Hello :) This may not be possible (netsearching results are contradictory) but it would be nice for the WXP client users to be able to browse Samba shares on the same server as OpenVPN via My Network Places -> Entire Network -> Microsoft Windows Network -> . What is working: [list] [*][code]C:\Documents and Settings\Administrator>net view \\10.8.0.1\ Shared resources at \\10.8.0.1\ Samba 3.5.6 Share name Type Used as Comment ------------------------------------------------------------------------------- Anbu-system Disk [snip more shares][/code] [*]Mapping a share via Windows explorer as \\10.8.0.1\[/list] What is not working: My Network Places -> Entire Network -> Microsoft Windows Network -> . No error but nothing listed (the WXP client has no non-administrative shares). Analysis: [code]C:\Documents and Settings\Administrator>browstat status Status for domain ACUR on transport \Device\NetBT_Tcpip_{3B8F088D-0CE7-4994-ABB9-D6E3DBE70D5B} Browsing is active on domain. Master browser name is: CW8VWXPV Master browser is running build 2600 1 backup servers retrieved from master CW8VWXPV \\CW8VWXPV There are 1 servers in domain ACUR on transport \Device\NetBT_Tcpip_{3B8F088D-0CE7-4994-ABB9-D6E3DBE70D5B} There are 1 domains in domain ACUR on transport \Device\NetBT_Tcpip_{3B8F088D-0CE7-4994-ABB9-D6E3DBE70D5B} Status for domain ACUR on transport \Device\NetBT_Tcpip_{412D62EA-B6B7-4BEA-876C-B0C199471BB5} Browsing is active on domain. Master browser name is: CW8VWXPV Master browser is running build 2600 1 backup servers retrieved from master CW8VWXPV \\CW8VWXPV There are 1 servers in domain ACUR on transport \Device\NetBT_Tcpip_{412D62EA-B6B7-4BEA-876C-B0C199471BB5} There are 1 domains in domain ACUR on transport \Device\NetBT_Tcpip_{412D62EA-B6B7-4BEA-876C-B0C199471BB5}[/code] So it looks like the WXP client's browser service has not found the browser running on the server ... ? Attempts to get it working: [list] [*]Added two lines to OpenVPN server config: [code]push "dhcp-option WINS 10.8.0.1" push "dhcp-option NBT 2"[/code] [*]Added two lines to Samba config file: [code]local master = yes wins support = yes[/code][/list] For testing purposes the WXP firewall is off and there are no IPTABLES. Both the WXP client and the Samba server use the same workgroup. The client configuration file: [code]client dev tun proto udp remote 1194 resolv-retry infinite nobind persist-key persist-tun ca .ca.crt cert .crt key .key ns-cert-type server comp-lzo verb 3[/code] The server configuration file: [code]port 1194 proto udp mssfix 1400 dev tun ca easy-rsa/keys/ca.crt cert easy-rsa/keys/server.crt key easy-rsa/keys/server.key dh easy-rsa/keys/dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "dhcp-option WINS 10.8.0.1" push "dhcp-option NBT 2" keepalive 10 120 comp-lzo persist-key persist-tun status /var/log/openvpn-status.log verb 3 management localhost 7505[/code] The Samba configuration (canonicalised by testparm; presumably [b]local master = yes[/b] is a default so removed by testparm): [code][global] workgroup = ACUR security = SHARE wins support = Yes guest only = Yes [Anbu-system] path = /srv/rsync/Anbu-system guest ok = Yes [snip similar shares][/code] Client versions: WXP Pro SP2 in VirtualBox VM running OpenVPN 2.2.0 Server versions: Debian 6 Squeeze 64-bit running OpenVPN 2.1.3 and Samba 2:3.5.6 Best Charles

Hi. Yes. In general it's possible. But first you must understan that seeng computers in My Network is not WINS server's job. WINS server just responses to clients about IP of some computer name, like DNS. By in order for windows to display computers in My Network window system must scan the LAN with a broadcasting packet. Makeing your samba WINS server is not for this scope. First, do the computers on that server's LAN see it on browsing to My Network page? In generela client must send broadcast packet to tun adapter, but I'm not sure. For this type of acting, server must be configured in bridge mode, which will forward all broadcasting packets thru the tunnel. But firstly see that your samba server appears on windows systems from samba's lan without VPN.

