4

We have an OpenVPN server at work, which I use frequently to access private work resources. When I do, the "Shared" listed in Finder populates with all the automatically announced servers/resources at work, but the reverse is also true. My local resources appear to anyone at work, and/or on the VPN as well.

Ideally, I would like to prevent my announcements from going over the VPN link, but would like to have the shares physically at work available to me while on the VPN. If the only method is to disable Bonjour (temporarily), I'll be fine with that, but is there a way to make it only one-sided?

And of course the master question: How do I accomplish this, at all, in the first place.

Improve this question
2

3 Answers 3

Reset to default
1

Usually, Bonjour only works on the local network and only its extension Wide-Area-Bonjour works through VPNs. Did you configure your Computer to use that or did you setup your router to handle that? Also, which other resources appear for the others at work?

But anyway, you don´t have to have File Sharing "turned on" on your computer (which will then cause the broadcasting of your computer´s name over Bonjour) to access others, so just turn off the services you don´t want others to see and you should be good.

Improve this answer
5
  • (1) Bonjour doesn't work over PPTP/L2TP/etc. VPNs. I do not know the technical reason, but it does work over SSL VPNs and OpenVPN. I don't use ShareTool, and I don't have any special configuration to create this scenario. I see all my co-workers shares too, as a matter of fact. (2) Your suggestion is not a solution because it breaks functionality I use. I want to see the iMac upstairs (which isn't mine, btw), on my laptop I'm now typing on. I don't want individuals at work to be able to do the same.
    – Jason Salaz
    Feb 14, 2011 at 0:43
  • (2): you didn´t specify what local resources you have; so without knowing of your local Macs my suggestion wouldn´t be that bad.
    – Asmus
    Feb 14, 2011 at 9:47
  • (1): Bonjour is a multicast protocol and does only work link local (so only in your local broadcast domain, not across subnets!) unless you use its "wide area" implementation; for that the DNS server you are using at work has to update all connected clients over dns-sd to publish its registered services. So the question would be why your iMac upstairs is registering itself at your work´s DNS-server once you start your VPN on your laptop?! Have you maybe entered your work´s DNS server in your router?
    – Asmus
    Feb 14, 2011 at 9:54
  • Could you describe which steps you had to take to get your vpn setup running? Did you simply have to import a openvpn.ovpn file or did you need to setup anything else, maybe with a .pkg installer you got from somebody at work? Also, do you have an entry in your firewall to forward multicast packages to your work´s dns server? You could do "sudo ipfw list" in the Terminal and look for entries that forward 224.0.0.251 (that´s the mDNS area)
    – Asmus
    Feb 14, 2011 at 10:32
  • It looks like this problem was actually due to software actively relaying things. Namely: iTunes was actively relaying the existence of an AppleTV across the VPN. I think. Regardless, with a standard set of apps, nothing is exposed from my computer outside of my computer itself. Thanks for sticking around with me on this.
    – Jason Salaz
    Mar 11, 2011 at 1:42
1

How about blocking udp traffic on port 5353?

Improve this answer
1
  • Is it actually that simple? Can I just filter outgoing 5353?
    – Jason Salaz
    Feb 12, 2011 at 22:53
1

If you are using OpenVPN, I assume you are using Linux on the server side.

Since OpenVPN is working in layer 2 bridge mode, applying a standard filter with iptables will not work. iptables works on layer 3 and your VPN is before that in the layer 2.

The trick is to use ebtables wich is like iptables but at layer 2.

You can block UDP port 5353 with ebtables.

Improve this answer
1
  • 1
    Strange assumption since OpenVPN is cross platform, even though you are correct :P.
    – Jason Salaz
    Jan 4, 2013 at 0:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .