Samba share no longer accessible when connected as PPTP VPN

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Atheros WiSOC based Hardware
Goto page 1, 2  Next
Author Message
madi123
DD-WRT User


Joined: 04 Mar 2008
Posts: 125

PostPosted: Sat Jun 13, 2020 7:22    Post subject: Samba share no longer accessible when connected as PPTP VPN Reply with quote
When connected as a PPTP VPN client to the router I used to have an access to a Samba share (e.g. "/ /192.168.2.1/share"). Now I don't.

The router has an IP of 192.168.2.1 and was setup as a PPTP VPN server. Current release is r43392.

I've tried toggling bcrelay - it doesn't help.

I've rolled back to r40270 - everything works like a charm, so this might relate to in-kernel samba. It just doesn't allow to connect from a different sub-network

I've tried printing to 192.168.2.1 (p910nd) through VPN - and it worked.

Currently client VPN gets IP of 192.168.2.10 in the 255.255.255.255 subnetwork. Router LAN is in 255.255.255.0
Workaround of putting ppp0 (PPTP) and router lan interfaces on same subnet interface also didn't help.

Tried workarounds below, still doesn't work:
https://wiki.dd-wrt.com/wiki/index.php/PPTP_Server_Configuration
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=4786


Last edited by madi123 on Sat Jun 13, 2020 8:21; edited 2 times in total
Sponsor
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 7936
Location: Netherlands

PostPosted: Sat Jun 13, 2020 8:12    Post subject: Reply with quote
It could well be related to the in kernel samba.

Instructions, which *might* work are in place for OpenVPN and WireGuard.
PPtP is really unsafe and not that much used any more (and should be deprecated IMHO) so there are no instructions for it.

WireGuard instructions See page 17 of the WireGuard Advanced setup guide, link in my signature at the bottom of this post

BTW also read the forum guide lines, link also in my signature, so that you know where to post these questions so that you will get better assistance

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
madi123
DD-WRT User


Joined: 04 Mar 2008
Posts: 125

PostPosted: Sat Jun 13, 2020 8:32    Post subject: Reply with quote
Need PPTP for various reasons (when pc doesn't allow installation of 3rd party software, or OpenVPN is blocked from downloading). I've left a ticket here https://svn.dd-wrt.com/ticket/7144 since it's code
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 7936
Location: Netherlands

PostPosted: Sat Jun 13, 2020 8:39    Post subject: Reply with quote
No it is not code it probably is configuration, you didn't even bothered to read my answer Sad
_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Mile-Lile
DD-WRT Guru


Joined: 24 Feb 2013
Posts: 1522
Location: Belgrade

PostPosted: Sat Jun 13, 2020 8:48    Post subject: Reply with quote
madi123 wrote:
Need PPTP for various reasons (when pc doesn't allow installation of 3rd party software, or OpenVPN is blocked from downloading). I've left a ticket here https://svn.dd-wrt.com/ticket/7144 since it's code


when you ssh to router and do cat /tmp/smb.conf

do you have something like bind interfaces only = yes

if answer is positive that's answer for your question... so, no bug... configuration issue...
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 9536
Location: Texas, USA

PostPosted: Sat Jun 13, 2020 15:22    Post subject: Reply with quote
You need to quit opening invalid / incomplete tickets and do some research in the forum about PPTP. Especially if you aren't submitting a patch to fix whatever is broken.

https://svn.dd-wrt.com/ticket/7145

Search the forum....

_________________
Official Forum Rules, Guidelines & Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?
Please DO NOT PM me with questions; Ask in the forum. ---------------------- Linux User #377467 counter.li.org / linuxcounter.net
madi123
DD-WRT User


Joined: 04 Mar 2008
Posts: 125

PostPosted: Sat Jun 13, 2020 19:18    Post subject: Reply with quote
Mile-Lile wrote:
madi123 wrote:
Need PPTP for various reasons (when pc doesn't allow installation of 3rd party software, or OpenVPN is blocked from downloading). I've left a ticket here https://svn.dd-wrt.com/ticket/7144 since it's code


when you ssh to router and do cat /tmp/smb.conf

do you have something like bind interfaces only = yes

if answer is positive that's answer for your question... so, no bug... configuration issue...


I did my homework, in the previous working configuration it was also bind interfaces only = yes, but it worked flawlessly. It is not related to config and I can't find in the code what changed
kernel-panic69
DD-WRT Guru


Joined: 08 May 2018
Posts: 9536
Location: Texas, USA

PostPosted: Sat Jun 13, 2020 19:22    Post subject: Reply with quote
Search the forum. Search my username and PPTP if you want. Adding duplicate useless tickets isn't going to get anything fixed if you can't find what broke.
_________________
Official Forum Rules, Guidelines & Helpful InformationFirmware FAQInstallation WikiWhere Do I Download Firmware?
DON'T use Chromium-based browsersRTFM/STFW TL;DR is NOT an excuse. • Why Should I Care What Color the Bikeshed Is?
Please DO NOT PM me with questions; Ask in the forum. ---------------------- Linux User #377467 counter.li.org / linuxcounter.net
madi123
DD-WRT User


Joined: 04 Mar 2008
Posts: 125

PostPosted: Sat Jun 13, 2020 22:06    Post subject: Reply with quote
kernel-panic69 wrote:
You need to quit opening invalid / incomplete tickets and do some research in the forum about PPTP. Especially if you aren't submitting a patch to fix whatever is broken.

https://svn.dd-wrt.com/ticket/7145

Search the forum....


I've posted a recommended solution for VPN connection on https://svn.dd-wrt.com/ticket/7145, some modules are not loaded which causing the problem. I hope this will be included in the next release, before my ticket will close. This will take away frustration from many users like me. I'm trying to be helpful. Very Happy

Missing modules not loaded into kernel:

/sbin/insmod nf_conntrack_proto_gre
/sbin/insmod nf_conntrack_pptp
/sbin/insmod nf_nat_proto_gre
/sbin/insmod nf_nat_pptp

lsmod after loading manually:

Code:
root@DD-WRT:/sbin# lsmod
Module                  Size  Used by
nf_nat_pptp             1648  0
nf_nat_proto_gre         929  1 nf_nat_pptp
nf_conntrack_pptp       3107  1 nf_nat_pptp
nf_conntrack_proto_gre     2783  1 nf_conntrack_pptp
madi123
DD-WRT User


Joined: 04 Mar 2008
Posts: 125

PostPosted: Sun Jun 14, 2020 7:05    Post subject: Reply with quote
egc wrote:
It could well be related to the in kernel samba.

Instructions, which *might* work are in place for OpenVPN and WireGuard.
PPtP is really unsafe and not that much used any more (and should be deprecated IMHO) so there are no instructions for it.

WireGuard instructions See page 17 of the WireGuard Advanced setup guide, link in my signature at the bottom of this post

BTW also read the forum guide lines, link also in my signature, so that you know where to post these questions so that you will get better assistance


This is actually super useful. I apologies for not reading the DDWRT WireGuard Advanced Setup p.17 you referred. It actually was super helpful. I'm citing it below so others can read and not create duplicate threads:

"The Routers NAS might not be reachable on newer builds with ksmbd.
When you want to access the routers NAS via internet with an app like andSMB it is reported that
change the hosts allow in tmp/smb.conf to include the WG subnet (10.4.0.0/24) might work:
hosts allow = 10.4.0.0/24. (in global section) (some say to also include the local host 127.0.0.1)
And add the interface of the VPN:
interfaces = br0, oet1 (maybe also WAN interface eth0 or vlan2, those seem to be running by default
(see ps) )
Alternatvely change bind interfaces only = yes to:
bind interfaces only = no
You can copy tmp/smb.conf and smb.db to /jffs/etc/ if you have permanent/usb storage so that it
will be read from there (since build 42693).
Use stopservice samba3, startservice samba3, to stop and start
I got it working with andSMB but I had to choose SMB v1 in andSMB."
madi123
DD-WRT User


Joined: 04 Mar 2008
Posts: 125

PostPosted: Sun Jun 14, 2020 8:46    Post subject: Reply with quote
Apparently after following the Wireguard guidance above ksmbd based samba share is still not discoverable in Windows 10. I'm out of luck. I did every possible change (smb.conf (Bind interfaces only = no, hosts allow = xx.xx.xx.) edit and copy to jffs together with smb.db + bcrelay + static advanced routing)

Did anyone really got ksmbd based samba working through PPTP vpn (also tried OpenVPN) with any of the recent builds past r43320? really need your help to make it work

I was able to get LAN access through VPN and see other network devices but still couldn't get the access to SAMBA share Sad
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 7936
Location: Netherlands

PostPosted: Sun Jun 14, 2020 11:25    Post subject: Reply with quote
I have tested it some weeks ago on WireGuard and OpenVPN, and could get it to work with andSMB on my phone, but did not test recently.

