I'm facing a strange issue: I'm using a Mac with Macos Tahoe 26.3. I can access a Windows server through SMB protocol on the local LAN and it's working fine.
Yesterday, I have added the tunneler on this server and created a service making me able to access this server with remote desktop securely from my Mac, wherever I am, through Openziti. It's working fine as well but when the tunneler is up, SMB doesn't work anymore.
It's not impossible to believe that someone adding the tunneler could the up causing connection problems like you're describing but to be honest, i would expect that it's some form of configuration error with OpenZiti moreso than a bug with OpenZiti in the scenario you're describing.
I assume you mean the Mac tunneler? It should be really easy to test this by just disabling the tunneler momentarily. If you meant the windows server, the same sort of test there would be an option too. That would maybe give us some steps to reproduce.
To be totally honest, i would be surprised if this was somehow an OpenZiti tunneler issue.
If you can reproduce, maybe send us some logs and we can try to look
Are you by any chance using the SMB serverâs LAN IP address in your intercept configuration? All of the OpenZiti tunnelers intercept connections by routing the IP addresses in the intercept configurations to the tunnelerâs listener (in the case of the macOS tunneler, this is a âtunâ network interface that the tunneler reads packets from). The tunneler then matches the packetâs protocol and destination port with the service configurations that it is aware of. If a match is found the tunneler uses the packet to initiate or continue an OpenZiti connection. If the packet does not match any service configurations then the tunneler discards it. Unfortunately there is no reliable way to regurgitate the unused packet back into the hostâs network stack without the tunneler re-intercepting it.
For this reason, itâs best to avoid using LAN or public-routable IPs in your service intercept configurations. Instead I recommend using a hostname, like âwindows-host.zitiâ in the intercept âaddressesâ field. This will cause the tunneler to assign a unique IP address to your service from its DNS IP range (100.64/10 by default), and you can use the hostname to access the RDP service while still using the LAN IP for SMB connections.
Thanks @Eric, how is the SMB connection declared? Is it by hostname like serveur01? I am "the windows guy" so I am not familar enough with the MacOS UI to know if that's the name being used to connect or if that's just the name of the connection and you can declare the connection some other way?
When the ZDEM is running, and you try SMB, are there any logs that are captured in the tunneler's logs related to the connection?
You are accessing the SMB server with a hostname âserveur01â, which is also the hostname in your RDP service (albeit with a .zpix domain appended). If your macâs network settings include â.zpixâ as a search domain, then itâs possible that the âserveur01â hostname is being resolved by the tunnelerâs DNS server, which would return one of those 100.64 IPs that the tunneler will intercept.
You can test this by âpingâing the hostname from a terminal. You may see different results when pinging the hostname with different domains. e.g.:
If â.zpixâ is an existing domain in your network Iâd recommend changing your ziti service intercept addresses to not overlap your existing domains. I often use the â.zitiâ domain in my services to make it clear that I'm intending to use the ziti overlay for connections.
Ziti Desktop Edge for macOS logs can be accessed through the âZâ menu in your title bar under Logging â Packet Tunnel. This will pop up a Console window showing the tunneler log with live updates. You can get to the log file with the âRevealâ button (
If it's reusing/keeping the connection open from before the tunneler is turned on (which would not surprise me) then it makes sense to me.
I'd definitely be interested in your logs when the tunneler is on and you cloe the finder window and reopen it to see if the tunneler is trying to intercept that traffic at that time.
Do you know what ports SMB is using? Oh it also makes me wonder if the SMB protocol can/does return back to the client the IP or hostname to use (i'll have to look into that)
I'm leaving the office. If it can help, here is the Wireshark capture on the inet interface of my Mac (10.137.137.11) when I try to access the server (10.137.137.1). Thanks both for your help. I'll survey your messages this week-end and further.
I was cliking like an idiot on the Title bar of the main window... Thank you. I 'll send the logs.