Mac OS X: tunnel OK, ping works, but no SMB connectivity

dominikhoffmann · ‎06-20-2002

I am using the VPN client for Mac OS X to connect to our corporate network. The problem that I have is that after starting the VPN connection (configured for split tunneling) I can ping the WINS server, but can't use it to resolve WINS names:

:

[localhost:~] admin% ping 10.20.1.10

PING 10.20.1.10 (10.20.1.10): 56 data bytes

64 bytes from 10.20.1.10: icmp_seq=0 ttl=127 time=28.909 ms

...

:

However, for whatever reason I can't query the WINS server:

:

[localhost:~] admin% smbutil lookup fr2

smbutil: can't get server address `10.20.1.10':

Unknown host

smbutil: can't resolve 10.20.1.10: syserr = Network is down

:

This is after I supplied the WINS server address in a file ~/.nsmbrc:

[default]

workgroup=XXXXXX

nbns=10.20.1.10

username=Dominik Hoffmann

:

I found out about how to use the FreeBSD smbutil command from a page at the BSD Devcenter <http://www.onlamp.com/pub/a/bsd/2001/11/15/Big_Scary_Daemons.html?page=1> at the O'Reilly Network.

:

What could be wrong? Would there be a problem with the Mac OS X machine being behind a NAT router connected to a cable modem? Having the cable modem ISP block port 80 shouldn't be a problem, should it?

dominikhoffmann · ‎06-24-2002

I have since tried to get somewhere by adding entries to the routing table. A traceroute to the host on the other side of the IPSec link that I can ping, reveals what appears the gateway:

:

[localhost:~/Unix/VPN Client] admin% traceroute 10.20.1.10

traceroute to 10.20.1.10 (10.20.1.10), 30 hops max, 40 byte packets

1 * router.subnet.isp.net (xxx.xxx.xxx.xxx) 29.12 ms 28.036 ms

2 10.20.1.10 (10.20.1.10) 75.116 ms 32.808 ms 35.64 ms

:

If I now add xxx.xxx.xxx.xxx to the routing table thus:

:

[localhost:~/Unix/VPN Client] admin% sudo route add -net 10 xxx.xxx.xxx.xxx

:

the routing table has an entry

:

[localhost:~/Unix/VPN Client] admin% netstat -rn

Routing tables

:

Internet:

Destination Gateway Flags Refs Use Netif Expire

default 192.168.1.1 UGSc 9 32 en0

10 xxx.xxx.xxx.xxx UGSc 0 0 en0

:

but now the ping breaks and I have no connectivity with the 3000 Concentrator side.

:

What am I doing wrong?

mclach · ‎06-27-2002

Hi Dominik.

I have set this up only with the following Samba Client, and have also

recommended customer to use this:

http://www.btinternet.com/~bioneural.net/smb.html

I do recommend that you do open a case on this though, this may take some testing in the laboratory.

In regard to the vpnclient and tracking where the packets are going can you grab the "vpnclient stat" command check where the packet count is encrypting, I think we may find that it is being "bypassed" rather then sent down the tunnel.

Thanks,

Cath