KSMBD is a work in progress with weekly updates.

I make my own builds and have switched back to the old samba36 at the moment, so cannot test anything.

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
madi123
DD-WRT User


Joined: 04 Mar 2008
Posts: 125

PostPosted: Tue Jun 16, 2020 14:07    Post subject: Reply with quote
So after investigations I found it works ONLY when 3 conditions are met:

1) ppp0 is UP (e.g. VPN is connected)
2) ppp0 is added to interfaces in smb.conf
3) samba3 service is restarted while ppp0 is UP
(to check ppp0 status run ifconfig -a)

So it works only when samba3 service was started while ppp0 link is up, and I was able to connect to samba share and transfer the files. However, if you disconnect from VPN then connect again you no longer have samba share access, and samba3 service needs to be restarted again. This is not practical.

If you are interested I've opened a discussion on ksmbd, hopefully they will fix it, since according to one of the developers:

"ksmbd doesn't support ip/mask in interfaces param."
https://github.com/cifsd-team/cifsd/issues/414
This is a root of the problem

I think this is true for now, since when I add IP/netmask nothing changes from the access standpoint, as a check I was able to add additional interface lo, which you normally won't see after running commands below. So, ksmbd still listens to interfaces only (e.g. eth0, br0, etc), but not the IP/netmask.

Commands and outputs:

for smb.conf (copied to /jffs/etc then edited with vi)
interfaces = br0 eth0 lo 192.168.2.1/32
bind interfaces only = no


ps output:
oot@DD-WRT2:/jffs/etc# ps -w | grep ksmbd
14398 root 1196 S ksmbd.mountd -c /jffs/etc/smb.conf -u /jffs/etc/smb.db
14399 root 1224 S ksmbd.mountd -c /jffs/etc/smb.conf -u /jffs/etc/smb.db
14401 root 0 SW [ksmbd-lo]
14403 root 0 SW [ksmbd-eth0]
14405 root 0 SW [ksmbd-br0]
14408 root 1364 S grep ksmbd

root@DD-WRT2:/jffs/etc# netstat -an | grep 445
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN
netstat: /proc/net/tcp6: No such file or directory
netstat: /proc/net/udp6: No such file or directory
netstat: /proc/net/raw6: No such file or directory

What do you think guys? Can someone try to fix it from DD-WRT side?

Is there any way to dynamically add the ppp0 to ksmbd listening ports as soon as ppp0 is UP? This should not restart samba3, otherwise it will screw up other transfers

Alternatively if you can help to create a Firewall rule that will mask requests coming from 192.168.2.1/32 PPTP network to Samba as they are coming from br0 lan 192.168.1.1/24 network (e.g. Use NAT for samba requests on port 445)
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 7936
Location: Netherlands

PostPosted: Tue Jun 16, 2020 16:34    Post subject: Reply with quote
Of course you can make a script which adds the interface to smb.conf when the interface is up.
(for openVPN there is a route up script and for Wireguard there will be route-up -down and use of native fwmark in the future)

But it probably still need a restart of samba3 unless ksmbd detects a change in config and acts accordingly (by restarting? )

Restarting services is not uncommon, for OpenVPN set_routes, firewall and wshaper (QoS) are restarted when the interfaces is up (and QoS is used)

As PPtP does not get much love any more (understandably so) it might not have high priority to make any changes regarding PPtP.
So you have to hope that ksmbd will "behave" better in the future.

_________________
Routers:Netgear R7800, R6400v1, R6400v2, Linksys EA8500, EA6900 (XvortexCFE), E2000 (converted WRT320N), WRT54GS v1.
WireGuard Documents & Guides:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327397
OpenVPN Documents & Guides: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327398
IPSET: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=327261
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
madi123
DD-WRT User


Joined: 04 Mar 2008
Posts: 125

PostPosted: Wed Jun 17, 2020 10:28    Post subject: Reply with quote
I think the fix that will work for everyone is adding support in ksmbd for ip/mask in interfaces param defined in smb.conf. This will fix the root of the problem. I hope this can be done sooner or later.
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Atheros WiSOC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum