Cannot see SMB share when VPNed in

Networking
1

Hello all, trying to access a share while VPNed in while out of state- background:

  • Trying to access with Windows10 laptop
  • Router/Firewall/VPN- PFSense with OpenVPN, NAT and such all setup
  • FreeNAS 11 virtualized in ESXi 6.0

I can log into my ESXi via vsphere, I can get into my FreeNAS webUI and pfsense webUI, so the VPN is doing it’s thing, but cannot see the SMB shares that I can when at home.

I pinged the FreeNAS instance and lost 3 out of 4 packets. I dragged the OpenVPN firewall rule up to the top and now the pings go through without a hitch. So changed to ping -t and there are still some some timed outs here and there, kind of weird.

I was trying to find someplace in the FreeNAS webUI that might have been restricting IPs, as when I’m VPN’ed in I am sub-netted and routed (saying that right?), NAT being 192.x.x.x, VPN’ed machines 10.x.x.x.

2

Most likely cause is that the SMB ports are being blocked somewhere. 445 should be all you need if you are using IP addresses, add 137-139 for Netbios/name resolution. You probably need to configure port forwarding on the router so the traffic on the 10.x.x.x network gets forwarded to the 192.168.x.x network.

One small side point - If you are only using Win 10 you can disable SMB 1.0 on freenas and Win10, it’s now commonly exploited.

1 Like
3

We’ll likely need to see all of the OpenVPN firewall rules. Or check pfSense’s general Firewall log and try to access your SMB share. See if a deny pops up. I find the Firewall Log widget on pfSense’s main page is handy for this kind of work.

4

You won’t be able to see them with network discovery but if you manually type them in it should work, assuming you’re not blocking anything between the VPN and your LAN.

5

Hello guys, I haven’t tested anything yet so didn’t respond, but don’t want to be rude and not reply at all. Will hotspot through my phone to test some ideas out. I also noticed my IP away from home would not change with or without being connected via the VPN, so I clicked the box to route all traffic through the VPN and will see if that helped as well.