No SMB access via VPN

[DeltaGolf]

I'm trying to access a remote Synology using SMB from a Mac. I'm connecting via VPN. I can't get to my files!

The VPN is taken care of by another device, not the Synology. I have a point to point connection. That works, I can access the router for example over the VPN. Requesting smb://192.168.1.1 just gets an error, 'something is wrong'. (Yes, my LAN has a different address, that's just an example!)

I can access a local Synology via SMB no problem, in fact SMB has been very stable on Macs recently - not always the case in the past.

I can ping the remote Synology on its LAN address and it responds. So I'm sure I'm connected fine over the VPN and its working. But something is stopping me accessing it via SMB. It's not a Synology firewall and in any case local users haven't been complaining about access. It's just me over VPN.

FWIW the Synology is still on DSM 6 point whatever.

Thanks for any pointers...

PS same when trying from an iPad, so its not a macOS issue

 

[Rusty]

It's not a Synology firewall

How can you be sure? Have you granted VPN subnet access to your NAS local subnet?

 

[DeltaGolf]

How can you be sure?

Because the Synology DSM Firewall is not enabled?

Assuming Control Panel Connectivity -> Security -> Firewall

Oh, and in other news, this is now true of two Synologys. I can't access SMB using VPN on either. There is a possibility its a firewall on the router issue. Both have new routers... But I can access their interfaces, just not get onto their LANs.

 

[Rusty]

Because the Synology DSM Firewall is not enabled?

Ok, as you didn’t specify it. Still could be a fw on some level. Can you try and telnet port 445 towards your NAS from the clients?

 

[DeltaGolf]

Sorry, was being specific about the VPN not being on the Syno, forget to be clear on the FW.

Anyways, I can access my local Synology on my local LAN via telnet.

deltagolf@deltaMac ~ % telnet 192.168.1.123 445
Trying 192.168.1.123...
Connected to synology.fritz.box.
Escape character is '^]'.

But not to the Synology on the remote site via VPN

Trying 192.168.2.123...
telnet: connect to address 192.168.2.123: Operation timed out
telnet: Unable to connect to remote host

Port 445 is not specifically opened on the firewall. But neither is whatever the VPN ports are (500?), Fritz takes care of that. And all of this has worked in the past. I still suspect the FritzBox. But I've followed all their suggestions at Cannot access shared files or printers over a VPN connection | FRITZ!Box 7581.

 

[Rusty]

Ok, so it's clearly being blocked. Considering it is not the FW on the NAS side, it has to be something on the router side.

 

[DeltaGolf]

So 445 should be open?

The FritzBox has a list of open ports. Many of those are opened automatically, for example

500 UDP, IPv4 VPN (IKE)
4500 UDP, IPv4 VPN (IPsec)
5060 UDP, IPv4, TCP Telephony (SIP)
7078-7097, UDP, IPv4 Telephony (RTP)

and there are other I've opened which point directly to the Synology.

I'm expecting that the FritzBox has automatically opened port 445. It worked fine on a previous model, but that may have had older firmware. And then again, FritzBox is know to be poor for VPN. So much so they are beta testing WireGuard to replace IPSec.

Anyway, if I open 445 I only have the option of pointing it at the Synology. Usually I'd be able to SMB to any server on the network. I might give it a go...

 

[DeltaGolf]

An update...

I have the sites connected with a LAN to LAN VPN. I've disconnected them from each other. Now I've connected using my own personal VPN account. And as if by magic I'm able to access the Synology via SMB.

So its not that the FritzBox is blocking SMB, its something to do with the site to site, LAN to LAN VPN connection.

Getting there!

 

[Gerard]

Is smb allowed for the user your connecting with? DSM 7 has a separate smb permission under users

 

[DeltaGolf]

Fixed it!

So that tickbox in the FritzBox VPN settings page. The one that says "Allow NetBIOS over this connection (for Microsoft Windows file and printer sharing)". Obviously I don't need to tick that cos we don't have any Windows machines and don't need printer sharing.

Obviously I do. So I did. And I have SMB again!

Now if it mentioned SMB on the settings page rather than as a passing reference buried in the FAQs I wouldn't have bothered you all here. But thank you for the suggestions, they helped me think it through and find the solution.

 

[wblew]

Fixed it!

So that tickbox in the FritzBox VPN settings page. The one that says "Allow NetBIOS over this connection (for Microsoft Windows file and printer sharing)". Obviously I don't need to tick that cos we don't have any Windows machines and don't need printer sharing.

Obviously I do. So I did. And I have SMB again!

Now if it mentioned SMB on the settings page rather than as a passing reference buried in the FAQs I wouldn't have bothered you all here. But thank you for the suggestions, they helped me think it through and find the solution.

The NetBIOS over TCP protocol is used by any non-Active Directory (and non WINS) SMB client to find the SMB file sharing server(s). In modern Microsoft networking, it has been replaced (after a side trip through WINS servers), with unicast DNS service. But without Active Directory, perhaps "Workgroup" networking, its back to NetBIOS or WINS service.

Indeed, Active Directory is heavily based on DNS service. Each AD domain is also two DNS zones.

I'm glad your setup is now working!

 

[mrzool]

Fixed it!

So that tickbox in the FritzBox VPN settings page. The one that says "Allow NetBIOS over this connection (for Microsoft Windows file and printer sharing)". Obviously I don't need to tick that cos we don't have any Windows machines and don't need printer sharing.

Obviously I do. So I did. And I have SMB again!

Now if it mentioned SMB on the settings page rather than as a passing reference buried in the FAQs I wouldn't have bothered you all here. But thank you for the suggestions, they helped me think it through and find the solution.

I registered on this forum only to thank you. I had exactly the same problem with exactly the same configuration and it was driving me crazy. Thank you so much!