Workgroup browsing not working (WXP client, Linux server)

catkin

Hello 🙂

This may not be possible (netsearching results are contradictory) but it would be nice for the WXP client users to be able to browse Samba shares on the same server as OpenVPN via My Network Places -> Entire Network -> Microsoft Windows Network -> <workgroup name>.

What is working:

C:\Documents and Settings\Administrator>net view \\10.8.0.1\
Shared resources at \\10.8.0.1\
Samba 3.5.6
Share name        Type  Used as  Comment
-------------------------------------------------------------------------------
Anbu-system       Disk
[snip more shares]

Mapping a share via Windows explorer as \\10.8.0.1\<share name>

What is not working: My Network Places -> Entire Network -> Microsoft Windows Network -> <workgroup name>. No error but nothing listed (the WXP client has no non-administrative shares).

Analysis:

C:\Documents and Settings\Administrator>browstat status

Status for domain ACUR on transport \Device\NetBT_Tcpip_{3B8F088D-0CE7-4994-ABB9-D6E3DBE70D5B}
    Browsing is active on domain.
    Master browser name is: CW8VWXPV
        Master browser is running build 2600
    1 backup servers retrieved from master CW8VWXPV
        \\CW8VWXPV
    There are 1 servers in domain ACUR on transport \Device\NetBT_Tcpip_{3B8F088D-0CE7-4994-ABB9-D6E3DBE70D5B}
    There are 1 domains in domain ACUR on transport \Device\NetBT_Tcpip_{3B8F088D-0CE7-4994-ABB9-D6E3DBE70D5B}

Status for domain ACUR on transport \Device\NetBT_Tcpip_{412D62EA-B6B7-4BEA-876C-B0C199471BB5}
    Browsing is active on domain.
    Master browser name is: CW8VWXPV
        Master browser is running build 2600
    1 backup servers retrieved from master CW8VWXPV
        \\CW8VWXPV
    There are 1 servers in domain ACUR on transport \Device\NetBT_Tcpip_{412D62EA-B6B7-4BEA-876C-B0C199471BB5}
    There are 1 domains in domain ACUR on transport \Device\NetBT_Tcpip_{412D62EA-B6B7-4BEA-876C-B0C199471BB5}

So it looks like the WXP client's browser service has not found the browser running on the server ... ?

Attempts to get it working:

Added two lines to OpenVPN server config:

push "dhcp-option WINS 10.8.0.1"
push "dhcp-option NBT 2"

Added two lines to Samba config file:

local master = yes
wins support = yes

For testing purposes the WXP firewall is off and there are no IPTABLES. Both the WXP client and the Samba server use the same workgroup.

The client configuration file:

client
dev tun
proto udp
remote <IP address hidden> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca <server name hidden>.ca.crt
cert <client name hidden>.crt
key <client name hidden>.key
ns-cert-type server
comp-lzo
verb 3

The server configuration file:

port 1194
proto udp
mssfix 1400
dev tun
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/server.crt
key easy-rsa/keys/server.key
dh easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option WINS 10.8.0.1"
push "dhcp-option NBT 2"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
management localhost 7505

The Samba configuration (canonicalised by testparm; presumably local master = yes is a default so removed by testparm):

[global]
	workgroup = ACUR
	security = SHARE
	wins support = Yes
	guest only = Yes
[Anbu-system]
	path = /srv/rsync/Anbu-system
	guest ok = Yes
[snip similar shares]

Client versions: WXP Pro SP2 in VirtualBox VM running OpenVPN 2.2.0
Server versions: Debian 6 Squeeze 64-bit running OpenVPN 2.1.3 and Samba 2:3.5.6

Best

Charles

Mimiko

Hi.

Yes. In general it's possible. But first you must understan that seeng computers in My Network is not WINS server's job. WINS server just responses to clients about IP of some computer name, like DNS. By in order for windows to display computers in My Network window system must scan the LAN with a broadcasting packet.

Makeing your samba WINS server is not for this scope. First, do the computers on that server's LAN see it on browsing to My Network page? In generela client must send broadcast packet to tun adapter, but I'm not sure. For this type of acting, server must be configured in bridge mode, which will forward all broadcasting packets thru the tunnel. But firstly see that your samba server appears on windows systems from samba's lan without VPN.

catkin

Hello Mimiko 🙂

Thanks -- and so quickly again!

Understood about WINS being a name-to-IP resolver and changing to bridged mode.

Yes -- Windows computers on the LAN can browse the shares on the Samba server.

For security, I don't want OpenVPN clients to be able to see anything on the LAN except the server, though -- access controls are too lax. It's late now so I'm not going to research whether/how the OpenVPN server can be configured for that until tomorrow.

Thanks again, Best

Charles

janjust

it is NOT necessary to switch to bridged mode for this - you can make this work in 'tun' mode just fine.
Make sure that samba is listening on the tun interface and make sure you do a 'remote announce' of the workgroup name to the VPN subnet.

Use 'nbtstat' on the WXP client to see if WINS name resolution is working, then try explorer again.

catkin

Thanks janjust 🙂

I would like to stay with tun if possible and have been trying as you suggested but have not got it working yet. What to do? If not to fix, how to investigate further?

The test environment is two VirtualBox VMs in a single host (CW8).

Server CW8vDS:

Debian 6 Squeeze 64-bit
Single NIC as eth0 (192.168.168.51/24) and eth0:1 (192.168.3.51/24)

OpenVPN 2.1.3 currently with

port 1194
proto udp
mssfix 1400
dev tun
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/server.crt
key easy-rsa/keys/server.key
dh easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option WINS 10.8.0.1"
push "dhcp-option NBT 2"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3

Samba 2:3.5.6 currently with:

[global]
	bind interfaces only = yes
	client lanman auth = Yes
	domain master = yes
	guest only = Yes
	hosts allow = 192.168.3.0/24 10.8.0.0/24 127.0.0.1
#	interfaces = eth0:0 lo tun0
	interfaces = 192.168.3.0/24 10.8.0.0/24 127.0.0.0/24
	lanman auth = Yes
	remote browse sync = 10.8.0.255
	remote announce = 10.8.0.255/ACUR
	security = SHARE
	wins support = Yes
	workgroup = ACUR

Client CW8vWPv:

WXP Pro SP2
Single NIC as 192.168.168.8/24 with default NetBIOS setting (accept from DHCP server or default to NBT)

OpenVPN 2.2.0 currently with:

client
dev tun
proto udp
remote 192.168.168.51 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca CW8vDS.ca.crt
cert Charles.CW8vDS.crt
key Charles.CW8vDS.key
ns-cert-type server
comp-lzo
verb 3

Before starting the attempts, Samba was listening on all interfaces and the client was able to browse the workgroup ACUR which included the server. After reconfiguring Samba so it was not listening on the client's network 192.168.168.0/24 and restarting the client the server was not listed; OK.

On the client, after connecting OpenVPN, the server is still not listed in workgroup ACUR and output from nbtstat -n lists only the client. Shares cannot now be mapped in Windows Explorer, even when the lanman lines are taken out of smb.conf and Samba restarted.

On the server, all looks well in /var/log/daemon.log -- no signs of trouble.

Best

Charles

Mimiko

After connecting the client could you see the node type you have on your cient:

reg query hklm\system\currentcontrolset\services\netbt\parameters

catkin

Thanks Mimiko 🙂

Here it is, after OpenVPN connection, showing type 2 AIUI:

C:\Documents and Settings\Administrator>reg query hklm\system\currentcontrolset\services\netbt\parameters

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\netbt\parameters
    NbProvider  REG_SZ  _tcp
    NameServerPort      REG_DWORD       0x89
    CacheTimeout        REG_DWORD       0x927c0
    BcastNameQueryCount REG_DWORD       0x3
    BcastQueryTimeout   REG_DWORD       0x2ee
    NameSrvQueryCount   REG_DWORD       0x3
    NameSrvQueryTimeout REG_DWORD       0x5dc
    Size/Small/Medium/Large     REG_DWORD       0x1
    SessionKeepAlive    REG_DWORD       0x36ee80
    TransportBindName   REG_SZ  \Device\
    EnableLMHOSTS       REG_DWORD       0x0
    DhcpNodeType        REG_DWORD       0x2

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\netbt\parameters\Interfaces

Mimiko

Try setting DhcpNodeType to 0x8, restart client and try again.

catkin

Thanks Mimiko 🙂

Just going out; in haste ...

Did so using regedit but it was set back to 2 when the OpenVPN connection was made. Changed it in /etc/openvpn/server.conf, changing push "dhcp-option NBT 8". Now showed 8 in registry when the OpenVPN connection was made but Windows Explorer still listed only the client in workgroup ACUR.

EDIT: back now. And nbtstat -n still listed only the client.

Mimiko

You can read this on how network browsing is working: http://technet.microsoft.com/en-us/library/cc767893.aspx#XSLTsection125121120120
In general, method with using in samba remote announce works if remote LAN has a working wins/samba server, which you dont have. The main reasons that Microsoft states is that browsing other non-wired lans is troublesome and are not work by default. So its must make several steps to get it working.
You can try using this tool to forward broadcast packets thru tunnel: https://forums.openvpn.net/topic7319.html

catkin

Thanks for the links Mimiko 🙂

I decided not to use Hanne's broadcast forwarder; installing binaries from unknown sources is too scary.

The good news is I got it working; the bad news is it's not very scalable because it uses a specific OpenVPN client IP address rather than an address range.

For simplicity I added another virtual NIC (eth1) to the server and moved the eth0:0 configuration to it, allowing a simpler interfaces line in /etc/samba/smb.conf. The working /etc/samba/smb.conf's global section is:

[global]
	guest only = Yes
	interfaces = eth1 lo tun0
	remote announce = 10.8.0.6/ACUR
	security = SHARE
	wins support = Yes
	workgroup = ACUR

When 10.8.0.6 was changed to 10.8.0.255 or 10.8.0.0 the server was not listed in the workgroup in Windows explorer. For production, the remote announce line can have an entry for each IP address the OpenVPN server is likely to lease to clients. This will be OK for a few clients but is not scalable to a large installation 🙁

BTW it was wrong to try using bind interfaces only. From the smb.conf man page: "Note that you should not use this parameter for machines that are serving PPP or other intermittent or non-broadcast network interfaces as it will not cope with non-permanent interfaces". Once it was remove it became possible for the client to map shares on the server again.

Similarly the O'Reilly Samba book (http://oreilly.com/catalog/samba/chapter/book/ch05_01.html) made clear that remote browse sync was useless here (my bolding): "The global remote browse sync option specifies that Samba should synchronize its browse lists with local master browsers in other subnets. However, the synchronization can occur only with other Samba servers, and not with Windows computers".

EDIT: AFAIK the interfaces line is not generally necessary; by default Samba listens on all interfaces; it was only necessary in the test set up because the OpenVPN client and server were on the same LAN; excluding eth0 via the interfaces line prevented the OpenVPN client from browsing the test shares directly.

Mimiko

Glad to hear you made it. Yes, writing the IPs to which samba will anounce itself is not scalable, but you will not have a lot of clients, right?

Will be helpful if you post all the configs you final configured, to be as example for others.

catkin

For us it's OK. Yes -- I will post the final config files after test in production to make sure it's working.

janjust

thanks for digging into this!
it is good to know that a "standard" openvpn 'tun' setup does not allow the 'network neighborhood' to work; if you switch to 'tap' mode (not bridging) then broadcasts are working and then the Samba server *does* show up in the network neighborhood. There are other drawbacks to using 'tap' mode but at least this part should work.

janjust

as a follow-up to my own last post:

it IS possible to get it working in 'tun' mode as well:

- add the following to the openvpn server config

push "dhcp-option WINS <WINS-SERVER-IP>"
push "dhcp-option NBT 8"

- set up Samba using

domain master = yes
local master = yes
os level = 33
preferred master = yes

(esp 'domain master' is crucial)

after that my WinXP VPN client automatically picked up the Samba domain master

catkin

I am unwell and we have done very limited testing in production anyway. What has been reported so far works for WXP but not for Win7. Will update when have more.

EDIT: "What has been reported so far" is using tun, specifically with /etc/openvpn/server.conf:

port 1194
proto udp
mssfix 1400
dev tun
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/server.crt
key easy-rsa/keys/server.key
dh easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option WINS 10.8.0.1"
push "dhcp-option NBT 8"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
management localhost 7505

and /etc/samba/smb.conf global section

[global]
	workgroup = ACUR
	security = SHARE
	wins support = Yes
	remote announce = 10.8.0.6/ACUR 10.8.0.10/ACUR 10.8.0.14/ACUR 10.8.0.18/ACUR   10.8.0.22/ACUR 10.8.0.26/ACUR 10.8.0.30/ACUR 10.8.0.34/ACUR 10.8.0.38/ACUR   10.8.0.42/ACUR 10.8.0.46/ACUR 10.8.0.50/ACUR 10.8.0.54/ACUR 10.8.0.60/ACUR   10.8.0.64/ACUR 10.8.0.68/ACUR
	guest only = Yes

jamesfawcett

Hi Catkin,

sorry to dig up an old thread from last August, but did you get any further with seeing the network shares in Windows 7?
Everything else you have discovered in this thread has worked so far for me, thank you! but i am struggling with the next step.

please share with us if you made any further progress 🙂

thank you

catkin

Not yet tested James ... will update when it has been

catkin

Have now tested the configuration with Windows 7. It does not work -- computers are not listed when browsing the network. I have not investigated a fix and do not anticipate having time to do so any time soon.

lindylex

Windows clients' can connect and ping machines by name or ip. The Workgroups on the servers does not populate the network neighborhood on the client.

server.conf


proto udp
port 1194
dev tap0
server-bridge 192.168.1.120 255.255.255.0 192.168.1.50 192.168.1.60
push "route 192.168.1.0 255.255.255.0"
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh2048.pem
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 3
client-to-client
log-append /var/log/openvpn
comp-lzo
keepalive 10 60

#This is to push to clients netbios names
push "dhcp-option WINS 192.168.1.120"
push "dhcp-option NBT 8"

grep -vE '^#|^;|^$' /etc/samba/smb.conf


[global]
   workgroup = WORKGROUP
   netbios name = mycvpn
   name resolve order = wins lmhosts host bcast
   domain master = yes
   local master = yes
   os level = 33
   preferred master = yes
   wins support = yes
   dns proxy = yes
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user
   usershare allow guests = yes
[homes]
   comment = Home Directories
   browseable = no
   read only = yes
   create mask = 0700
   directory mask = 0700
   valid users = %S
[printers]
   comment = All Printers
   browseable = no
   path = /var/spool/samba
   printable = yes
   guest ok = no
   read only = yes
   create mask = 0700
[print$]
   comment = Printer Drivers
   path = /var/lib/samba/printers
   browseable = yes
   read only = yes
   guest ok = no

Any help is greatly appreciated.