpn server so everything must go thought openvpn client . it mean the openvpn client computer act as router to all lan side to connect to openvpn server.

all of above example you give nothing to do with making network appear over vpn so you are looking wrong way . you are making client to site connection so you are not making the same as you thing on that situation.

only making tap work for you , but when making tap and your speed slow down dont came back here to ask , that is nature of tap connection and the more computer add on that network the more slow down speed it will.

flexmcmurphy

@300000

I know that "my other unanswered questions" had nothing to do with making samba shares and other hosts on the remote lan appear automatically in a connecting clients Network Neighbourhood. I was just asking about those things out of interest to understand more clearly how OpenVPN is supposed to be set up as a routed VPN. I didn't get any clarification though.

I don't think the OpenVPN documentation about expanding the scope of a routed VPN is well explained for a beginner audience. Just a few statements only a network admin would understand and very little details or background explanation. There should be fully worked out example set ups with all code and config files included and every single line explained. In contrast, making a bridged VPN with OpenVPN is far better explained although it seems most people should never use bridged VPNs in the first place. They are slow, less secure and usually not needed.

People like me are using Github scripts to get OpenVPN working and have no idea what they are doing. I think OpenVPN could do a better job of making beginners guides where everything is explained in painstaking detail like in one of those o'Reillys books. An "Idiots Guide to OpenVPN" would be ideal.

Thank you @300000 and @TinCanTech both for your help.

Flex