Windows file sharing over different subnets

Windows file sharing over different subnets

[Y Makki]

Hello,

I'm faced with a problem on my network, I'll start by describing the
structure. The router is a redhat box, with 3 network cards:
eth0 goes to the dsl modem, ppp0
eth1 goes to the 192.168.1.0 network which contains a Windows 2000 file
server (192.168.1.3)
eth2 goes to 192.168.2.0 which contains windows clients, mostly Win98

Is it possible to allow clients to see/use the file server? what I have
done so far is add "option netbios-name-servers 192.168.1.3;" to
dhcpd.conf and issue the following on the gateway:

ip route add 224.0.0.0/4 dev eth1
route add -net 255.255.255.255 netmask 255.255.255.255 eth1

tcpdump shows some activity when trying to browse network neighborhood
from the fileserver:

a client (192.168.2.2)
----------------------
02:40:58.548757 arp reply 192.168.2.2 is-at 0:40:5:72:f6:6a
02:40:58.549485 192.168.2.2.microsoft-ds > 192.168.1.3.1214: R [tcp sum
ok] 0:0(0) ack 673608238 win 0 (ttl 128, id 3584, len 40)
02:40:58.549552 192.168.2.2.netbios-ssn > 192.168.1.3.1215: S [tcp sum
ok] 197681:197681(0) ack 673643567 win 8760 <mss 1460,nop,nop,sackOK>
(DF) (ttl 128, id 3840, len 48)

the fileserver (192.168.1.3)
----------------------------
02:41:01.476626 192.168.1.3.1215 > 192.168.2.2.netbios-ssn: S [tcp sum
ok] 673643566:673643566(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl
128, id 13498, len 48)
02:41:01.476736 192.168.1.3.1214 > 192.168.2.2.microsoft-ds: S [tcp sum
ok] 673608237:673608237(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl
128, id 13499, len 48)
02:41:02.242490 192.168.1.3.1220 > 192.168.1.1.domain:  [udp sum ok] 49+
A? 192.gateway.localdomain. [|domain] (ttl 128, id 13500, len 69)
02:41:02.243234 192.168.1.3.netbios-ns > 192.168.1.255.netbios-ns:  [udp
sum ok]
>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
TrnID=0x823B
OpCode=0
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=192             NameType=0x20 (Server)
QuestionType=0x20
QuestionClass=0x1

This goes on for a while, after which win2k says "192.168.2.2" cannot be
found. Browsing from the client 192.168.2.2 yields no results.

Any ideas/hints greatly appreciated.

Re: Windows file sharing over different subnets

[Andrew J. Meader]

Hi,

Netbios is not routable (without help.) Make sure iptables is allowing 
port 139 and make sure both network segments share a common wins server. 
This is painfully obvious, but, can you ping from one segment to the 
other segment?

Have fun.

Andy

Y Makki wrote:

>Hello,
>
>I'm faced with a problem on my network, I'll start by describing the
>structure. The router is a redhat box, with 3 network cards:
>eth0 goes to the dsl modem, ppp0
>eth1 goes to the 192.168.1.0 network which contains a Windows 2000 file
>server (192.168.1.3)
>eth2 goes to 192.168.2.0 which contains windows clients, mostly Win98
>
>Is it possible to allow clients to see/use the file server? what I have
>done so far is add "option netbios-name-servers 192.168.1.3;" to
>dhcpd.conf and issue the following on the gateway:
>
>ip route add 224.0.0.0/4 dev eth1
>route add -net 255.255.255.255 netmask 255.255.255.255 eth1
>
>tcpdump shows some activity when trying to browse network neighborhood
>from the fileserver:
>
>a client (192.168.2.2)
>----------------------
>02:40:58.548757 arp reply 192.168.2.2 is-at 0:40:5:72:f6:6a
>02:40:58.549485 192.168.2.2.microsoft-ds > 192.168.1.3.1214: R [tcp sum
>ok] 0:0(0) ack 673608238 win 0 (ttl 128, id 3584, len 40)
>02:40:58.549552 192.168.2.2.netbios-ssn > 192.168.1.3.1215: S [tcp sum
>ok] 197681:197681(0) ack 673643567 win 8760 <mss 1460,nop,nop,sackOK>
>(DF) (ttl 128, id 3840, len 48)
>
>the fileserver (192.168.1.3)
>----------------------------
>02:41:01.476626 192.168.1.3.1215 > 192.168.2.2.netbios-ssn: S [tcp sum
>ok] 673643566:673643566(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl
>128, id 13498, len 48)
>02:41:01.476736 192.168.1.3.1214 > 192.168.2.2.microsoft-ds: S [tcp sum
>ok] 673608237:673608237(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl
>128, id 13499, len 48)
>02:41:02.242490 192.168.1.3.1220 > 192.168.1.1.domain:  [udp sum ok] 49+
>A? 192.gateway.localdomain. [|domain] (ttl 128, id 13500, len 69)
>02:41:02.243234 192.168.1.3.netbios-ns > 192.168.1.255.netbios-ns:  [udp
>sum ok]
>  
>
>>>>NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
>>>>        
>>>>
>TrnID=0x823B
>OpCode=0
>NmFlags=0x11
>Rcode=0
>QueryCount=1
>AnswerCount=0
>AuthorityCount=0
>AddressRecCount=0
>QuestionRecords:
>Name=192             NameType=0x20 (Server)
>QuestionType=0x20
>QuestionClass=0x1
>
>This goes on for a while, after which win2k says "192.168.2.2" cannot be
>found. Browsing from the client 192.168.2.2 yields no results.
>
>Any ideas/hints greatly appreciated.
>

