Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.
Buying anything on Amazon? Please use the Geekzone Amazon aff link.




632 posts

Ultimate Geek
+1 received by user: 30

Trusted

Topic # 113875 30-Jan-2013 18:32 Send private message

Hi All,

I have two different subnets linked with a router between them.

I need to access a SMB share over a port forward across the WAN interface - not as bad a security threat as you might think because the WAN interface is not exposed to the internet in this case, just a different subnet.

I opened 135/137/139 and 445 TCP and UDP and cant access the share by typing in \\SERVER\Share

Am I missing something?

Cheers

-Al

Create new topic


632 posts

Ultimate Geek
+1 received by user: 30

Trusted

  Reply # 753416 30-Jan-2013 18:33 Send private message

PS: I tried making the server a DMZ and that didnt work either!



632 posts

Ultimate Geek
+1 received by user: 30

Trusted

  Reply # 753418 30-Jan-2013 18:40 Send private message

First problem : I can ping one particular device on the LAN subnet, but the SERVER with the SMB share(same subnet) wont reply to pings.

Guess thats the first problem to over come.

-AL

3043 posts

Uber Geek
+1 received by user: 223

Trusted
Subscriber

  Reply # 753447 30-Jan-2013 19:33 Send private message

Hang on, why are you using NAT at all? If the 2 subnets are directly connected via a single router than you don't even need port forwarding as one subnet can route directly to a host in the other? What devices etc. are you using and what are you trying to achieve?





1966 posts

Uber Geek
+1 received by user: 19

Trusted
Subscriber

  Reply # 755113 3-Feb-2013 16:26 Send private message

Replace SERVER with the IP address of your router. The server behind the NAT is not visible by its name from the outside.



632 posts

Ultimate Geek
+1 received by user: 30

Trusted

  Reply # 755173 3-Feb-2013 18:49 Send private message

Yeah your right, it needs to be the IP of the router, but still doesnt work.

I wonder if it has to do with the reply address?

Here is my diagram of what I *think* might be happening?

https://www.dropbox.com/s/dt7q9owe5y997ug/Drawing1%20%282%29.jpg?m

HTH

-Al



632 posts

Ultimate Geek
+1 received by user: 30

Trusted

  Reply # 755203 3-Feb-2013 20:28 Send private message

bigal_nz: Yeah your right, it needs to be the IP of the router, but still doesnt work.

I wonder if it has to do with the reply address?

Here is my diagram of what I *think* might be happening?

https://www.dropbox.com/s/dt7q9owe5y997ug/Drawing1%20%282%29.jpg?m

HTH

-Al


Yip - the air router needs to change the source to 192.168.150.243 for SMB requests going across it.

iptables -t nat -o eth0 -s 192.168.0.0/24 -J MASQUERADE

Or something like that!

1966 posts

Uber Geek
+1 received by user: 19

Trusted
Subscriber

  Reply # 755338 4-Feb-2013 08:39 Send private message

What are your client and server SMB hosts. Recent (6.1 and above) windows versions do not require return path.

3043 posts

Uber Geek
+1 received by user: 223

Trusted
Subscriber

  Reply # 755364 4-Feb-2013 09:22 Send private message

Hi Bigal_nz,
OKKKKK I think you need to look at a major redesign of your network. Firstly why have you got 2x routers connecting to the internet? Have you got connections with 2 different ISPs? Unless these are seperate networks due to one being say for you and one being say your neighbour you only need one router for everything. You have double NAT going on there which is REALLY bad with the stuff behind the air router.

The answers will come from this I think!






1966 posts

Uber Geek
+1 received by user: 19

Trusted
Subscriber

  Reply # 755373 4-Feb-2013 09:43 Send private message

I've only just looked at the diagram, honestly, left me a bit perplexed.

450 posts

Ultimate Geek
+1 received by user: 53


  Reply # 755388 4-Feb-2013 09:53 Send private message

I'm no expert in this particular field, but if it were me, I'd look at using a VPN over the WAN perhaps.



632 posts

Ultimate Geek
+1 received by user: 30

Trusted

  Reply # 755697 4-Feb-2013 17:48 Send private message

Zeon: Hi Bigal_nz,
OKKKKK I think you need to look at a major redesign of your network. Firstly why have you got 2x routers connecting to the internet? Have you got connections with 2 different ISPs? Unless these are seperate networks due to one being say for you and one being say your neighbour you only need one router for everything. You have double NAT going on there which is REALLY bad with the stuff behind the air router.

