Access domain share over VPN from workgroup.

[Muffin-Man]

Hi there everyone

Right, we successfully created a vpn between two offices using netgear dg834 routers. One site is a domain and another a workgroup both with different subnets (lets say 10.0.0.0 & 192.168.0.0). PC's can ping each other from the domain to the workgroup and vice versa without a problem, even the domain controller (SBS2003) can VNC into one of the workgroup PC's (Win XP Pro).

BUT file sharing between the sites aren't working. I want to map a drive on a workgroup PC (Win XP Pro) that points to a folder a domain pc (WinXP Pro).

Any ideas?

 

[Prof.Merlin]

Taking a wild guess but dont the pc's have to be in the same IP class in order to do that? Both have to be in the 10.0.0.0 range or 192.168.0.0?

 

[atom_guy]

OK, you clearly have Layer 3 (IP) working (evident by the fact that you can ping between the two sites) as well as Layer 4 (TCP/UDP - proven by the fact that you can VNC) so there is likely some non-VPN related factor involved here. Unless you've got packet filters block specific types of TCP/UDP traffic, I would ignore the fact that you're using a VPN and concentrate on other things.

Can you ping the target machine both by name as well? Have you tried mapping a drive to the IP address and seeing if that works?

A common mistake is also to point your client PCs at the ISP's DNS. This will prevent them from resolving internal host names and - since you've got a routed set-up where NetBIOS broadcasts would be blocked - the machines won't be able to resolve names to IP's by "shouting" over the network either.

Point your client PCs at your domain controller for DNS, and your domain controller to the Internet. In most cases, you will not need to configure anything on the domain controller for this to work.

 

[atom_guy]

Ultra-v16: the beauty of IP is that it doesn't care what your IP address is. All an IP address is is a lazy-man's representation of a number that can be between 1 and 16 million. All an individual machine/router cares about is: "if I can't reach this particular number range directly, who do I send this to?" That's the purpose of a default gateway.

Some trivia: The IP address 192.168.0.50 can therefore also be represented as a number, 3232235570, or ((((192)*256 + 168) * 256 + 0) * 256 + 50) * 256. Try it for yourself: run "ping 3232235570" from a command prompt and see what the result is (no, I'm not being malicious, it won't break anything.)

In this case, a device X, configure with 10.0.0.50, would forward traffic to its default gateway, the VPN router (say, 10.0.0.1) for any traffic it doesn't know how to handle (say, stuff going to 192.168.0.50.). The VPN router will look at its configuration, see that it knows how to reach 192.168.0.0/24 (through a VPN interface in this case), and forward it on to the receiving end of the VPN tunnel. The receiving end would place the packet on the wire for the 192.168.0.50 device to receive. Return traffic would then follow the same process in reverse.

 

[Prof.Merlin]

Kewl...now I know as well.

Thank you

 

[Muffin-Man]

Yes, I can ping them with IP addresses but we dont want the workgroup PC to use the Domain's DNS server. Tried mapping a drive with the IP of the target machine but it cant browse that machine (even if I choose to log in with different credentials, eg.
Username: [domain]\[username]
Password: [password]

 

[atom_guy]

Can you elaborate on "can't browse that machine"? Any events in the logs on the destination machine?

If you're not going to point the client machines at a DNS server, you're going to have to put entries into the LMHOST files of all of them. This generally ends up being a complete mess... any reason why you don't want them to use your DNS? Third party?

 

[abdulgani]

Ensure that you have the latest firmware on your Netgear DG834 routers. That solved the problem for me.