Bugreport [6.40.3]: SMB access to VRRP interface not possible with interface restrictions

marting · September 20, 2017, 7:57am

Hi,

SMB-access is possible to a VRRP interface/ip with SMB interfaces=all.

But SMB does not listen to the specified VRRP interfaces if there are interfaces specified. See following test scenario (had the problem with productive router, this is minimized version):

[admin@MikroTik] > /interface export
# sep/20/2017 09:45:31 by RouterOS 6.40.3
# software id = IXF3-V908
#
# model = 2011UiAS
# serial number = 60880564F9AD
/interface vrrp
add interface=ether10 name=vrrp1

[admin@MikroTik] > /ip address export
# sep/20/2017 09:45:40 by RouterOS 6.40.3
# software id = IXF3-V908
#
# model = 2011UiAS
# serial number = 60880564F9AD
/ip address
add address=192.168.88.1/24 interface=ether10 network=192.168.88.0
add address=192.168.88.2/24 interface=vrrp1 network=192.168.88.0

[admin@MikroTik] > /ip smb export    
# sep/20/2017 09:45:52 by RouterOS 6.40.3
# software id = IXF3-V908
#
# model = 2011UiAS
# serial number = 60880564F9AD
/ip smb
set allow-guests=no enabled=yes interfaces=ether10,vrrp1
/ip smb users
add name=test password=test read-only=no

Try from debian 8.5:

root@mg4:~# ifconfig eth0
eth0      Link encap:Ethernet  Hardware Adresse 00:22:68:0a:36:77
          inet Adresse:192.168.88.254  Bcast:192.168.88.255  Maske:255.255.255.0
          inet6-Adresse: fe80::222:68ff:fe0a:3677/64 Gültigkeitsbereich:Verbindung
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metrik:1
          RX packets:7872 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4572 errors:0 dropped:0 overruns:0 carrier:0
          Kollisionen:0 Sendewarteschlangenlänge:1000
          RX bytes:10505509 (10.0 MiB)  TX bytes:396606 (387.3 KiB)
          Interrupt:20 Speicher:fc000000-fc020000

root@mg4:~#
root@mg4:~# ping 192.168.88.1 -c1
PING 192.168.88.1 (192.168.88.1) 56(84) bytes of data.
64 bytes from 192.168.88.1: icmp_seq=1 ttl=64 time=0.364 ms

--- 192.168.88.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.364/0.364/0.364/0.000 ms
root@mg4:~#
root@mg4:~# mount -t cifs //192.168.88.1/pub -o "username=test,password=test,sec=ntlm" /mnt/tmp/1
root@mg4:~#
root@mg4:~# ping 192.168.88.2 -c1
PING 192.168.88.2 (192.168.88.2) 56(84) bytes of data.
64 bytes from 192.168.88.2: icmp_seq=1 ttl=64 time=0.443 ms

--- 192.168.88.2 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.443/0.443/0.443/0.000 ms
root@mg4:~#
root@mg4:~# mount -t cifs //192.168.88.2/pub -o "username=test,password=test,sec=ntlm" /mnt/tmp/2
[ 2556.204948] CIFS VFS: Error connecting to socket. Aborting operation.
[ 2556.205290] CIFS VFS: cifs_mount failed w/return code = -111
Unable to find suitable address.
root@mg4:~#
root@mg4:~# telnet 192.168.88.2 445
Trying 192.168.88.2...
telnet: Unable to connect to remote host: Connection refused
root@mg4:~#
root@mg4:~# # NOW REMOVING SMB INTERFACE RESTRICTIONS (SETTING interfaces=all)
root@mg4:~#
root@mg4:~# mount -t cifs //192.168.88.2/pub -o "username=test,password=test,sec=ntlm" /mnt/tmp/2
root@mg4:~#
root@mg4:~# telnet 192.168.88.2 445
Trying 192.168.88.2...
Connected to 192.168.88.2.
Escape character is '^]'.
^CConnection closed by foreign host.
root@mg4:~#

I don´t know exactly when this bug started.

strods · September 20, 2017, 2:57pm

SMB over VRRP must work in a same way as with other interfaces. However, your VRRP IP address is incorrect. You must not use IP address which is not /32 if it is under same subnet as any other address on router:
https://wiki.mikrotik.com/wiki/Manual:Interface/VRRP
“Note: address on VRRP interface must have /32 netmask if address configured on VRRP is from the same subnet as on router’s any other interface.”

marting · September 20, 2017, 3:31pm

Sorry, it’s only a testing scenario. There is no IP from same subnet on a regular interface on the productive router and the problem is the same.
But I could remove ip from regular interface or switch vrrp ip to /32 next week and repost results then.

Regards Martin

marting · September 22, 2017, 7:22am

As suspected same error (unable to find suitable address) with this configuration:

[admin@MikroTik] > /interface export
# sep/22/2017 09:23:02 by RouterOS 6.40.3
# software id = IXF3-V908
#
# model = 2011UiAS
# serial number = 60880564F9AD
/interface vrrp
add interface=ether10 name=vrrp1
[admin@MikroTik] > 
[admin@MikroTik] > /ip address export
# sep/22/2017 09:23:12 by RouterOS 6.40.3
# software id = IXF3-V908
#
# model = 2011UiAS
# serial number = 60880564F9AD
/ip address
add address=192.168.88.1/24 interface=ether10 network=192.168.88.0
add address=192.168.88.2 interface=vrrp1 network=192.168.88.2
[admin@MikroTik] > 
[admin@MikroTik] > /ip smb export
# sep/22/2017 09:23:19 by RouterOS 6.40.3
# software id = IXF3-V908
#
# model = 2011UiAS
# serial number = 60880564F9AD
/ip smb
set allow-guests=no enabled=yes interfaces=vrrp1
/ip smb users
add name=test password=test read-only=no