The answers will come from this I think!



There are reasons for doing it this way, and constrictions on what I can change and what I cant.

I guess I am fudging a solution with my hands tied to some extent.

Yes both the routers at the top of the diagram connect to the internet.

There are two different organisations involved. I only control the 192.168.150.0 subnet.

Proper routing would be best solution...but again I dont control the 192.168.0.0 network.

3043 posts

Uber Geek
+1 received by user: 223

Trusted
Subscriber

  Reply # 755712 4-Feb-2013 18:11 Send private message

bigal_nz:
Zeon: Hi Bigal_nz,
OKKKKK I think you need to look at a major redesign of your network. Firstly why have you got 2x routers connecting to the internet? Have you got connections with 2 different ISPs? Unless these are seperate networks due to one being say for you and one being say your neighbour you only need one router for everything. You have double NAT going on there which is REALLY bad with the stuff behind the air router.

The answers will come from this I think!



There are reasons for doing it this way, and constrictions on what I can change and what I cant.

I guess I am fudging a solution with my hands tied to some extent.

Yes both the routers at the top of the diagram connect to the internet.

There are two different organisations involved. I only control the 192.168.150.0 subnet.

Proper routing would be best solution...but again I dont control the 192.168.0.0 network.



Hmm I see. Would it be an option to perhaps connect router2 to router1? Can we get some mroe info on the situation and your limitations? Don't need to name names of course ;p





1186 posts

Uber Geek
+1 received by user: 57

Subscriber

  Reply # 755729 4-Feb-2013 18:48 Send private message

So you have a static route on Router 1 (192.168.150.1)??

192.168.0.0 255.255.255.0 gw=192.168.150.243




Ross
ADSL2+ sync (Kbps): 11577/945, attenuation (dB): 33.0/16.9, Noise margin (dB): 11.5/11.5



632 posts

Ultimate Geek
+1 received by user: 30

Trusted

  Reply # 756766 7-Feb-2013 04:11 Send private message

Zeon:
bigal_nz:
Zeon: Hi Bigal_nz,
OKKKKK I think you need to look at a major redesign of your network. Firstly why have you got 2x routers connecting to the internet? Have you got connections with 2 different ISPs? Unless these are seperate networks due to one being say for you and one being say your neighbour you only need one router for everything. You have double NAT going on there which is REALLY bad with the stuff behind the air router.

The answers will come from this I think!



There are reasons for doing it this way, and constrictions on what I can change and what I cant.

I guess I am fudging a solution with my hands tied to some extent.

Yes both the routers at the top of the diagram connect to the internet.

There are two different organisations involved. I only control the 192.168.150.0 subnet.

Proper routing would be best solution...but again I dont control the 192.168.0.0 network.



Hmm I see. Would it be an option to perhaps connect router2 to router1? Can we get some mroe info on the situation and your limitations? Don't need to name names of course ;p


Dont worry the iptables rule to do SNAT fixed it, so it had a return path:

iptables -t NAT -A POSTROUING -o br0 -j SNAT --to-source 192.168.150.243

Giving the packs a return address of 192.168.150.243 when crossing the Air Router.

Cheers

-Al


Create new topic




Twitter »
Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





Trending now »

Hot discussions in our forums right now:

Has Spark (Telecom) locked their iphone 6 ?
Created by anewguy2014, last reply by michaelmurfy on 17-Dec-2014 14:32 (25 replies)
Pages... 2


Do I have the right to return this?
Created by corksta, last reply by Dairyxox on 21-Dec-2014 10:29 (44 replies)
Pages... 2 3


Police Camera Van Disguise
Created by Reanalyse, last reply by Dratsab on 21-Dec-2014 10:07 (67 replies)
Pages... 3 4 5


In defence of cats
Created by Rikkitic, last reply by DarthKermit on 17-Dec-2014 15:40 (68 replies)
Pages... 3 4 5


Slaughter of Innocents
Created by networkn, last reply by networkn on 19-Dec-2014 17:46 (64 replies)
Pages... 3 4 5


Spray Foam Insulation
Created by AACTech, last reply by timbosan on 19-Dec-2014 16:58 (36 replies)
Pages... 2 3


How to upload 150GB of photos to iCloud?
Created by josephhinvest, last reply by timbosan on 17-Dec-2014 15:05 (35 replies)
Pages... 2 3


Couriers starting to charge for redelivery
Created by mattwnz, last reply by rendezvous on 19-Dec-2014 11:45 (78 replies)
Pages... 4 5 6



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.