Windows 10: OpenVPN is public network and access to SMB share doesn't work

Hello, i still didn't found solution for this.

I have some Linux servers with latest versions of OpenVPN and some OpenVPN clients. OpenVPN works just fine, access from Linux or Windows 7 clients too. There is no problem. I am very sure Samba, firewall and OpenVPN server are configured correctly.

Problem is with Windows 10 and i am not sure when it started, maybe after some last update. I don't know.

Problem is - the network through virtual network adapter "TAP-Windows Adapter V9" is always identified as public and there is no user accessible option how i can configure it as private network.

I found command for powershell in this thread (Set Network Location to Private or Public in Windows 10 | Windows 10 Tutorials), but it doesn't help permanently and it doesn't enable access to SMB share anyway. I can even reconfigure all unknown networks in secpol.msc as private, which i believe is very insecure behavior, but for testing i tried it. It didn't help either.

I have for testing two notebooks and one virtual installation (QEMU). On one notebook access to Samba share works just fine, on virtual and second notebook it does't. It is same OpenVPN, same key for notebooks (why not if they are not connected at a same time) and different key for virtual.

I am using OpenVPN GUI, which is running as W10 service under system priviledges. I have set DNS and route by push parameters in OpenVPN config on server, i have propper server key verification. There is no warning in OpenVPN log.

When access to the SMB share doesn't work, W10 displays error message "0x80004005" which i beleive means it is blocked by local W10 firewall, because "Network discovery" is disabled for public networks.

In one case i tried explicitly allow all trafic from and to the IPv4 address of my server in VPN for all protocols. It didn't help either.

On virtual is no additional firewall/antivirus. On one of notebooks, which does'n work, is installed AVG, but without firewall module.


Question is
- how i can override this behavior?
- how i can tell W10, my OpenVPN network is safe and private?
- how i can do more diagnostics? Wireshark? What i should investigate?

:)

 

SMB to shares on USB storage does not work


I have several usb-connected drives and several SATA drives on a Win7Pro-64 system just upgraded to Win10. The only account on the machine is a local administrator account. On each drive I have a shared folder.

Where before I could connect via SMB/Samba from non-Windows networked devices using the local account credentials, I can now only access the shares on SATA drives. Any share on a USB drive is inaccessible to, say, ES File Explorer or Astro on a Android Tablet (although the share name can be read).

I can still access all shares from another Windows 10 machine. All devices have the proper Workgroup.

Clearly there is some SMB policy change in Windows 10. I've seen one fix for network drives but it doesn't seem to apply here (and also doesn;t work). Also not working is anonymous login to shares with with Everyone access, which also used to work.

 

Accessing public and private shares from Windows

I might have misunderstood your point, but at least I have no issues accessing both private and public folders / shares on my NAS. Of the NAS shares I always map (see screenshot), I access share with one set of credentials, Public requires no credentials because, as the name says, it's meant to be public. Share OD, my local backup for everything I store in OneDrive is again accessed with same credentials than :





When mapping a network share, you can use different credentials for each share simply by selecting this option:





The above option is not required to access public shares on NAS.

 

Cannot access shared network drive


Personally, I wouldnt use Everyone. If anyone hacks into you, they have full access to everything and can demolish everything on your raid. I would rather set up accounts and access separately for each person. That way, I know who did all that damage. In the end with a little extra work, I feel more secure by using Authenticated Users.


If this helps.
step 1 create non-microsoft account and without email and address without admin rights
step 2 share a drive or folder to specific user account (if Everyone is listed, remove it)
step 3 set security > add Authenticated Users (if more than 1 account) or add specific users
step 3a remove Everyone from list
step 3b uncheck full control and write for all items listed except SYSTEM and Admin account.
step 4 right click Start > Computer Management > System Tools > Shared Folders > Shares ... to verify settings and change anything else. You can also see the number of connections to each share here.