SMB over port forwards

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › SMB over port forwards

bigal_nz

635 posts

Ultimate Geek
+1 received by user: 32
Inactive user

#113875 30-Jan-2013 18:32

Hi All,

I have two different subnets linked with a router between them.

I need to access a SMB share over a port forward across the WAN interface - not as bad a security threat as you might think because the WAN interface is not exposed to the internet in this case, just a different subnet.

I opened 135/137/139 and 445 TCP and UDP and cant access the share by typing in \\SERVER\Share

Am I missing something?

Cheers

-Al

bigal_nz

635 posts

Ultimate Geek
+1 received by user: 32
Inactive user

#753416 30-Jan-2013 18:33

PS: I tried making the server a DMZ and that didnt work either!

bigal_nz

635 posts

Ultimate Geek
+1 received by user: 32
Inactive user

#753418 30-Jan-2013 18:40

First problem : I can ping one particular device on the LAN subnet, but the SERVER with the SMB share(same subnet) wont reply to pings.

Guess thats the first problem to over come.

-AL

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#753447 30-Jan-2013 19:33

Hang on, why are you using NAT at all? If the 2 subnets are directly connected via a single router than you don't even need port forwarding as one subnet can route directly to a host in the other? What devices etc. are you using and what are you trying to achieve?

Speedtest 2019-10-14

lyonrouge

1993 posts

Uber Geek
+1 received by user: 20

Trusted

Lifetime subscriber

#755113 3-Feb-2013 16:26

Replace SERVER with the IP address of your router. The server behind the NAT is not visible by its name from the outside.

bigal_nz

635 posts

Ultimate Geek
+1 received by user: 32
Inactive user

#755173 3-Feb-2013 18:49

Yeah your right, it needs to be the IP of the router, but still doesnt work.

I wonder if it has to do with the reply address?

Here is my diagram of what I *think* might be happening?

https://www.dropbox.com/s/dt7q9owe5y997ug/Drawing1%20%282%29.jpg?m

HTH

-Al

bigal_nz

635 posts

Ultimate Geek
+1 received by user: 32
Inactive user

#755203 3-Feb-2013 20:28

bigal_nz: Yeah your right, it needs to be the IP of the router, but still doesnt work.

I wonder if it has to do with the reply address?

Here is my diagram of what I *think* might be happening?

https://www.dropbox.com/s/dt7q9owe5y997ug/Drawing1%20%282%29.jpg?m

HTH

-Al

Yip - the air router needs to change the source to 192.168.150.243 for SMB requests going across it.

iptables -t nat -o eth0 -s 192.168.0.0/24 -J MASQUERADE

Or something like that!

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

lyonrouge

1993 posts

Uber Geek
+1 received by user: 20

Trusted

Lifetime subscriber

#755338 4-Feb-2013 08:39

What are your client and server SMB hosts. Recent (6.1 and above) windows versions do not require return path.

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#755364 4-Feb-2013 09:22

Hi Bigal_nz,
OKKKKK I think you need to look at a major redesign of your network. Firstly why have you got 2x routers connecting to the internet? Have you got connections with 2 different ISPs? Unless these are seperate networks due to one being say for you and one being say your neighbour you only need one router for everything. You have double NAT going on there which is REALLY bad with the stuff behind the air router.

The answers will come from this I think!

Speedtest 2019-10-14

lyonrouge

1993 posts

Uber Geek
+1 received by user: 20

Trusted

Lifetime subscriber

#755373 4-Feb-2013 09:43

I've only just looked at the diagram, honestly, left me a bit perplexed.

Dairyxox

1595 posts

Uber Geek
+1 received by user: 455

#755388 4-Feb-2013 09:53

I'm no expert in this particular field, but if it were me, I'd look at using a VPN over the WAN perhaps.

bigal_nz

635 posts

Ultimate Geek
+1 received by user: 32
Inactive user

#755697 4-Feb-2013 17:48

Zeon: Hi Bigal_nz,
OKKKKK I think you need to look at a major redesign of your network. Firstly why have you got 2x routers connecting to the internet? Have you got connections with 2 different ISPs? Unless these are seperate networks due to one being say for you and one being say your neighbour you only need one router for everything. You have double NAT going on there which is REALLY bad with the stuff behind the air router.

The answers will come from this I think!

There are reasons for doing it this way, and constrictions on what I can change and what I cant.

I guess I am fudging a solution with my hands tied to some extent.

Yes both the routers at the top of the diagram connect to the internet.

There are two different organisations involved. I only control the 192.168.150.0 subnet.

Proper routing would be best solution...but again I dont control the 192.168.0.0 network.

Mighty Ape

Shop now at Mighty Ape (affiliate link).

Zeon

3926 posts

Uber Geek
+1 received by user: 759

Trusted

#755712 4-Feb-2013 18:11

bigal_nz:
Zeon: Hi Bigal_nz,
OKKKKK I think you need to look at a major redesign of your network. Firstly why have you got 2x routers connecting to the internet? Have you got connections with 2 different ISPs? Unless these are seperate networks due to one being say for you and one being say your neighbour you only need one router for everything. You have double NAT going on there which is REALLY bad with the stuff behind the air router.

The answers will come from this I think!

There are reasons for doing it this way, and constrictions on what I can change and what I cant.

I guess I am fudging a solution with my hands tied to some extent.

Yes both the routers at the top of the diagram connect to the internet.

There are two different organisations involved. I only control the 192.168.150.0 subnet.

Proper routing would be best solution...but again I dont control the 192.168.0.0 network.

Hmm I see. Would it be an option to perhaps connect router2 to router1? Can we get some mroe info on the situation and your limitations? Don't need to name names of course ;p

Speedtest 2019-10-14

Spyware

3818 posts

Uber Geek
+1 received by user: 1366

Lifetime subscriber

#755729 4-Feb-2013 18:48

So you have a static route on Router 1 (192.168.150.1)??

192.168.0.0 255.255.255.0 gw=192.168.150.243

Spark Max Fibre using Mikrotik CCR1009-8G-1S-1S+, CRS125-24G-1S, Unifi UAP, U6-Pro, UAP-AC-M-Pro, Apple TV 4K (2022), Apple TV 4K (2017), iPad Air 1st gen, iPad Air 4th gen, iPhone 13, SkyNZ3151 (the white box). If it doesn't move then it's data cabled.

bigal_nz

635 posts

Ultimate Geek
+1 received by user: 32
Inactive user

#756766 7-Feb-2013 04:11

Zeon:
bigal_nz:
Zeon: Hi Bigal_nz,
OKKKKK I think you need to look at a major redesign of your network. Firstly why have you got 2x routers connecting to the internet? Have you got connections with 2 different ISPs? Unless these are seperate networks due to one being say for you and one being say your neighbour you only need one router for everything. You have double NAT going on there which is REALLY bad with the stuff behind the air router.

The answers will come from this I think!

There are reasons for doing it this way, and constrictions on what I can change and what I cant.

I guess I am fudging a solution with my hands tied to some extent.

Yes both the routers at the top of the diagram connect to the internet.

There are two different organisations involved. I only control the 192.168.150.0 subnet.

Proper routing would be best solution...but again I dont control the 192.168.0.0 network.

Hmm I see. Would it be an option to perhaps connect router2 to router1? Can we get some mroe info on the situation and your limitations? Don't need to name names of course ;p

Dont worry the iptables rule to do SNAT fixed it, so it had a return path:

iptables -t NAT -A POSTROUING -o br0 -j SNAT --to-source 192.168.150.243

Giving the packs a return address of 192.168.150.243 when crossing the Air Router.

Cheers

-Al