1

I have an EC2 instance, running Win 2008. On it, I have a shared drive. Windows permissions are set properly. The server has a static IP through Elastic IP.

I do not want to open this to the world. I have a VPN at my office, so I can restrict access to the IP address of my office.

So I set up the following rules on the corresponding Security Group (in AWS console): Inbound rules allow

  • UPD port 445
  • TCP port 445
  • UDP ports 135-139
  • TCP ports 135-139

All of this works. I am able to map a drive from a PC or connect to the shared drive on my mac using smb://ip-address/share.

Now things get complicated. I want to get rid of the VPN solution at my office (because we are moving to a virtual office).

So I provisioned another EC2 instance (this one is Linux) and installed OpenVpn. That instance has an Elastic IP also.

From my laptop I am able to connect to the new VPN. When I check 'what is my ip' on my laptop, it is the IP of the VPN server, as expected.

I set up the same rules as above for the new VPN, opening the same ports to the IP as the server. I have tried the external, as well as the internal IP addresses.

And this is not working. When I try to connect to the shared drive from my client, while connected to the VPN, it tells me it cannot connect to the shared drive.

I am pretty sure this is related to the settings in the Security Group, but I cannot get it to work.

Olivier De Meulder
  • 166
  • 6
  • SMB (server message block) protocol is very commonly banned and blocked by ISPs, you should use nmap to check it. You don't need `TCP ports 135-139` , only 139,445 TCP and 137-139 UDP. Transmiting SMB through WAN is danger when using SMB1.0/2.0, SMB 3.0 is supposed to be fully encrypted and having consistency checking mechanisms. I haven't seen any studies about it yet. Everyone currently carries this kind of traffic inside VPN tunnel. – Michal Sokolowski Dec 13 '15 at 07:02
  • Have you considered using e.g. https://aws.amazon.com/marketplace/pp/B00MI40CAE/ref=srh_res_product_title?ie=UTF8&sr=0-2&qid=1450039940555? – Jukka Dec 13 '15 at 20:54
  • @Jukka that is what I have. – Olivier De Meulder Dec 13 '15 at 21:34

0 Answers0