Home / server / Questions / 338593
In Process
Alex Duggleby
Asked: 2011-12-08 07:58:38 +0800 CST

Allow Broadcast to 255.255.255.255 through TMG/VPN (for NetBios Resolution)

  • 772

Is it possible to allow a VPN client to do NetBIOS broadcast name resolution through TMG?

In the TMG Queries I can see the rule that is blocking ClientIP->255.255.255.255

I've tried adding 255.255.255.255 to the Internal IP Range.

My VPN Client cannot resolve a NetBIOS name on my internal network. An a server on the internal network cannot resolve the NetBIOS name of the VPN client.

Thanks in advance.

vpn netbios microsoft-ftmg-2010 microsoft-ftmg

3 Answers

  1. 255.255.255.255 is the layer 2 broadcast address. NetBIOS is a layer 3 protocol. As such you should be seeing NetBIOS broadcasts to x.x.x.255, where x.x.x is your subnet address. Broadcast traffic to 255.255.255.255 is related to some layer 2 protocol, not NETBIOS.

    Here's an example of a NetBIOS name query on my home network from my workstation (192.168.1.66) looking for my AppleTV:

    4:28:03 PM 12/18/2011   192.168.1.66    192.168.1.255   NbtNs   NbtNs:Query Request for APPLETV  <0x00> Workstation Service

    EDIT:

    In response to ceving's comment, let me clarify, and if I'm wrong, someone please correct me.

    A layer 2 broadcast (sent to FF-FF-FF-FF-FF-FF) is sent to 255.255.255.255 at layer 3 (which is a limited broadcast meant for all nodes on the same physical network). Your subnet broadcast address is always x.x.x.SubnetBroadcastAddress (which is a directed broadcast, which in the OP's case is 192.168.1.255, which is intended for all nodes on the x.x.x.x subnet). A broadcast sent to FF-FF-FF-FF-FF/255.255.255.255 is meant for every node on the same physical network and since NetBIOS works at layer 3, it will never send a NetBIOS broadcast to 255.255.255.255, only to the subnet broadcast address (192.168.1.255 in this case). Therefore, the broadcast traffic that the OP is seeing is not NetBIOS broadcast traffic but layer 2 broadcast traffic meant for every node on that physical network.

    A limited broadcast (FF-FF-FF-FF-FF-FF/255.255.255.255) is meant for all nodes on the same physical network, whereas a directed broadcast (FF-FF-FF-FF-FF-FF/x.x.x.SubnetBroadcastAddress) is intended for specific nodes on that network (those that match the subnet address), to which there may be connected nodes in different subnets (multinets). Nobody ever said that all of the nodes on the same layer 2 network have to belong to the same layer 3 network, hence why the limited broadcast address (FF-FF-FF-FF-FF-FF/255.255.255.255) exists. In both cases the layer 2 destination is FF-FF-FF-FF-FF-FF, the difference is in which nodes accept the broadcast, based on the layer 3 address.

    • 6

  2. A VPN network is actually a router. And a router does not forward unlimited broadcasts (255.255.255.255). Those broadcasts are only valid in a local sub net. In order to forward those broadcasts through a VPN you have to bridge the layer 2 (Ethernet) through the VPN.

    • 3

  3. Do you have an Active Directory domain controller running on your network? You could have it perform name resolution for all clients using its WINS service.

    Two things need to happen: the WINS service must be started on the DC, and the clients must be told to register with the server. The clients can be informed of the WINS server by manually configuring them, or by using DHCP.

    Check out a quick Google here. I've only skimmed it, but the TechRepublic article seems to do a good job of explaining the basics.

    HTH.

    • 1