Hello Mimiko :) Thanks -- and so quickly again! Understood about WINS being a name-to-IP resolver and changing to bridged mode. Yes -- Windows computers on the LAN can browse the shares on the Samba server. For security, I don't want OpenVPN clients to be able to see anything on the LAN except the server, though -- access controls are too lax. It's late now so I'm not going to research whether/how the OpenVPN server can be configured for that until tomorrow. Thanks again, Best Charles

it is [b]NOT[/b] necessary to switch to bridged mode for this - you can make this work in 'tun' mode just fine. Make sure that samba is listening on the tun interface and make sure you do a 'remote announce' of the workgroup name to the VPN subnet. Use 'nbtstat' on the WXP client to see if WINS name resolution is working, then try explorer again.

Thanks janjust :) I would like to stay with tun if possible and have been trying as you suggested but have not got it working yet. What to do? If not to fix, how to investigate further? The test environment is two VirtualBox VMs in a single host (CW8). Server CW8vDS: [list] [*]Debian 6 Squeeze 64-bit [*]Single NIC as eth0 (192.168.168.51/24) and eth0:1 (192.168.3.51/24) [*]OpenVPN 2.1.3 currently with[code]port 1194 proto udp mssfix 1400 dev tun ca easy-rsa/keys/ca.crt cert easy-rsa/keys/server.crt key easy-rsa/keys/server.key dh easy-rsa/keys/dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "dhcp-option WINS 10.8.0.1" push "dhcp-option NBT 2" keepalive 10 120 comp-lzo persist-key persist-tun status /var/log/openvpn-status.log verb 3[/code] [*]Samba 2:3.5.6 currently with:[code][global] bind interfaces only = yes client lanman auth = Yes domain master = yes guest only = Yes hosts allow = 192.168.3.0/24 10.8.0.0/24 127.0.0.1 # interfaces = eth0:0 lo tun0 interfaces = 192.168.3.0/24 10.8.0.0/24 127.0.0.0/24 lanman auth = Yes remote browse sync = 10.8.0.255 remote announce = 10.8.0.255/ACUR security = SHARE wins support = Yes workgroup = ACUR[/code] [/list] Client CW8vWPv: [list] [*]WXP Pro SP2 [*]Single NIC as 192.168.168.8/24 with default NetBIOS setting (accept from DHCP server or default to NBT) [*]OpenVPN 2.2.0 currently with:[code]client dev tun proto udp remote 192.168.168.51 1194 resolv-retry infinite nobind persist-key persist-tun ca CW8vDS.ca.crt cert Charles.CW8vDS.crt key Charles.CW8vDS.key ns-cert-type server comp-lzo verb 3[/code] [/list] Before starting the attempts, Samba was listening on all interfaces and the client was able to browse the workgroup ACUR which included the server. After reconfiguring Samba so it was not listening on the client's network 192.168.168.0/24 and restarting the client the server was not listed; OK. On the client, after connecting OpenVPN, the server is still not listed in workgroup ACUR and output from [b]nbtstat -n[/b] lists only the client. Shares cannot now be mapped in Windows Explorer, even when the lanman lines are taken out of smb.conf and Samba restarted. On the server, all looks well in /var/log/daemon.log -- no signs of trouble. Best Charles

After connecting the client could you see the node type you have on your cient: [code]reg query hklm\system\currentcontrolset\services\netbt\parameters[/code]

