VPN Access through RT2600ac to DS412+ NAS

[GeorgeBR]

Hi

I'm a coder, but not very knowledgeable about networking - so please be gentle!!

I've got an RT2600ac router, and have configured VPN using L2TP/IPSec, and I can VPN into my RT2600ac from my laptop. When I look at the network configuration I have an IP address that appears to be part of the network my RT2600ac is on.

On the same network as the RT2600ac I have my DS412+ NAS drive. This has SMB, and works fine when I'm on the local network (although it can be a bit clunky from a Mac!) However, when I connect to the RT2600ac through the VPN I am unable to 'see' the NAS - either through SMB or even accessing it's HTTP web browser interface.

I'd really like to be able to connect to my VPN and then use the NAS as if I was on the local network - and any other devices on my local network for that matter!

Any advice greatfully received. Remember - please be gentle with me, I'm a network no-nothing!!!

George

 

[fredbert]

Can you access the NAS using its LAN IP?

Even though they seem to be on the same IP subnet, the Mac on the VPN is separated by the VPN server on the router. So not all local advertising works across the VPN gateway.

In Mac Finder use Connect to Server menubar item and use smb://NAS_LAN_IP. Likewise you can browse to the NAS IP address.

 

[GeorgeBR]

Hi, thanks for the reply.
On the local network I can do everything fine (web access to the router, SMB connection from Mac)
When on VPN I can access the router web interface, but cannot see the NAS in any way (web or SMB)
I'm guessing I have to have some routing rules. I've tried setting up a number of 'obvious candidate' ports for VPN and SMB to redirect to the NAS, but nothing seems to work!
I'm particularly concerned that my lack of knowledge will leave me with open ports with a security risk!

 

[fredbert]

Did you try to directly connect using the NAS's LAN IP? And that also fails?

• How exactly are you accessing the NAS when on the LAN and from the VPN?
  • e.g. manually using LAN IP, it automatically reveals itself by Bonjour or Windows networking advertised name, Quick Connect, something else, one of more of these
• When you use the term 'see' what do you mean?
  • It's subjective so you might mean that your client device doesn't automatically find and list the NAS, or that you try to connect but that fails.
• Which devices are you using?
  • You list Mac, PC, iOS, and Android.
• Have you tried temporarily turning off the NAS's firewall, if it is on?

I'm not sure what you mean by setting up ports to direct to the NAS. This sounds like port forwarding in the router and unnecessary, if you only access the NAS from the Internet using the VPN service on the router. Specifically you shouldn't really expose SMB, it was developed as a local file sharing service and V1 is a known, widely exploited malware target: ensure SMB minimum version is 2 in DSM Control Panel.

With a properly function VPN service on the router you need to have the router's firewall accept incoming VPN connections to itself. Once connected, the VPN client device should be able to access the LAN devices using their LAN IPs, without any port forwarding.