WAN Browsing with samba

Objective

Secure workgroup browsing across public Wide Area Networks

Linux Solution

A linux server running samba with freeSwan can provide a VPN with commercial grade security. Working configurations can be established with freely available applications. Security can be considerably enhanced with advanced firewall configurations. Commercial implementations are available.

Problem

For some configurations browsing does not work correctly - not all workgroups can be browsed when there is more than one workgroup per LAN

Samba is a unix/linux/windows interworking application which is of great interest to network administrators responsible for LANs that use both Windows and Unix/Linux operating systems. When used with freeswan (an ipsec implementation) the resulting Wide Area Network (multiple LANs interconnected through the Internet or other public networks) is able to provide commercial grade Virtual Private Networking. There is great interest in using this technology to permit browsing of workstations and workgroups across the WAN.

While this type of network has been implemented successfully, there are limitations that have created problems for the users of these networks. One of those problems arises when there are multiple workgroups on each LAN. Frequently this problem is first noticed when portable computers are moved from one LAN to another and must change their workgroup name to be visible to other users. As the attached material demonstrates, the solution to this problem is not simple.

There has been extensive discussion on the samba list of the problems associated with browsing multiple workgroups. The diagram helps describes why browsing multiple workgroups is problematic on Wide Area Networks.

Problem Definition

Server1 and Server2 are running Samba both as Domain Master Browsers (DMB) with the remote announce option enabled. Server1 is the WINS server

workgroup1 (netbios name = group1) : client1A(W98) & Server1(MB)
workgroup2 (name = group2) : client2A(W98) & Server2(MB)
workgroup3 (name = group3) : client1B(W98) & client1C(W98)(MB)
workgroup4 (name = group4) : client2B(W98) & client2C(W98)(MB)

In this configuration, when client2B examines the list of available workgroups, all 4 workgroups will be visible. However, an attempt to browse group3 (view the list of workstations in that workgroup) will fail since the WINS server will provide a broadcast address as the IP address of the Master Browser (MB) for group3 (client1C). Similarly, any client on Lan1 can not browse group4, again because the WINS server will provide a broadcast address for the MB for that workgroup. Since the broadcast address does not reach beyond the limits of the LAN, the MB never receives the request.

The solution for this problem is NOT simple.

Consider what happens if group3 and group4 have the same netbios name. On each LAN, one of the hosts will win the browser war and become the MB on that LAN (ie one on each LAN). Both those master browsers will attempt to register with the WINS server and (presumably) one of those registrations will be rejected because the name already exists. The result is especially problematic for WAN browsing where the WINS server may not be continuously available. The samba implementation of the SMB protocol has not yet found a solution for this problem.

Conclusion

The SMB protocol and the MS implementation of the SMB protocol differ in ways which create browsing problems on Wide Area Networks. The MS solution to those problems is proprietary and depends on WINS replication which is not available in samba. The way in which samba can overcome these problems is not clear and members of the samba team have indicated that this problem is not currently on their list of priorities. Until such time as a solution is found (see current progress on CIFS), network administrators will have to find their own solutions. Such solutions have to be found outside the scope of netbios, MS browsing, and WINS. For example, dynamic dns can assist in solving this problem.

Of course, other solutions may exist - but until now they have not been found and/or explained in the samba documentation. Contributions to this explanation - additions, corrections, explanations and especially solutions - would be much appreciated.

alex@avantel.ca

|Home|Contact|Services|