Server doesn't see share on remote machine connected via VPN

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Tom Stoddard - 18 May 2006 00:31 GMT

I have indirect synchronization set up on a server which I can connect to
via a VPN. When I initiate an indirect synchronization from the remote
machine I can see a message being dropped in the dropbox on the folder but
when the synchronizer on the server tries to send data back to the remote
machine it fails because it doesn't find the remote machine.

Is this happening because of the way VPN works? Is there something I can do
to change this behavior?

Thanks!

Reply to this Message

David W. Fenton - 18 May 2006 16:35 GMT

> I have indirect synchronization set up on a server which I can
> connect to via a VPN. When I initiate an indirect synchronization
[quoted text clipped - 5 lines]
> Is this happening because of the way VPN works? Is there something
> I can do to change this behavior?

There are a number of issues, but let me repeat something I've said
before: most of the problems getting indirect replication working
are with layers that are outside Jet, and most commonly with
networking issues. I'm lucky in that I have a decade of networking
and NT administration experience under my belt, so I don't have too
many problems. But most people trying indirect replication don't
have that experience and run into problems.

That said, the possible causes:

1. a firewall somewhere is blocking access.

2. NETBIOS over TCP/IP may be turned off. See if you can ping the IP
address of the remote machine. With a VPN there are probably 2
different IP address's that the remote machine could be known as.
Either one should be accessible.

The solution to #1 is to put the IP address of the remote machine in
the local firewall's trusted sites listing (however that's
accomplished with that particular firewall).

The solution to #2 is to put an entry for the machine in the HOSTS
file of the local machine that maps the machine name to both of its
IP addresses.

Signature

David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

Reply to this Message

Tom Stoddard - 20 May 2006 15:35 GMT

Thanks David! You were right; the local machine is running Windows XP which
used Windows built in firewall by default on the VPN connection. I turned
the firewall off and the synchronization worked perfectly.

Now all I have to do is figure out how to find the firewall's "trusted
list".

>> I have indirect synchronization set up on a server which I can
>> connect to via a VPN. When I initiate an indirect synchronization
[quoted text clipped - 30 lines]
> file of the local machine that maps the machine name to both of its
> IP addresses.

Reply to this Message

David W. Fenton - 20 May 2006 18:42 GMT

> You were right; the local machine is running Windows XP which
> used Windows built in firewall by default on the VPN connection. I
> turned the firewall off and the synchronization worked perfectly.

It makes absolutely no sense for the firewall to be active on a VPN
connection, seems to me. It's a private network so I can't see why
there'd need to be any more limitations on connections than there
would be on a LAN connection.

Signature

David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

Reply to this Message

larsdennert@gmail.com - 22 May 2006 18:21 GMT

Windows firewall is pretty worthless except for the most basic user.
Programs can add themselves to the exception list. Even if Windows
networking is on the exception list, routed ip addresses still get
blocked if the remote machine is on a different sub net. Meaning vpn
networking traffic always gets blocked by it.

Reply to this Message

David W. Fenton - 22 May 2006 21:33 GMT

> Windows firewall is pretty worthless except for the most basic user.
> Programs can add themselves to the exception list. Even if Windows
> networking is on the exception list, routed ip addresses still get
> blocked if the remote machine is on a different sub net. Meaning vpn
> networking traffic always gets blocked by it.

Well, I'd say Windows Firewall is better than no firewall at all, but
for a VPN connection, there's really no justification for having it
activated that I can think of.

Since the networking activates Windows Firewall per connection, it's
possible to use it on your base Internet connection while *not* using
within the VPN tunnel. That's certainly the way I'd set it up.

Signature

David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

Reply to this Message

larsdennert@gmail.com - 23 May 2006 18:40 GMT

So there must be a way to exclude a subnet from the windows firewall. I
haven't seen that functionality. I usually just turn it off for roaming
vpn users and then turn off file sharing as well.

Instead of antivirus software I restrict user rights and file
permissions. Most external email has antivirus and it's a crap shoot
for the browser.

I've had good luck with that and no antivirus to slow things down.

Reply to this Message

David W. Fenton - 24 May 2006 00:52 GMT

> So there must be a way to exclude a subnet from the windows
> firewall.

I don't know that there is, but it's really easy to simply turn off
the firewall for the VPN client connection, as it serves no
protection beyond what is provided by the firewall on the underlying
Internet connection that the VPN tunnel is running withing.

Well, I guess there's one exception, and that would be machines
infected with worms on the network on the other end of the VPN.

> . . . I
> haven't seen that functionality. I usually just turn it off for
[quoted text clipped - 5 lines]
>
> I've had good luck with that and no antivirus to slow things down.

I don't use AV software myself, but I don't let my clients try to
get by without it. They aren't technically savvy enough to protect
themselves, in most cases.

Signature

David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

Reply to this Message

larsdennert@gmail.com - 24 May 2006 18:02 GMT

Ah I see. You are refering to the DUN or Cisco client. Yea that would
work. When you use DUN, the internet doesn't work anyway unless you
turn off gateway routing and add some static ip routes so I only use it
for intermittant roaming users.

I think I was thinking of a hardware vpn where the routers do the vpn
and there is no software running on the clients.

Reply to this Message

David W. Fenton - 24 May 2006 20:36 GMT

> Ah I see. You are refering to the DUN or Cisco client. Yea that
> would work. When you use DUN, the internet doesn't work anyway
> unless you turn off gateway routing and add some static ip routes
> so I only use it for intermittant roaming users.

Yes, I was assuming you were using the Windows VPN client.

> I think I was thinking of a hardware vpn where the routers do the
> vpn and there is no software running on the clients.

I don't usually see that kind of scenario with my clients, so I
don't usually think of it.

Signature

David W. Fenton http://www.dfenton.com/
usenet at dfenton dot com http://www.dfenton.com/DFA/

Reply to this Message