Re: Windows file sharing over different subnets

[Y Makki]

Hi,

I don't really need a wins server on the eth1 segment since there are no
windows machines here except the file server, the eth2 segment has no
servers at all.

For testing I have set the FORWARD default policy to ACCEPT, and allow
all incoming traffic from both eth1 and eth2.
I also tried earlier to DNAT any 135:139 traffic coming from eth2 to the
fileserver, which did not help. Ping works from segment to segment.

Maybe there is a client or relay agent of some sort I could install on
the linux gateway, I don't know.



On Thu, 2003-03-27 at 14:17, Andrew J. Meader wrote:
> Hi,
> 
> Netbios is not routable (without help.) Make sure iptables is allowing 
> port 139 and make sure both network segments share a common wins server. 
> This is painfully obvious, but, can you ping from one segment to the 
> other segment?
> 
> Have fun.
> 
> Andy
> 
> Y Makki wrote:
> 
> >Hello,
> >
> >I'm faced with a problem on my network, I'll start by describing the
> >structure. The router is a redhat box, with 3 network cards:
> >eth0 goes to the dsl modem, ppp0
> >eth1 goes to the 192.168.1.0 network which contains a Windows 2000 file
> >server (192.168.1.3)
> >eth2 goes to 192.168.2.0 which contains windows clients, mostly Win98
> >
> >Is it possible to allow clients to see/use the file server? what I have
> >done so far is add "option netbios-name-servers 192.168.1.3;" to
> >dhcpd.conf and issue the following on the gateway:
> >
> >ip route add 224.0.0.0/4 dev eth1
> >route add -net 255.255.255.255 netmask 255.255.255.255 eth1
> >
> >tcpdump shows some activity when trying to browse network neighborhood
> >from the fileserver:
> >
> >a client (192.168.2.2)
> >----------------------
> >02:40:58.548757 arp reply 192.168.2.2 is-at 0:40:5:72:f6:6a
> >02:40:58.549485 192.168.2.2.microsoft-ds > 192.168.1.3.1214: R [tcp sum
> >ok] 0:0(0) ack 673608238 win 0 (ttl 128, id 3584, len 40)
> >02:40:58.549552 192.168.2.2.netbios-ssn > 192.168.1.3.1215: S [tcp sum
> >ok] 197681:197681(0) ack 673643567 win 8760 <mss 1460,nop,nop,sackOK>
> >(DF) (ttl 128, id 3840, len 48)
> >
> >the fileserver (192.168.1.3)
> >----------------------------
> >02:41:01.476626 192.168.1.3.1215 > 192.168.2.2.netbios-ssn: S [tcp sum
> >ok] 673643566:673643566(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl
> >128, id 13498, len 48)
> >02:41:01.476736 192.168.1.3.1214 > 192.168.2.2.microsoft-ds: S [tcp sum
> >ok] 673608237:673608237(0) win 16384 <mss 1460,nop,nop,sackOK> (DF) (ttl
> >128, id 13499, len 48)
> >02:41:02.242490 192.168.1.3.1220 > 192.168.1.1.domain:  [udp sum ok] 49+
> >A? 192.gateway.localdomain. [|domain] (ttl 128, id 13500, len 69)
> >02:41:02.243234 192.168.1.3.netbios-ns > 192.168.1.255.netbios-ns:  [udp
> >sum ok]
> >  
> >
> >>>>NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
> >>>>        
> >>>>
> >TrnID=0x823B
> >OpCode=0
> >NmFlags=0x11
> >Rcode=0
> >QueryCount=1
> >AnswerCount=0
> >AuthorityCount=0
> >AddressRecCount=0
> >QuestionRecords:
> >Name=192             NameType=0x20 (Server)
> >QuestionType=0x20
> >QuestionClass=0x1
> >
> >This goes on for a while, after which win2k says "192.168.2.2" cannot be
> >found. Browsing from the client 192.168.2.2 yields no results.
> >
> >Any ideas/hints greatly appreciated.
> >
> 
> 

Re: Windows file sharing over different subnets

[Andrew J. Meader]

If you don't want to run wins on your nt2k box then you should work with 
the lmhosts file. lmhosts.sam is a good reference for what you are 
trying to do. You can use Samba to do some netbios forwarding but for 
what you are doing that might be overkill. Read lmhosts.sam (on one of 
the windows boxes.)

Andy

Y Makki wrote:

>Hi,
>
>I don't really need a wins server on the eth1 segment since there are no
>windows machines here except the file server, the eth2 segment has no
>servers at all.
>
>For testing I have set the FORWARD default policy to ACCEPT, and allow
>all incoming traffic from both eth1 and eth2.
>I also tried earlier to DNAT any 135:139 traffic coming from eth2 to the
>fileserver, which did not help. Ping works from segment to segment.
>
>Maybe there is a client or relay agent of some sort I could install on
>the linux gateway, I don't know.
>

Re: Windows file sharing over different subnets

[Richard Doyle]

On the other hand, WINS has some advantages over lmhosts: it is dynamic
and your dhcp server can instruct the clients to use the wins server
instead of sending out broadcasts (add an "option netbios-node-type 2"
statement to your dhcpd configuration file; see man dhcp-options).

You may find some way to route broadcast traffic, but that way lies
madness...

-Richard

do netbios over tcp/ip peering instead of broadcasts
On Thu, 2003-03-27 at 11:40, Andrew J. Meader wrote:
> If you don't want to run wins on your nt2k box then you should work with 
> the lmhosts file. lmhosts.sam is a good reference for what you are 
> trying to do. You can use Samba to do some netbios forwarding but for 
> what you are doing that might be overkill. Read lmhosts.sam (on one of 
> the windows boxes.)
> 
> Andy
> 
> Y Makki wrote:
> 
> >Hi,
> >
> >I don't really need a wins server on the eth1 segment since there are no
> >windows machines here except the file server, the eth2 segment has no
> >servers at all.
> >
> >For testing I have set the FORWARD default policy to ACCEPT, and allow
> >all incoming traffic from both eth1 and eth2.
> >I also tried earlier to DNAT any 135:139 traffic coming from eth2 to the
> >fileserver, which did not help. Ping works from segment to segment.
> >
> >Maybe there is a client or relay agent of some sort I could install on
> >the linux gateway, I don't know.
> >

RE: Windows file sharing over different subnets

[Daniel Chemko]

1. Is File sharing enabled on the win98 box? I am not sure it is
'visible' without it.

2. The server is trying to find NetBIOS String ("192.168.2.2") on the
network, which will fail. The followup would be to search WINS for it.
If the WINS server on windows 2000 does not have that computer
registered, then the machine cannot be resolved. Can you look at your
wins server on 192.168.1.3 and see an entry for your win98 clients that
allegedly registered with it?

3. Make sure the win98 computers are configured for wins automatically.
Sometimes it is set for manual or disabled wins settings.

RE: Windows file sharing over different subnets

[ymakki]

I enabled file sharing on the win98 box and shared a folder to test, i
had the same thought you did. 

The win98 client is configured to use 'dns for wins resolution',
although I have done nothing yet with dns on the router box, it runs
bind; I don't know if that is even relevant to be honest. 

I added the client entry into win2k's lmhosts.sam and ran nbtstat- R,
still can't browse the client from the server even with \\192.168.2.2\

Also added the rules mentioned to dnat broadcasts originating on both
subnets to the other one.

