The situation is this:

  • I have a Debian server which acts as a web/mail server as well as an Internet gateway for a small office. All the externally available services run on OpenVZ virtual environments.
  • I have a requirement to provide external access to a directory (for a designer) shared with the employees inside the office. The directory must be accessible via SMB, so I've set up OpenVPN to provide secure access to Samba over the internet.
  • For additional security, I don't want to give OpenVPN remote users (which there might be more of in the future) full access to the company network, so I plan to set up a Samba daemon on one Virtual Environment, listening only on the OpenVPN virtual interface, and a separate Samba daemon on the physical machine, listening only on the internal network interface. The daemons would serve the same directory located inside the VE's root tree (and accessible to the physical machine's OS).

The main question is this: Won't there be conflicts (file locking issues, etc) when the files are accessed simultaneously from the internal network and the outside (which is likely as this setup is for Adobe InDesign/InCopy collaboration)? If so, what would be a better setup in this situation? Another alternative i'm thinking of is making the internal Samba daemon accessible on the OpenVPN interface through port forwarding. Again, I don't want OpenVPN clients to have actual full access to company network, i just want Samba shares working across the Internet (which the planned workflow requires).

If somebody has any experience with a similar setup, I would be very grateful if you shared your insights.

Edit - clarifications: I use OpenVPN with a bridged VPN (a tap interface) as I understand that is the right choice for Samba (would it even work on a routed VPN? Wouldn't it require elaborate forwarding/routing setup?) However, I don't want to bridge the VPN with the physical server's interface for 3 reasons: Avoid disturbing the company network while bringing the interface up&down; Avoid granting external clients access to the whole internal network; As a policy rule, avoid running public services on the physical machine.

Currently, I plan to use option 1:

  • option 1: running OpenVPN and Samba on a VE for the external clients and a second Samba instance on the main server for the employees (who don't need VPN). However I worry about two instances of Samba serving the same files and clashing (hence the original question formulation).
  • Option 2 would be to run just OpenVPN on in the VE and forward the Samba ports to the physical machine (or Hardware Node in OpenVZ terms).
  • Option 3 would be to not bother with VEs for this service (as it's essentialy non-public) and just run OpenVPN on the Hardware Node with a tap (bridge) interface but NOT actually bridge it with a physical interface, then make the single Samba instance listen on the internal network interface & the tap interface (for VPN clients), and NOT listen on the external interface.

So, the updated question would be: would option 3 be any less secure than the first two? If not, I would implement it as it seems to be the simplest and most robust.

Sorry I couldn't express it in less words :) Thanks for reading and answers.

  • Routed works just fine with Samba as long as you push a WINS server to the clients so that they can resolve the computer names. But even proper DNS resolution should work with modern Windows OS's. Besides the problem with bridging is that you now have a broadcast domain that extends over your WAN connection via the VPN tunnels. Sep 29, 2011 at 17:00
  • If you must bridge you probably want to setup a filtering bridge if you wish to try to restrict traffic on it. I believe you can accomplish this with Linux using ebtables. Sep 29, 2011 at 17:05
  • Btw here's information on using Samba with routed (tun interface) and OpenVPN. openvpn.net/index.php/open-source/documentation/… Sep 29, 2011 at 17:19
  • DNS resolution probably won't work as the HN has no DNS entry (I guess it's security by obscurity - previous admin did the setup). I could go with routing + WINS. However, with Option 3 above, the tap interface is not really bridged, (I'm just making Samba listen on two interfaces while ignoring the third) so the "exposed" broadcast domain is diffirent from the internal network. Do you thing that would pose any security risks?
    – odemarken
    Sep 29, 2011 at 17:24
  • So the TAP interface isn't bridged with an physical interfaces on the box? If that's the case then I don't see any risks. Just verify with nmap or other scanning tool that you don't have any other services binding to that TAP interface. Sep 29, 2011 at 17:31

1 Answer 1


I'd just use a firewall to control access. To make this work you would have to have OpenVPN setup to use a tun interface and route the traffic through a firewall. Once you have that done you have a couple of options for limiting access. You can assign a static IP address to the contractor using the client-config-dir directive and then restrict what that IP address can access. If you keep the statically assigned IP addresses in a block of IPs that can be described using a different CIDR from the OpenVPN DHCP users (employees) then you can write firewall rules easily to target each type of user. The other option which I tend to prefer as over all I find it cleaner to manage is to setup 2 different OpenVPN servers on different ports using different subnets for the clients and use one for employee access and one for contractor access. Then you can apply any restrictions you would like on either group based on the subnet without having to deal with individual IP addresses.

On the SAMBA side of things you can simply rely on the permissions on the files to restrict what he sees. But if you don't want to, or can't, expose all the normal shares to the contractor b/c they may disclose information like client/project list then you can use the invalid users = <username> option on the shares you wish them not to see. And add a share just for the contractor using the valid users = <username> directive. Another option would be to use the include = /somepath/%G.smb.conf or include = /somepath/%u.smb.conf directives to do per primary group or per user configuration directives.

  • Thank you for your extensive answer, however, I don't feel that it addresses my main points - perhaps I didn't express clearly enough what I'm after. Please read my updated quesion if you can be bothered :)
    – odemarken
    Sep 29, 2011 at 17:03
  • I don't use or have any experience with OpenVZ so I can't comment on how the file locking thing will work. And your whole solution seems to pivot on that point. But you also asked for other solutions. Sep 29, 2011 at 17:29
  • thanks again - you put me on the right track. I think I will try the dual-Samba approach (with oplocks disabled) for now and see if there are any performace issues, then explore the other options if needed.
    – odemarken
    Sep 30, 2011 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.