11 replies to this topic

[lopess]

Does samba in openpli  9.0 support "wins server = x.x.x.x" ?

 

[WanWizard]

Probably.

 

But WINS, like NetBIOS, hasn't been used in Windows since Windows XP?

[lopess]

I have a network with Vlans. This is necessary because some vlans use a different Internet connection. This is not about separating vlans from each other, but about the ability to manage them and allocate a different WAN connection. However, this does not allow me to freely browse through various devices in the network environment. Traditionally, of course, I can view devices in the network environment that are within one VLAN, but not from others. Of course, I can manually assign the appropriate IP addresses, but that's not my point. That's why I thought about WINS. It seems to me that if you set one device as a WINS server, which would collect a list of devices from different VLANs and make it available to a given receiver. Am I thinking wrong?

[WanWizard]

That will work, providing you mean "using an NetBIOS browser" by "view devices" (like Windows Explorer), any Windows machine has NetBIOS over tcp enabled and runs in legacy mode (i.e. SMBv1 enabled), and any Samba service is configured for legacy mode too.

 

And you have the nessecary ports (137/138/139) open on the device that seperates the VLAN's.

 

This is an interesting read ( https://www.truenas....-than-ever.106/ ), in OpenPLi images from 8.0 onwards, WS-Discovery is enabled if samba is installed.

 

Note that SMBv1 is not secure, it isn't disabled for nothing since Windows 8.

[40H3X]

VLAN's are not mandatory for using another gateway, but apart from that, you state; "this does not allow me to freely browse through various devices in the network", "I can view devices in the network environment that are within one VLAN, but not from others."

 

VLAN's are used when you need multiple subnets using the same interface, so separation between these subnets is and integral part op this technique.

 

So if you want to access other subnets you must make appropriate FW rules in you router and for some devices there could also be need of IP masquerading, as some devices won't accept access from IP's  from other subnets (this is not the case for Enimga2 devices)

[WanWizard]

From an IP point of view, all true.

 

But the question is from a Windows point of view, i.e. which devices show up in the Explorer (formally know as Network Neighborhood).

 

In the old Windows NetBIOS world, when have a WINS database on a server, and you configure your clients for WINS, it would change the local segment broadcast to a directed broadcast, and would allow the client to query the WINS database for all Windows devices on all subnets (VLAN or physical).

 

But this mechanism is long dead, and all but burried. It was phased out after Active Directory was introduced, and now that all Windows systems have SMB1 disabled by default, it will no longer work on Windows without some major surgery. Enabling it in Samba is slightly less work, but we also disable SMBv1.

 

It has been replaced by WS-Discovery, which is a combination of UPNP and HTTP. Which also seems to be a pain getting it to work over subnet boundaries, as it needs multicast routing set up.

[40H3X]

…and getting multicast over other subnets can be, certainly for most users, a challenge. Locally I use a  multicast routing daemon for that.

[WanWizard]

My firewall supports it, but I haven't configured it as it is a bit of a pain getting it all setup, and I don't have an immediate need for it.

[lopess]

I don't think "WS-discovery" will help at all. Correct me if I'm wrong, but the assumption is that the "TTL/hop limit" is 1 and cannot be changed, which means that it is limited only to a given/local subnet.

[WanWizard]

Yes. and No.

 

WS-Discovery uses multicast, and multicast can be routed (if your router supports multicast routing). And alternatively your router could run a WS-Discovery proxy, which could forward the multicast messages onto another network.

 

In both cases though, it is not an automatic mechanism, it requires software support for your router, and configuration.

 

But imho re-enabling SMBv1 is a bad idea, It is hacked and will leave all your systems open to attack if a bad actor can gain access to your network (think about randomsware for example).

[lopess]

I have USG-XG-8 from Ubiquiti. My router supports mdns repeater and igmp-proxy, but it seems to me that this is not enough. In such a situation, I can only set one network as upstream and the other as downstream. I think I would need PIM support, but this router doesn't support it.

Edited by lopess, 9 March 2024 - 11:47.

[WanWizard]

Broadcast solutions are and always will be a bloody pain. mDNS / Bonjour / Avahi suffers from the same problem, and that can be addressed using DNS-SD.

 

Perhaps that is an option to look into (your will need a third-party tool to enable mDNS for win32 if you need low level resolving).