Here's something new, a tcpdump on the client (192.168.2.2) while trying
to access it through the win2k server (192.168.1.3):

17:28:12.327623 192.168.2.2.microsoft-ds > 192.168.1.3.1079: R [tcp sum
ok] 0:0(0) ack 228195974 win 0 (ttl 128, id 10240, len 40)
17:28:12.327981 192.168.2.2.netbios-ssn > 192.168.1.3.socks: S [tcp sum
ok] 254406:254406(0) ack 228254317 win 8760 <mss 1460,nop,nop,sackOK>
(DF) (ttl 128, id 10496, len 48)
17:28:12.329218 192.168.2.2.netbios-ssn > 192.168.1.3.socks: FP [tcp sum
ok] 1:6(5) ack 73 win 8688
>>> NBT Packet
NBT SessionReject
Flags=0x83000001
Reason=0x82
Called name not present

 (DF) (ttl 128, id 10752, len 45)


I'm breaking my head over this..



On Thu, 2003-03-27 at 15:15, Daniel Chemko wrote: 
> 1. Is File sharing enabled on the win98 box? I am not sure it is
> 'visible' without it.
> 
> 2. The server is trying to find NetBIOS String ("192.168.2.2") on the
> network, which will fail. The followup would be to search WINS for it.
> If the WINS server on windows 2000 does not have that computer
> registered, then the machine cannot be resolved. Can you look at your
> wins server on 192.168.1.3 and see an entry for your win98 clients that
> allegedly registered with it?
> 
> 3. Make sure the win98 computers are configured for wins automatically.
> Sometimes it is set for manual or disabled wins settings.
> 
> 
> 

RE: Windows file sharing over different subnets

[Y Makki]

Hello,

Just thought I'd post to let you guys know how I got it to work.

On the Linux side, 2 simple things: enable IP forwarding and make sure
it's -P FORWARD ACCEPT or add 135:139 + whatever relevant traffic.

On the Windows side I removed netbios/netbeui from all 9x clients, and
checked 'client for microsoft networks' in bindings under tcp properties
for the ethernet adapter.

With this you can browse computers even over different subnets using
\\IP, or maybe add netbios names to lmhosts on each machine (which I
didn't bother trying). I took the other alternative which is install
Samba on the router and have it run as a WINS server; everything works
like a charm.

Thanks for the suggestions/help everyone

Cheers.


