I have been trying for a while now to get samba share discovery working across subnets, but I can't figure out what is wrong in my config.
For my samba share I use the linux fileserver turnkey image. I use wsdd to make the samba share visible. The configuration I have works right now, if the fileserver and my windows client are in the same network. When I move the fileserver into its own network, it's not visible anymore, yet reachable by directly entering the IP in the file explorer.
Windows Client IP: 192.168.1.50 (192.168.1.0/24, gateway: 192.168.1.254)
There is no firewall on the fileserver enabled. The router (OpenWRT) is configured to accept Input, Output and Forward from and to the two subnets. I have not added any port forwards or traffic rules.
The wsdd config looks like this:
WSDD_PARAMS="-v --workgroup='WORKGROUP'"
(I only pasted the relevant entries from the config files - hope I didn't miss anything)
network
~# cat /etc/config/network
config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
config interface 'lan'
option device 'br-lan'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option ipaddr '192.168.1.254'
config interface 'iot'
option proto 'static'
option device '@lan'
option ipaddr '192.168.0.254'
option netmask '255.255.255.0'
option type 'bridge'
firewall
~#cat /etc/config/firewall
config zone
option name 'iot'
option input 'ACCEPT'
option output 'ACCEPT'
list network 'iot'
option forward 'ACCEPT'
config zone
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
list network 'lan'
config rule
option src_ip '192.168.1.0/24'
option dest_ip '192.168.0.0/24'
option name 'Allow broadcast from Windows subnet to Samba subnet'
option target 'ACCEPT'
option proto 'udp'
option dest_port '137-138'
option enabled '0'
config rule
option src_ip '192.168.0.0/24'
option dest_ip '192.168.1.0/24'
option name 'Allow broadcast from Samba subnet to Windows subnet'
option target 'ACCEPT'
option proto 'udp'
option dest_port '137-138'
option enabled '0'
config forwarding
option src 'iot'
option dest 'lan'
config forwarding
option src 'lan'
option dest 'iot'
umdns
~# cat /etc/config/umdns
config umdns
option jail 1
list network lan
list network iot
I found several threads using smcroute, but I don't have 2 physical devices?
ubus call umdns browse does not list my samba share, but other devices from the 192.168.0.0/24 subnet.
@ notation is an additional interface on the an existing object, i dont believe option type bridge is correct. also usually traffic between one zone to another can be enabled via zone forwarding and not via the zone input/output/forwarding form. maybe you can give a try (like using lan to wan as example).
just a note: zone A to zone B is unidirectional, i.e. zone A can initiate traffic into zone B (and get reply), but zone B cannot initiate traffic into zone A.
so if iot network is untrusted (i guess otherwise you'd just use lan zone) maybe just allow lan->iot and. and maybe you'll need firewall rule to allow specific traffic from iot clients accessing lan servers.
actually i have a very similar setup, i have lan to guest zone forwarding and one rule
config rule
option name 'Allow SMB from guest to Samba server'
option src 'guest'
option dest 'lan'
list dest_ip '192.168.1.201'
option target 'ACCEPT'
list proto 'tcp'
list proto 'udp'
option dest_port '139 445'
Can you see the samba share in a windows Explorer > Network though? Access works, as I can access the samba share via IP directly. It's just the discovery that doesn't work.
remote announce = 192.168.2.255/SERVERS 192.168.4.255/STAFF
the above line would cause nmbd to announce itself to the two given IP addresses using the given workgroup names.
. I just did this so I can exclude the firewall from interfering with what I want to accomplish.