Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

We have an OpenVPN server at work, which I use frequently to access private work resources. When I do, the "Shared" listed in Finder populates with all the automatically announced servers/resources at work, but the reverse is also true. My local resources appear to anyone at work, and/or on the VPN as well.

Ideally, I would like to prevent my announcements from going over the VPN link, but would like to have the shares physically at work available to me while on the VPN. If the only method is to disable Bonjour (temporarily), I'll be fine with that, but is there a way to make it only one-sided?

And of course the master question: How do I accomplish this, at all, in the first place.

share|improve this question
    
Related: apple.stackexchange.com/questions/960/… –  Jason Salaz Feb 12 '11 at 20:57
    
The sheer amount of Google Search results that link me back here now is astounding. –  Jason Salaz Feb 14 '11 at 0:42
add comment

3 Answers

up vote 1 down vote accepted

Usually, Bonjour only works on the local network and only its extension Wide-Area-Bonjour works through VPNs. Did you configure your Computer to use that or did you setup your router to handle that? Also, which other resources appear for the others at work?

But anyway, you don´t have to have File Sharing "turned on" on your computer (which will then cause the broadcasting of your computer´s name over Bonjour) to access others, so just turn off the services you don´t want others to see and you should be good.

share|improve this answer
    
(1) Bonjour doesn't work over PPTP/L2TP/etc. VPNs. I do not know the technical reason, but it does work over SSL VPNs and OpenVPN. I don't use ShareTool, and I don't have any special configuration to create this scenario. I see all my co-workers shares too, as a matter of fact. (2) Your suggestion is not a solution because it breaks functionality I use. I want to see the iMac upstairs (which isn't mine, btw), on my laptop I'm now typing on. I don't want individuals at work to be able to do the same. –  Jason Salaz Feb 14 '11 at 0:43
    
(2): you didn´t specify what local resources you have; so without knowing of your local Macs my suggestion wouldn´t be that bad. –  Asmus Feb 14 '11 at 9:47
    
(1): Bonjour is a multicast protocol and does only work link local (so only in your local broadcast domain, not across subnets!) unless you use its "wide area" implementation; for that the DNS server you are using at work has to update all connected clients over dns-sd to publish its registered services. So the question would be why your iMac upstairs is registering itself at your work´s DNS-server once you start your VPN on your laptop?! Have you maybe entered your work´s DNS server in your router? –  Asmus Feb 14 '11 at 9:54
    
Could you describe which steps you had to take to get your vpn setup running? Did you simply have to import a openvpn.ovpn file or did you need to setup anything else, maybe with a .pkg installer you got from somebody at work? Also, do you have an entry in your firewall to forward multicast packages to your work´s dns server? You could do "sudo ipfw list" in the Terminal and look for entries that forward 224.0.0.251 (that´s the mDNS area) –  Asmus Feb 14 '11 at 10:32
    
It looks like this problem was actually due to software actively relaying things. Namely: iTunes was actively relaying the existence of an AppleTV across the VPN. I think. Regardless, with a standard set of apps, nothing is exposed from my computer outside of my computer itself. Thanks for sticking around with me on this. –  Jason Salaz Mar 11 '11 at 1:42
add comment

How about blocking udp traffic on port 5353?

share|improve this answer
    
Is it actually that simple? Can I just filter outgoing 5353? –  Jason Salaz Feb 12 '11 at 22:53
add comment

If you are using OpenVPN, I assume you are using Linux on the server side.

Since OpenVPN is working in layer 2 bridge mode, applying a standard filter with iptables will not work. iptables works on layer 3 and your VPN is before that in the layer 2.

The trick is to use ebtables wich is like iptables but at layer 2.

You can block UDP port 5353 with ebtables.

share|improve this answer
1  
Strange assumption since OpenVPN is cross platform, even though you are correct :P. –  Jason Salaz Jan 4 '13 at 0:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.