Hey all,
I've got bit of a long question that I've been struggling with today. Hopefully some samba/openvpn expert here can spot the problem.
I've split the wireless and wired bridge on my router to give out 192.168.10.x IP's to wired hosts and 192.168.20.x IP's to wireless hosts. After setting up the firewall to work with this setup, I realized that windows file sharing wouldn't work without the router as a WINS server. So I set that up and it worked fine. Wired and wireless hosts can see each other on the workgroup browser.
Now...I've set up openvpn on the router as well. It's running in routing mode with certificates and handing out 192.168.30.x/30 IP's to hosts. The VPN works perfectly fine. The problems are with cross-vpn file sharing:
-> Hosts in the wired/wireless subnets only see each other in the workgroup browser, not the hosts in the VPN.
-> Hosts in the VPN subnet only see each other in the workgroup browser, not the wired/wireless hosts.
-> Hosts in the VPN can access all directly hosts by name (i.e. \\computername) but hosts in the wired/wireless subnet can only access hosts in the VPN subnet by IP (i.e. \\192.168.30.6)
Firewalls are disabled on all hosts for testing purposes. All hosts have the same workgroup set.
/etc/openvpn/server.conf:
# network
port 1194
proto udp
dev tun
server 192.168.30.0 255.255.255.0
push "route 192.168.10.0 255.255.255.0"
push "route 192.168.20.0 255.255.255.0"
push "redirect-gateway"
push "dhcp-option WINS 192.168.10.1"
# certificate and keyfiles
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
dh /etc/openvpn/dh.pem
tls-auth /etc/openvpn/shared.key
#misc
keepalive 10 120
status /tmp/openvpn.status/etc/samba/smb.conf:
[global]
syslog = 0
syslog only = yes
workgroup = WORKGROUP
server string = OpenWrt Samba Server
security = share
encrypt passwords = yes
guest account = nobody
domain master = yes
local master = yes
preferred master = yes
wins support = yes
name resolve order = wins lmhosts hosts bcast
browse list = yes
remote browse sync = 192.168.10.255 192.168.20.255 192.168.30.255
remote announce = 192.168.10.255/WORKGROUP 192.168.20.255/WORKGROUP 192.168.30.255/WORKGROUP
os level = 250/etc/firewall.user:
#!/bin/sh
# Copyright (C) 2006 OpenWrt.org
WIFI=`uci get network.wifi.ifname`
WAN=`uci get network.wan.ifname`
LAN=`uci get network.lan.ifname`
VPN=tun0
iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule
# The following chains are for traffic directed at the IP of the
# WAN interface
iptables -F input_wan
iptables -F forwarding_wan
iptables -t nat -F prerouting_wan
# Allow WIFI to access WAN
iptables -A FORWARD -i $WIFI -o $WAN -j ACCEPT
# Allow communicantion between LAN AND WIFI
iptables -A FORWARD -i $WIFI -o $LAN -j ACCEPT
iptables -A FORWARD -i $LAN -o $WIFI -j ACCEPT
# Allow communicantion between LAN AND VPN
iptables -A FORWARD -i $VPN -o $LAN -j ACCEPT
iptables -A FORWARD -i $LAN -o $VPN -j ACCEPT
# Allow communicantion between WIFI AND VPN
iptables -A FORWARD -i $VPN -o $WIFI -j ACCEPT
iptables -A FORWARD -i $WIFI -o $VPN -j ACCEPT
# Allow outside access to VPN
iptables -t nat -A prerouting_wan -p udp --dport 1194 -j ACCEPT
iptables -A input_wan -p udp --dport 1194 -j ACCEPT
# Forwarding for VPN
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
# Allow outside access to dropbear
iptables -t nat -A prerouting_wan -p tcp --dport 22 -j ACCEPT
iptables -A input_wan -p tcp --dport 22 -j ACCEPTThanks! Any help is appreciated.