Samba binding to multiple interfaces

[qsecofr]

Hi,

[solved] an stray interfaces line further on down in the config file caused the issue. Sorry. Should've grepped the config file even after thinking I carefully read through it.
:r

I've got a server running FreeBSD 7.2 and Samba34. The server has multiple interfaces. One is a static routable address. Three are 192.168 non-routable addresses, one of which is a wireless AP. And it seems that no amount of configuration file editing gets Samba to listen on more than one single interface. The goal is to have it listen on one wired and one wireless interface: 192.168.1 and 192.168.2 respectively.

In /usr/local/etc/smb.conf:

interfaces = 192.168.1.1 192.168.2.1 127.0.0.1
; interfaces = bge1 ral0
;interfaces = bge1, ral0
bind interfaces only = yes

No combination seems to affect the behavior.

# sockstat -4 | more
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS      
root     smbd       2061  21 tcp4   192.168.1.1:445       *:*
root     smbd       2061  22 tcp4   192.168.1.1:139       *:*
root     nmbd       2056  9  udp4   *:137                 *:*
root     nmbd       2056  10 udp4   *:138                 *:*
root     nmbd       2056  11 udp4   192.168.1.1:137       *:*
root     nmbd       2056  12 udp4   192.168.1.1:138       *:*

I've read and re-read the man page and googled to no avail so far. I'm sure I've missed something. As for the interface that is being served, both file share and printer share appear to work. No issues with that, I just want to extend it to another interface..
TIA

 

[Zare]

If Samba itself doesn't support multi interface binding, easiest and possibly cleanest workaround would be configuring Samba to bind all interfaces, and then block connections with pf or ipfw to unneeded interfaces. Somewhat in lines of "can listen, cannot hear".

Jailing Samba can sound like a good solution here, but it can get pretty messy. IP alias based jail is problematic because some of those Microsoft protocols depend on broadcasting, which IMHO doesn't get through to jails because aliases are in 1-host network (255.255.255.255). So either VNET based jail, or push host-created tap to jail via devfs, bridged on host with appropriate physical network interface.

 

[qsecofr]

Yes, I've tried that as one of the combinations as well. I commented out the interfaces and its partner bind lines and let Samba itself find the interfaces. But the smbd daemon still appeared to listen only on the single interface. It's got me stumped so far..

Firewall does filter out any Samba traffic on the external interface.