On Thu, 2003-03-27 at 16:24, Daniel Chemko wrote:
> I would really suggest WINS even if you only have 1 server, etc.. It is
> ment for interLAN communication like the one you describe.
> 
> Oh, another thing would be to broadcast to each other's networks. I am
> not sure if NetBIOS likes this, but here goes.
> 
> iptables -t nat -A PREROUTING --destination 192.168.1.255 -j DNAT
> --to-destination 192.168.2.255
> 
> iptables -t nat -A PREROUTING --destination 192.168.2.255 -j DNAT
> --to-destination 192.168.1.255
> 
> This effectively merges the subnets together on the broadcast range. Any
> broadcasts to one would go to the other.
> 
> If my hypothesis is correct, a request for 192.168.2.2 would be detected
> since 192.168.2.2 would service the request for itself.
> 
> Any SMB guru's can throw their 2 cents in any time :-)
> 
> 
> -----Original Message-----
> From: Y Makki [mailto:bugzilla@sympatico.ca] 
> Sent: Thursday, March 27, 2003 11:41 AM
> To: Andrew J. Meader
> Cc: netfilter@lists.netfilter.org
> Subject: Re: Windows file sharing over different subnets
> 
> Hi,
> 
> I don't really need a wins server on the eth1 segment since there are no
> windows machines here except the file server, the eth2 segment has no
> servers at all.
> 
> For testing I have set the FORWARD default policy to ACCEPT, and allow
> all incoming traffic from both eth1 and eth2.
> I also tried earlier to DNAT any 135:139 traffic coming from eth2 to the
> fileserver, which did not help. Ping works from segment to segment.
> 
> Maybe there is a client or relay agent of some sort I could install on
> the linux gateway, I don't know.
> 
> 
> 
> On Thu, 2003-03-27 at 14:17, Andrew J. Meader wrote:
> > Hi,
> > 
> > Netbios is not routable (without help.) Make sure iptables is allowing
> 
> > port 139 and make sure both network segments share a common wins
> server. 
> > This is painfully obvious, but, can you ping from one segment to the 
> > other segment?
> > 
> > Have fun.
> > 
> > Andy
> > 
> > Y Makki wrote:
> > 
> > >Hello,
> > >
> > >I'm faced with a problem on my network, I'll start by describing the
> > >structure. The router is a redhat box, with 3 network cards:
> > >eth0 goes to the dsl modem, ppp0
> > >eth1 goes to the 192.168.1.0 network which contains a Windows 2000
> file
> > >server (192.168.1.3)
> > >eth2 goes to 192.168.2.0 which contains windows clients, mostly Win98
> > >
> > >Is it possible to allow clients to see/use the file server? what I
> have
> > >done so far is add "option netbios-name-servers 192.168.1.3;" to
> > >dhcpd.conf and issue the following on the gateway:
> > >
> > >ip route add 224.0.0.0/4 dev eth1
> > >route add -net 255.255.255.255 netmask 255.255.255.255 eth1
> > >
> > >tcpdump shows some activity when trying to browse network
> neighborhood
> > >from the fileserver:
> > >
> > >a client (192.168.2.2)
> > >----------------------
> > >02:40:58.548757 arp reply 192.168.2.2 is-at 0:40:5:72:f6:6a
> > >02:40:58.549485 192.168.2.2.microsoft-ds > 192.168.1.3.1214: R [tcp
> sum
> > >ok] 0:0(0) ack 673608238 win 0 (ttl 128, id 3584, len 40)
> > >02:40:58.549552 192.168.2.2.netbios-ssn > 192.168.1.3.1215: S [tcp
> sum
> > >ok] 197681:197681(0) ack 673643567 win 8760 <mss 1460,nop,nop,sackOK>
> > >(DF) (ttl 128, id 3840, len 48)
> > >
> > >the fileserver (192.168.1.3)
> > >----------------------------
> > >02:41:01.476626 192.168.1.3.1215 > 192.168.2.2.netbios-ssn: S [tcp
> sum
> > >ok] 673643566:673643566(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
> (ttl
> > >128, id 13498, len 48)
> > >02:41:01.476736 192.168.1.3.1214 > 192.168.2.2.microsoft-ds: S [tcp
> sum
> > >ok] 673608237:673608237(0) win 16384 <mss 1460,nop,nop,sackOK> (DF)
> (ttl
> > >128, id 13499, len 48)
> > >02:41:02.242490 192.168.1.3.1220 > 192.168.1.1.domain:  [udp sum ok]
> 49+
> > >A? 192.gateway.localdomain. [|domain] (ttl 128, id 13500, len 69)
> > >02:41:02.243234 192.168.1.3.netbios-ns > 192.168.1.255.netbios-ns:
> [udp
> > >sum ok]
> > >  
> > >
> > >>>>NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
> > >>>>        
> > >>>>
> > >TrnID=0x823B
> > >OpCode=0
> > >NmFlags=0x11
> > >Rcode=0
> > >QueryCount=1
> > >AnswerCount=0
> > >AuthorityCount=0
> > >AddressRecCount=0
> > >QuestionRecords:
> > >Name=192             NameType=0x20 (Server)
> > >QuestionType=0x20
> > >QuestionClass=0x1
> > >
> > >This goes on for a while, after which win2k says "192.168.2.2" cannot
> be
> > >found. Browsing from the client 192.168.2.2 yields no results.
> > >
> > >Any ideas/hints greatly appreciated.
> > >
> > 
> > 
> 
> 
> 

RE: Windows file sharing over different subnets

[Raymond Leach]

[-- Attachment #1: Type: text/plain, Size: 1492 bytes --]

On Sat, 2003-03-29 at 09:31, Y Makki wrote:
> Hello,
> 
> Just thought I'd post to let you guys know how I got it to work.
> 
> On the Linux side, 2 simple things: enable IP forwarding and make sure
> it's -P FORWARD ACCEPT or add 135:139 + whatever relevant traffic.
> 
If you use Win2K and/or WinXP then you should also add port 445.

> On the Windows side I removed netbios/netbeui from all 9x clients, and
> checked 'client for microsoft networks' in bindings under tcp properties
> for the ethernet adapter.
> 
On Win9x it is impossible to remove Netbios/Netbui. Even if you remove
the 'service' from the network setup, you will notice that on the tcp/ip
page the option to select/deselct netbios over ip is disabled. That is
because netbios over ip is required by win9x for file and print sharing.

If you disable netbios over ip on win2k and/or winxp, then they use port
445 for file and print sharing and they use ip instead of netbios
tunneled in an ip packet. However, this will result in win9x machines
not being able to see or connect to your win2k and winxp machines.


> With this you can browse computers even over different subnets using
> \\IP, or maybe add netbios names to lmhosts on each machine (which I
> didn't bother trying). I took the other alternative which is install
> Samba on the router and have it run as a WINS server; everything works
> like a charm.
> 
> Thanks for the suggestions/help everyone
> 
> Cheers.

<<snip>>


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]