1

This subject is covered in many posts along the internet but I still can't get it to work. I have the following setup:

  • Samba Client: Laptop "Quincy" on Windows 10, local LAN 192.168.178.100, VPN 10.8.0.50
  • OpenVPN Server: "Coleman" on Ubuntu 16.04, eth0 192.168.178.2, tun0 10.8.0.1
  • Samba Server: "Cannonball" on Ubuntu 16.04, eth0 192.168.1768.3

When I am inside the LAN everything works fine, but when I am outside the LAN I would like to access my Samba shares through the VPN but I am not able to do that. Windows reports that there is no access to \\\192.168.178.3\user. Strangely enough when I try to connect from the laptop the following is logged in /var/log/samba/smbd.samba.log:

[2016/10/19 20:37:29.135523,  3] ../source3/lib/access.c:338(allow_access)
Allowed connection from 192.168.178.2 (192.168.178.2)

but /var/log/samba/quincy.samba.log reports:

[2016/10/19 20:37:46.116302,  3] ../source3/smbd/server_exit.c:252(exit_server_common)
Server exit (failed to receive smb request)

So my interpretation is that a request for access is received by the samba server from the windows client, but no actual samba request (e.g to browse or to access files) is received. More likely is that the samba client is not receiving the information from the server and therefore returns the access error.

So I tried almost everything what I could find in the forums and faqs for IP forwarding, firewall settings, etc. but still no solution was found. Below you can find configuration files and stuff which can give more information.

I hope someone is able to help me with this. I am really at a loss with this one.

/etc/openvpn/server.conf on 192.168.178.2:

;local a.b.c.d  
port 1194  
;proto tcp  
proto udp  
;dev tap  
dev tun  
;dev-node MyTap  
ca ca.crt  
cert Coleman.crt  
key Coleman.key  # This file should be kept secret  
dh dh2048.pem  
;topology subnet  
server 10.8.0.0 255.255.255.0  
ifconfig-pool-persist ipp.txt  
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100  
;server-bridge  
push "route 192.168.178.0 255.255.255.0"  
;push "route 192.168.20.0 255.255.255.0"  
push "dhcp-options DNS 10.8.0.1"  
;client-config-dir ccd  
;route 192.168.40.128 255.255.255.248  
;client-config-dir ccd  
;route 10.9.0.0 255.255.255.252  
;learn-address ./script  
push "redirect-gateway def1 bypass-dhcp"  
push "dhcp-option DNS 8.8.8.8"      ## Google DNS servers  
push "dhcp-option DNS 8.8.8.4"  
;client-to-client  
;duplicate-cn  
keepalive 10 120  
tls-auth ta.key 0 # This file is secret  
key-direction 0  
;cipher BF-CBC        # Blowfish (default)  
cipher AES-128-CBC   # AES  
auth SHA256  
;cipher DES-EDE3-CBC  # Triple-DES  
comp-lzo  
;max-clients 100  
user nobody  
group nogroup  
persist-key  
persist-tun  
status openvpn-status.log  
;log         openvpn.log  
;log-append  openvpn.log  
verb 3  
;mute 20  

The UFW rules on 192.168.178.2:

Naar                       Actie       Van  
----                       -----       ---  
OpenSSH                    ALLOW       Anywhere                  
Postfix                    ALLOW       Anywhere                  
Dovecot IMAP               ALLOW       Anywhere                  
Dovecot Secure IMAP        ALLOW       Anywhere                  
1194/udp                   ALLOW       Anywhere                  
Apache                     ALLOW       Anywhere                  
Apache Full                ALLOW       Anywhere                  
Apache Secure              ALLOW       Anywhere                  
8080                       ALLOW       Anywhere                  
1194                       ALLOW       Anywhere                  
445/tcp                    ALLOW       Anywhere                  
137/udp                    ALLOW       Anywhere                  
138/udp                    ALLOW       Anywhere                  
139/tcp                    ALLOW       Anywhere                  
OpenSSH (v6)               ALLOW       Anywhere (v6)             
Postfix (v6)               ALLOW       Anywhere (v6)             
Dovecot IMAP (v6)          ALLOW       Anywhere (v6)             
Dovecot Secure IMAP (v6)   ALLOW       Anywhere (v6)             
1194/udp (v6)              ALLOW       Anywhere (v6)             
Apache (v6)                ALLOW       Anywhere (v6)             
Apache Full (v6)           ALLOW       Anywhere (v6)             
Apache Secure (v6)         ALLOW       Anywhere (v6)             
8080 (v6)                  ALLOW       Anywhere (v6)             
445/tcp (v6)               ALLOW       Anywhere (v6)             
137/udp (v6)               ALLOW       Anywhere (v6)             
138/udp (v6)               ALLOW       Anywhere (v6)             
139/tcp (v6)               ALLOW       Anywhere (v6)             

/etc/samba/smb.conf on 192.168.178.3:

[global]  
netbios name = Cannonball  
server string = Samba file server  
domain master = yes  
workgroup = BEGONET  
security = user  
hosts allow = 127. 192.168.178.  
hosts deny = 192.168.178.20 
interfaces = 127.0.0.1/8 192.168.178.0/24  
remote announce = 192.168.178.255  
remote browse sync = 192.168.178.255  
log file = /var/log/samba/samba.log  
max log size = 1000  
encrypt passwords = true  
unix password sync = yes  
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192  
name resolve order = wins lmhosts bcast  
wins support = yes  
wins proxy = no  
dns proxy = no  
passdb backend = tdbsam  
passwd program = /usr/bin/passwd '%u'  
passwd chat = *New*password* %n\n *ReType*new*password* %n\n   *passwd*changed*\n  
add user script = /usr/sbin/useradd -d /dev/null -c 'Samba User Account' -s   /dev/null '%u'  
add user to group script = /usr/sbin/useradd -d /dev/null -c 'Samba User   Account' -s /dev/null -g '%g' '%u'  
add group script = /usr/sbin/groupadd '%g'  
delete user script = /usr/sbin/userdel '%u'  
delete user from group script = /usr/sbin/userdel '%u' '%g'  
delete group script = /usr/sbin/groupdel '%g'  
add machine script = /usr/sbin/useradd -d /dev/null -g sambamachines -c   'Samba Machine Account' -s /dev/null -M '%u'  
machine password timeout = 120  
template shell = /dev/null   
smb ports = 139  

[tmp]   
comment = temporary files  
path = /tmp  
read only = yes  

[printers]  
    comment = All Printers    
    browsable = yes  
    path = /var/spool/samba  
    printable = yes  
    guest ok = no  
    read only = yes  
    create mask = 0700 

[print$]  
    comment = Printer Drivers  
    path = /var/lib/samba/printers  
    browsable = yes  
    read only = yes  
    guest ok = no  

[Backups]  
    path = /home/Backups  
    writeable = yes  
    browseable = yes  
    valid users = berry  
    guest ok = no

No firewall is active on 192.168.178.3

0

In your smb.conf you should have interfaces and hosts allow defined as following:

   interfaces = 127.0.0.0/8 192.168.178.0/24 10.8.0.0/24
   hosts allow = 127.0.0.1 192.168.178.1/24 10.8.0.1/24

Also i would add hosts deny = ALL as you don't need access from any other interfaces.

And don't forget to restart samba service after making changes service smbd restart

  • Thanks for the help! The smb.conf entries were indeed a bit sloppy and corrected that according to you suggestion. However it does not address the problem because it was already established that the samba server grants access to the client over vpn. – BeGosV Oct 22 '16 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.