Access Denied when opening shares via VPN

[heatproofsean]

Revisiting an old outstanding issue: On a AD environment, users can access shares no problem. When they use a VPN, they can't access the ReadyNAS shares. They can access Windows-based shares on the VPN just fine.

I can access the root \\CHDNAS001\ but if I try to open/map \\CHDNAS001\IT I get the error after a few minutes of loading:

"\\chdnas001\IT is not accessible. You might not have permission to use this network resource. Conact the administrator of this server to find out if you have access permissions.

The specified network name is no longer available."

Hostname:	CHDNAS001
	Model:	ReadyNAS 1100
Serial:	000da21013ba
Firmware:	RAIDiator 4.1.5 [1.00a147]
Memory:	512 MB [2.5-3-3-7]
	MAC address:	00:0D:A2:10:13:BA
IP address 1:	10.181.2.1

[Sandshark]

I suspect your VPN is not routing SMB1, which is what your old NAS uses.  For security reasons, that may not be something you want to change.

[heatproofsean]

Thanks for the advice, I have a feeling the other windows file shares use SMB1 as well, since they are running on older OS (Windows 2003). Is there any other method of sharing the files if this is the cause?

[StephenB]

---

@heatproofsean wrote:

 I have a feeling the other windows file shares use SMB1 as well, since they are running on older OS (Windows 2003). 

---

Windows 2003 does use SMB 1 (SMBv2 was introduced with Vista).  So if those shares are accessible over the VPN, then the VPN isn't the cause of your problem.

[Sandshark]

Have you tried accessing via the IP address instead of name?  Some of us have problems with Win10 when using the NAS name.  I'm not sure why it would be different on VPN than local, but it's worth a try.

Are you sure somebody didn't put exceptions in for the Windows 2003 servers and forgot about the NAS?

[heatproofsean]

I did try with IP address and it didn't make a difference.

And I've looked at our firewall and I can't see any special rules for the other windows file servers. Again, I can connect to the root of the NAS but not into any of the actual shares.

[StephenB]

---

@heatproofsean wrote:

I did try with IP address and it didn't make a difference.

And I've looked at our firewall and I can't see any special rules for the other windows file servers. Again, I can connect to the root of the NAS but not into any of the actual shares.

---

Have you tried using net use in CMD (explicitly specifying NAS admin credentials)?

For instance

net use * /delete /y
net use t: \\nas-ip-address\C /user:admin nas-admin-password

The second command maps the full data volume to drive letter T (which requires NAS admin credentials).

If the VPN is blocking SMB 1 somehow, then the second command would fail over the VPN, but would work on the local network.

What do you mean by "connect to the root of the NAS"?  Do you mean that you can see the share list in file explorer (or from CMD)?  Or do you mean something else?

[heatproofsean]

I'll try mapping via CMD and the admin logon now. And yes, If I use windows explorer to go to \\CHDNAS001\ I can see the list of shares. But if I then try to open one I get the error mentioned above.

[heatproofsean]

This is the error i get using the CMD method. It added the drive but I can't actually open it. When I navigate to the root \\10.181.2.1\ and open the share I see this.

[heatproofsean]

[StephenB]

---

@heatproofsean wrote:

This is the error i get using the CMD method. It added the drive but I can't actually open it. When I navigate to the root \\10.181.2.1\ and open the share I see this.

---

Maybe also try this CMD on a local machine, and confirm that it works there.

Do you have any internet security software running on the remote PCs? (Kaspersky, or perhaps Avast)

[heatproofsean]

we have Symantec Endpoint Protection running, and accessing the CMD added share works fine when on site, just not when using the VPN.

[StephenB]

---

@heatproofsean wrote:

we have Symantec Endpoint Protection running

---

It could certainly be SEP, so try disabling that and see if that makes any difference.

[heatproofsean]

no difference 😞