Re: [Openvpn-users] Beta11 - client-to-client

[Leonard Isham <leonard.isham@xxxxxxxxx>]

On Tue, 2 Nov 2004 08:12:22 +0100 (CET), Mathias Sundman
<mathias@xxxxxxxxxx> wrote:
> On Tue, 2 Nov 2004, Adam Pavelec wrote:
> 
> > I've been experiencing a problem regarding the client-to-client directive in
> > my bridged configuration.  It seems that when I have two or more remote
> > clients behind the same subnet requesting resources from eachother by netbios
> > name, their traffic is routed through the OpenVPN tunnel instead of being
> > routed locally.  I've been running Beta11 since its release, and it seems
> > that this issue has just recently appeared.  Am I missing something in my
> > server configuration to prevent this from happening?
> 
> I guess it "works as designed". As you have created a bridge you now have
> two "local subnets" connecting these two hosts, just like if you have had
> two physical network adapters in each machine and had connected them both
> between these machines.
> 
> It's a matter of name resolution. Unfortunally I don't know how you should
> be able to set a "prefered" subnet. Windows will probably broadcast both
> subnets, or use the IP address it receives from a WINS server if you have
> specified one.
> 
> I can only think of two ugly work arounds. Add the local hosts you want to
> communicate with locally to your LMHOSTS file or add statical entries in
> the WINS server.
> 
> You could also try the changing the network adapter binding order to see
> if that have any effect.
> 
> Maybe the metric value for the "local subnet" route can have some effect
> too.
> 
> --
> _____________________________________________________________
> Mathias Sundman                  (^)   ASCII Ribbon Campaign
> OpenVPN GUI for Windows           X    NO HTML/RTF in e-mail
> http://www.nilings.se/openvpn    / \   NO Word docs in e-mail
> 

OK without seeing your exact configuration here is what I believe is
happening, and I do have to say it does work as designed as this is
Microsoft's architecture controlling the behavior.

Assumptions:
1. The server site is the location of netbios resolution because one
of the following:
 - You are using WINS  at the server site
 - the remote site is always the master browser for theses systems
because of specific configuration or the fact that servers and domain
controllers are heavily favored.
2. The remote computers do not have any "infrastructure servers"

What happens:
1. Netbios resolution looks to the WINS server or master browser which
has the bridged IP address related to the netbios name.

Possible resolutions:
1. Add static entries into WINS with the local IP addresses for the
remote systems.
2. Change name resolution order to LMHOSTS first and maintain the file
on the machines.
3. Change to routing instead of tunneling.  (more complex from the
network side, but properly configured would resolve your netbios
issues)

-- 
Leonard Isham, CISSP
Ostendo non ostento.

____________________________________________
Openvpn-users mailing list
Openvpn-users@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/openvpn-users