USB Drive not discoverable with VPN active

[jzchen]

I can use that in the time being for my NAS server as its readyshare works perfectly regardless of the VPN being up or not, remote or not.

Do you think this "readyshare" is possibly interfering? (I understand that is a Netgear router, but I haven't heard of such a NAS that works with or without VPN). I mean is the Netgear router still on your network and readyshare running during these tests on the EBG15, (with the understanding you've moved the storage to the EBG15)?

 

[ColinTaylor]

Not surprising since I am quite naive to routing etc.. I have probably been posting too much extra detail that clouds the issue. Post #5 tries to explain it better.

OK. I understand. The problem is the way Asus have configured/designed things.

When using the VPN you are connected to the EBG15's VPN interface (e.g. tun21). The Samba server only listens on the LAN interface (br0), not tun21. So you cannot connect to Samba via the VPN using the VPN server interface address. The problem doesn't apply for SSH connections as the router's dropbear server listens on all interfaces.

EDIT: Corrected misleading statement.

 

[danno]

OK. I understand. The problem is the way Asus have configured/designed things.

When using the VPN you are connected to the EBG15's VPN interface (e.g. tun21). The Samba server only listens on the LAN interface (br0), not tun21. So you cannot connect to Samba via the VPN. The problem doesn't apply for SSH connections as the router's dropbear server listens on all interfaces.

Anyway to re-route to (br0)? Maybe this works for wireless routers as opposed to the EBG15 running wireless firmware on a wired only router?

 

[ColinTaylor]

Anyway to re-route to (br0)? Maybe this works for wireless routers as opposed to the EBG15 running wireless firmware on a wired only router?

I'm assuming all this works the same way as it does for Asus' wireless routers (I don't have an EBG15 myself). So this isn't a routing issue, it a configuration choice by Asus.

To be sure what I'm saying is correct for your router you can SSH into it and run the following command:

cat /etc/smb.conf | grep -E "interfaces|hosts"

If you were running a custom firmware (like Asuswrt-Merlin) you could modify the config file. But AFAIK that's not possible on the EBG15.

 

[danno]

:/tmp/etc# cat smb.conf


listen = br0,0.0.0.0,IPv4,445,DIRECT_TCP
listen = br0,::,IPv6,445,DIRECT_TCP
listen = br0,0.0.0.0,IPv4,139,NBSS
listen = ANY,0.0.0.0,IPv4,3702,WSD
listen = ANY,0.0.0.0,IPv4,5355,LLMNR

[/share]

 

[danno]

I might be able to replace the config file. I have no idea at this point and a football game is on (IPTV going through the EBG15 LOL).

 

[ColinTaylor]

:/tmp/etc# cat smb.conf


listen = br0,0.0.0.0,IPv4,445,DIRECT_TCP
listen = br0,::,IPv6,445,DIRECT_TCP
listen = br0,0.0.0.0,IPv4,139,NBSS
listen = ANY,0.0.0.0,IPv4,3702,WSD
listen = ANY,0.0.0.0,IPv4,5355,LLMNR

[/share]

OK that is different. Asus appears to be using Tuxera's SMB server rather than Samba. But the issue is the same, it's only listening for port 445 traffic on br0.

 

[danno]

OK that is different. Asus appears to be using Tuxera's SMB server rather than Samba. But the issue is the same, it's only listening for port 445 traffic on br0.

It appears that the listen statements are cumulative?

 

[ColinTaylor]

It appears that the listen statements are cumulative?

It looks like it.

https://docs.tuxera.com/docs/latest/reference/config/global/#listen

 

[jzchen]

Asus appears to be using Tuxera's SMB server rather than Samba.

ASUS actually advertises this on the box, but I do not remember seeing it on the web pages. (I did not look carefully I confess).

 

[danno]

OpenVPN dox appear to offer up a solution (I suppose) however I have no idea if it would work. The smb.conf file is built at boot time so any patch would have to be applied after every boot. Probably too complicated for what benefit would be achieved.
I knew going into the Asuswrt fora it did not support the EBG since I read the list of supported routers. I was hoping someone might know of a hack replacement knowing which router was the basis for the EBG firmware.
I am still in the window of return to Amazon, but given all of the hassle I would take enough pleasure from sending it down the trash chute from the tenth floor we live on to justify junking it. The sound of it banging off the walls of the chute on the way down would be good therapy.

https://openvpn.net/community-docs/connecting-to-a-samba-share-over-openvpn.html

Thank you everyone for all of your insight.

 

[jzchen]

@danno How was the football game? (Feels like the only intelligent thing I can contribute to this thread)...

 

[danno]

@danno How was the football game? (Feels like the only intelligent thing I can contribute to this thread)...

I watched until a bit after half time thinking GB was going to roll the Bears over. They could not do much of anything right up to that point. I woke up to find out the Bears came back!
Thank you for your contributions!

 

[ColinTaylor]

@danno Can we take a step back and (for my benefit) do a sanity check as I may have misunderstood your problem.

Can you explain what exactly you're doing that doesn't work (when connected via VPN). What do you see? Are there any error messages, etc.

 

[danno]

@danno Can we take a step back and (for my benefit) do a sanity check as I may have misunderstood your problem.

Can you explain what exactly you're doing that doesn't work (when connected via VPN). What do you see? Are there any error messages, etc.

Thank you for your patience and continued support Colin. I will invest some time to pull together some screen shots etc.. Be back later.

 

[danno]

@danno Can we take a step back and (for my benefit) do a sanity check as I may have misunderstood your problem.

Can you explain what exactly you're doing that doesn't work (when connected via VPN). What do you see? Are there any error messages, etc.

Ok, another pass at this. The reason I am going through this "exercise" is to apply a VPN to our home network. We have several ipcams and I am no longer willing to port forward devices or enable router remote administration. I also want to remove our R6400 Netgear which does not support OpenVPN etc.. Besides, it is slow. I also like the idea of defeating Geofencing while we can.
Our Eero's are supplied by the ISP and have no USB ports. I want to take advantage of USB storage while away from home and get rid of the R6400.

While on the home LAN with the VPN off, I can use Windows to MAP the USB drive attached to the EBG15. The Samba server shows up under the Windows "File Explorer" "Network" tab/twisty/carat. So the router(server) is discovered and windows will allow me to access the drive folders so I can work with the files. I can use FileZilla FTP (TLS) to access the drive as well.

Regardless of my being remote or on the home lan, as soon as I connect to the VPN, the router(server) is removed from the "File Explorer" network list. I do not have to refresh it. It is gone. No error messages, nothing. Just gone. However FileZilla will still allow a TLS connection to work with the files on the EBG15 USB drive. If I attempt to MAP the USB drive using Windows File Explorer since I know the IP address or server name I get this;

If I try from my phone with the VPN active, Cx File Explorer cannot connect to the IP address it cannot connect to the user at the ip address.

These results are the same as long as I connect to the VPN on the client regardless of being on the lan or remote.

With the VPN up, I can however, review all of the ipcams, and the USB drive hung off our old R6400 which is running as an AP with the wireless off since we have the Eero's performing that function.

Hope this helps.

At this point it, to the uninitiated naive novice I am, it looks as though the only course of action is to change the SMB configuration, unless there is a way to route the tunnel to the LAN subnet without causing loops or other issues. At least that is what OpenVPN is recommending as a solution as I posted above.

Post #5 above tries to illustrate the topology.

 

[ColinTaylor]

Thanks for the detailed explanation. I was indeed misunderstanding the situation slightly.

So when going through the VPN you can connect to 192.168.50.1 using FTPS (FileZilla) and SSH, but not SMB. Correct?

If so I'm wondering whether this is a firewall issue rather than an SMB issue... Can you SSH into the EBG15 and post the output of this command (assuming the command works):

iptables-save

 

[danno]

Thanks for the detailed explanation. I was indeed misunderstanding the situation slightly.

So when going through the VPN you can connect to 192.168.50.1 using FTPS (FileZilla) and SSH, but not SMB. Correct?

If so I'm wondering whether this is a firewall issue rather than an SMB issue... Can you SSH into the EBG15 and post the output of this command (assuming the command works):

iptables-save

The command works. I ran it from the WinSubForLinux.

Which records are of interest?

 

[ColinTaylor]

Which records are of interest?

All of them. Your router is significantly different than mine in this respect so I need to see the whole picture to understand what it's doing. You could send it to me by direct message if you prefer.

 

[danno]

Looks like the output was interpreted for emoticons. Sorry 'bout that. Not too bad tho.