Help: Networking for Samba file sharing -- guideance on multicasting / scripting appreciated

User Support
1

Any help from an NFT / Qubes networking expert is greatly appreciated!

I have read the docs, looked at the localsend tutorial, and created scripts to reproduce the setup. For the life of me I cannot get Samba “auto-discovery” to work. This depends on multicasting. If I install inside of sys-net, then everything works perfect. However, inside of an AppVM the networking does not work.

What Works:

  • directly connecting to the share via the local network IP address of sys-net (port fowarding)

What does NOT work:

  • auto-discovering the shares on other LAN devices (multicasting most likely)

From my understanding, this “auto-discovery” works via the “wsdd2” package (debian). This service provides the capability and this has been confirmed by disabling / enabling it in a test install.

Specifically, it is done via port 3702 TCP/UDP multi-cast. In the docs the for it you can see details: wsdd2(8) — wsdd2 — Debian trixie — Debian Manpages

The multi-cast group address is 239.255.255.250 according to the docs. I am not an expert on this stuff, so anything could be wrong. This is just my understanding of how everything works.

Samba depends on port 445 TCP. Connecting to this port directly via the LAN IP will work. But the “auto-discovering” provided by “wsdd2” does NOT work.

I have created 3 different scripts to try and get this to work. Somewhere there must be a problem with the NFT rules, but I do not understand NFT enough to identify it. The scripts were adapted from the scripts provided for localsend multicast: WillyJL ─ LocalSend through 2 layers of NAT

sys-net script:

#!/bin/bash

iface=wls6  # discover via 'ip -a '
localip=192.168.1.75 # discover via 'ip -a '
firewallip=10.138.28.178 # look in qubes manager


########################################################################
# multi-casting
########################################################################
if true; then
	echo "Multi-casting executing"
	nft add chain qubes custom-prerouting
	nft insert rule qubes prerouting jump custom-prerouting

	port=3702  
	multicast=239.255.255.250  # WSDD multicast group
	nft add rule qubes custom-prerouting  iif != $iface udp dport $port ip daddr $multicast ip ttl set 2 ip saddr set $localip dup to $multicast device $iface notrack


	port=5355  
	multicast=224.0.0.252 # LLMNR query multicast group
	nft add rule qubes custom-prerouting  iif != $iface udp dport $port ip daddr $multicast ip ttl set 2 ip saddr set $localip dup to $multicast device $iface notrack
fi

########################################################################
# port forwarding 
########################################################################
nft add chain qubes custom-dnat-appvm '{ type nat hook prerouting priority filter +1; policy accept; }'

port=445  
for proto in tcp udp; do
    nft add rule qubes custom-dnat-appvm iif == $iface $proto dport $port ct state new,established,related counter dnat $firewallip
    nft add rule qubes custom-forward iif == $iface ip daddr $firewallip $proto dport $port ct state new,established,related counter accept
done

port=3702  
for proto in tcp udp; do
    nft add rule qubes custom-dnat-appvm iif == $iface $proto dport $port ct state new,established,related counter dnat $firewallip
    nft add rule qubes custom-forward iif == $iface ip daddr $firewallip $proto dport $port ct state new,established,related counter accept
done

port=5355  
for proto in tcp udp; do
    nft add rule qubes custom-dnat-appvm iif == $iface $proto dport $port ct state new,established,related counter dnat $firewallip
    nft add rule qubes custom-forward iif == $iface ip daddr $firewallip $proto dport $port ct state new,established,related counter accept
done

sys-firewall script:

#!/bin/bash

iface=eth0  # always eth0
appvmip=10.137.0.33 # look in qubes manager

########################################################################
# multi-casting
########################################################################
if true; then
	echo "Multi-casting executing"
	nft add chain qubes custom-prerouting
	nft insert rule qubes prerouting jump custom-prerouting

	port=3702
	multicast=239.255.255.250  # WSDD multicast group
	nft add rule qubes custom-prerouting iif != $iface udp dport $port ip daddr $multicast ip ttl set 2 dup to $multicast device $iface notrack


	port=5355
	multicast=224.0.0.252 # LLMNR query multicast group
	nft add rule qubes custom-prerouting iif != $iface udp dport $port ip daddr $multicast ip ttl set 2 dup to $multicast device $iface notrack
fi

########################################################################
# port forwarding 
########################################################################

nft add chain qubes custom-dnat-appvm '{ type nat hook prerouting priority filter +1; policy accept; }'

port=445
for proto in tcp udp; do
    nft add rule qubes custom-dnat-appvm  iif == $iface $proto dport $port ct state new,established,related counter  dnat $appvmip
    nft add rule qubes custom-forward iif == $iface ip daddr $appvmip $proto dport $port ct state new,established,related counter accept
done

port=3702
for proto in tcp udp; do
    nft add rule qubes custom-dnat-appvm  iif == $iface $proto dport $port ct state new,established,related counter  dnat $appvmip
    nft add rule qubes custom-forward iif == $iface ip daddr $appvmip $proto dport $port ct state new,established,related counter accept
done

port=5355
for proto in tcp udp; do
    nft add rule qubes custom-dnat-appvm  iif == $iface $proto dport $port ct state new,established,related counter  dnat $appvmip
    nft add rule qubes custom-forward iif == $iface ip daddr $appvmip $proto dport $port ct state new,established,related counter accept
done

appvm script:

#!/bin/bash

iface=eth0 # always eth0
appvmip=10.137.0.33 # look in qubes manager


########################################################################
# port forwarding 
########################################################################

port=445
for proto in tcp udp; do
    nft add rule qubes custom-input iif == $iface $proto dport $port ip daddr $appvmip ct state new,established,related counter accept
done

port=3702
for proto in tcp udp; do
    nft add rule qubes custom-input iif == $iface $proto dport $port ip daddr $appvmip ct state new,established,related counter accept
done

port=5355
for proto in tcp udp; do
    nft add rule qubes custom-input iif == $iface $proto dport $port ip daddr $appvmip ct state new,established,related counter accept
done
2

I haven’t tried to set up Samba auto-discovery, but since you tried mimicking the localsend guide without success I’ll point out that the following guide is likely to be the most helpful:

3

Thanks that is what I am basing my script on is that tutorial. However, for some reason it still does not work and I cannot figure out why. My scripts appear correct, but it won’t auto discover.

4

Hi @QAnon7346. Which scenario are you trying to achieve:

  1. AppVM → LAN: One AppVM on Qubes OS to auto-discover a device sitting on your local area network;
  2. LAN → AppVM: One device on your LAN to auto-discover an AppVM on Qubes OS.

I’ve found the solution to both, however, I want to give you the proper and easiest instructions.