Thanks Mimiko :) Here it is, after OpenVPN connection, showing type 2 AIUI:[code]C:\Documents and Settings\Administrator>reg query hklm\system\currentcontrolset\services\netbt\parameters ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\system\currentcontrolset\services\netbt\parameters NbProvider REG_SZ _tcp NameServerPort REG_DWORD 0x89 CacheTimeout REG_DWORD 0x927c0 BcastNameQueryCount REG_DWORD 0x3 BcastQueryTimeout REG_DWORD 0x2ee NameSrvQueryCount REG_DWORD 0x3 NameSrvQueryTimeout REG_DWORD 0x5dc Size/Small/Medium/Large REG_DWORD 0x1 SessionKeepAlive REG_DWORD 0x36ee80 TransportBindName REG_SZ \Device\ EnableLMHOSTS REG_DWORD 0x0 DhcpNodeType REG_DWORD 0x2 HKEY_LOCAL_MACHINE\system\currentcontrolset\services\netbt\parameters\Interfaces[/code]

Try setting DhcpNodeType to 0x8, restart client and try again.

Thanks Mimiko :) Just going out; in haste ... Did so using regedit but it was set back to 2 when the OpenVPN connection was made. Changed it in /etc/openvpn/server.conf, changing push "dhcp-option NBT [b]8[/b]". Now showed 8 in registry when the OpenVPN connection was made but Windows Explorer still listed only the client in workgroup ACUR. EDIT: back now. And nbtstat -n still listed only the client.

You can read this on how network browsing is working: [url]http://technet.microsoft.com/en-us/library/cc767893.aspx#XSLTsection125121120120[/url] In general, method with using in samba remote announce works if remote LAN has a working wins/samba server, which you dont have. The main reasons that Microsoft states is that browsing other non-wired lans is troublesome and are not work by default. So its must make several steps to get it working. You can try using this tool to forward broadcast packets thru tunnel: [url]https://forums.openvpn.net/topic7319.html[/url]

Thanks for the links Mimiko :) I decided not to use Hanne's broadcast forwarder; installing binaries from unknown sources is too scary. The good news is I got it working; the bad news is it's not very scalable because it uses a specific OpenVPN client IP address rather than an address range. For simplicity I added another virtual NIC (eth1) to the server and moved the eth0:0 configuration to it, allowing a simpler interfaces line in /etc/samba/smb.conf. The working /etc/samba/smb.conf's global section is: [code][global] guest only = Yes interfaces = eth1 lo tun0 remote announce = 10.8.0.6/ACUR security = SHARE wins support = Yes workgroup = ACUR[/code] When 10.8.0.6 was changed to 10.8.0.255 or 10.8.0.0 the server was not listed in the workgroup in Windows explorer. For production, the remote announce line can have an entry for each IP address the OpenVPN server is likely to lease to clients. This will be OK for a few clients but is not scalable to a large installation :( BTW it was wrong to try using [b]bind interfaces only[/b]. From the smb.conf man page: "[i]Note that you should not use this parameter for machines that are serving PPP or other intermittent or non-broadcast network interfaces as it will not cope with non-permanent interfaces[/i]". Once it was remove it became possible for the client to map shares on the server again. Similarly the O'Reilly Samba book ([url]http://oreilly.com/catalog/samba/chapter/book/ch05_01.html[/url]) made clear that [b]remote browse sync[/b] was useless here (my bolding): "[i]The global remote browse sync option specifies that Samba should synchronize its browse lists with local master browsers in other subnets. [b]However, the synchronization can occur only with other Samba servers, and not with Windows computers[/b][/i]". EDIT: AFAIK the interfaces line is not generally necessary; by default Samba listens on all interfaces; it was only necessary in the test set up because the OpenVPN client and server were on the same LAN; excluding eth0 via the interfaces line prevented the OpenVPN client from browsing the test shares directly.

Loading...

Something went wrong while trying to load the full version of this site. Try hard-refreshing this page to fix the error.

Workgroup browsing not working (WXP client, Linux server)

« Previous Page