5

I have setup a wireguard vpn network between three computer.

  • A) My Home-PC that is running a wireguard client and wants to connect to my sambashare at my office-server C).
  • B) My Home-Server that is acting as my wireguard-server / endpoint. A) and C) connect to this one.
  • C) My Office-Server that has the samba-share that I want to access via wireguard.

  • Forwarding seems to work properly because:

    • I can ping from A) to C) and from C) to A). When using the wireguard interface ip of C).
    • I can also SSH from A) to C). When using the wireguard interface ip of C).

I think the problem relies in my smb.conf or how smbd.service binds to the interfaces that I specified in smb.conf because:

  • I can NOT access my Samba-Share at C) when using the wireguard ip address.
  • I can access my Samba-Share at C) when specifying the eth0 ip address.

This is how my smb.conf file looks like:

#### Networking ####

# The specific set of interfaces / networks to bind to
# This can be either the interface name or an IP address/netmask;
# interface names are normally preferred
;   interfaces = 127.0.0.0/8 eth0
   interfaces = lo eth0 wg-buero-tunnel

# Only bind to the named interfaces and/or networks; you must use the
# 'interfaces' option above to use this.
# It is recommended that you enable this feature if your Samba machine is
# not protected by a firewall or is a firewall itself.  However, this
# option cannot handle dynamic or non-broadcast interfaces correctly.
;   bind interfaces only = yes
   bind interfaces only = yes

and this is the output of netstat -tulpen | grep smbd

tcp        0      0 127.0.0.1:139           0.0.0.0:*               LISTEN      0          17353      1023/smbd
tcp        0      0 192.168.124.177:139     0.0.0.0:*               LISTEN      0          17349      1023/smbd
tcp        0      0 127.0.0.1:445           0.0.0.0:*               LISTEN      0          17352      1023/smbd
tcp        0      0 192.168.124.177:445     0.0.0.0:*               LISTEN      0          17348      1023/smbd

The IP's here should correspond to the devices that I specified in the smb.conf but one IP/device is still missing.

lo 127.0.0.1

eth0 192.168.124.177

wg-buero-tunnel The wireguard ip is missing completely

I am really running out of ideas here.

Improve this question

6 Answers 6

Reset to default
4

Samba will not listen on the Wireguard interface if the interface address/mask is not explicitly specified, but if the interfaces are restricted by interfaces = ... and bind interfaces only = yes.

The solution is to specify the IP address/mask for the Wireguard interface. e.g.

interfaces = lo eth0 10.8.0.0/24

This is also clear from Samba documentation smb.conf: interfaces

... By default Samba will query the kernel for the list of all active interfaces and use any interfaces except 127.0.0.1 that are broadcast capable. ...
... The "mask" parameters can either be a bit length (such as 24 for a C class network) or a full netmask in dotted decimal form.

It is well known that Wireguard doesn't support broadcasting and why not. These are the consequences for Samba: It is not possible to use the other three alternatives to specify interfaces described there like 2) the interface name or 3) the ip address only or 4) the broadcast address/mask, because Wireguard doesn't support broadcasting.

You can verify it also by ip link command:

eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ... 
    link/ether ...
wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> ...      # without "BROADCAST"
    link/none
Improve this answer
2

The solutions proposed here did not work for me, in my case the solution was to set

bind interfaces only = no

in the /etc/samba/smb.conf.template file. This way Samba will listen on all interfaces, no matter broadcast or not.

This may create a little bit of a downside, the samba share must be accessed by IP, not by name, so for example

\\192.168.1.1    - works
\\SAMBA_SHARE    - does not work

but is not a big issue.

Improve this answer
1

To make things like Samba (or similar stuff that needs bcasts) work on wireguard tunnels, you can use a vxlan tunnel on top of wireguard.

This encapsulation (vxlan) acts more or less like a "real" network interface, with brordcasts/multicasts/etc fully working, at least in my scenarios.

I've set some of these tunnels and they perform really well, even with the performance penalty of the two encapsulation. Configuration is also rather easy via the command "ip link add", you can find many examples on the net, I got inspiration from this (very interesting) article (removed, I leave link with IA):

https://web.archive.org/web/20200708181943/https://insom.github.io/journal/2017/04/02/

https://gist.github.com/pamolloy/f464c2b54af03c436491f42abf0bbff9

Improve this answer
1

The additional factor which gave me these symptoms was my ufw firewall. It needs to be opened to the wireguard interface. I could ping and ssh but of course ssh was already open through the firewall.

sudo ufw allow in on wg-buero-tunnel proto tcp to any port 139
sudo ufw allow in on wg-buero-tunnel proto tcp to any port 445
sudo ufw allow in on wg-buero-tunnel proto udp to any port 137
sudo ufw allow in on wg-buero-tunnel proto udp to any port 138
Improve this answer
0

I think that's because samba can only listen on broadcast-capable interfaces

  • Parameter: interfaces
  • Type: string
  • Description: Network interfaces Samba will respond to. Allows changes to defaults.
  • Default: All available interfaces capable of broadcasts

It doesn't say what happens with non-default, but I would guess so.

Improve this answer
0

Its interesting to see how there are already detailed and specific answers to solve the problem at hand, while in my case - with pretty much the same setup as the OP - the simple addition of the VPN subnet to the hosts allow section in the /etc/samba/smb.conf (on arch) already did the trick:

hosts allow = 192.168.10. 192.168.2. 127.

Here, 192.168.2. is my LAN subnet and 192.168.10. is my wireguard VPN subnet. I can connect to the SMB server from a device on WAN through the VPN without changing anything else. I can read/write data at what seems like normal speeds. So I am not sure what the impact of wireguard not supporting broadcast has on this, despite maybe discovery not working.

Improve this answer
2
  • Hey there, does your client see your smb server name in your smb network, or do you have to setup your smb client to explicitly connect to the servers wireguard ip to be able to connect to the server?
    – AlexOnLinux
    Commented Sep 15, 2021 at 11:05
  • I have not tested this, as I just assign a drive letter to the SMB share with a static IP address (the LAN one).
    – Markus Ressel
    Commented Oct 18, 2021 at 10:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .