Accessing shares over VPN: AFP works, but not SMB

There is a command line tool called 'smbdiagnose' that will capture the logs and network pcap logs and if you specify the -s option a whole lot of detail about your hardware and operating system. When running the utility it starts a network capture which is when you will attempt to connect to the SMB shares when the timeout completes, you press CTRL+C in the Terminal to complete the network capture and it will generate a compressed 'smbdiagnose.tar.gz' file on your desktop. Double-click it and that will expand the files into an smbdiagnose folder.

If you have the technical knowledge to read a pcap network dump and analyze it, you might discover the problem. If not, you can call Apple Support and send them the smbdiagnose.tar.gz likely generated with the '-s' option to include output from the sysdiagnose command. You can read the pcap file with this command (or you could open it in WireShark an open source packet analysis tool):

tcpdump -r ~/Desktop/smbtcpfile.pcap1 | less

I would run the smbdiagnose at home where it's working and again over your VPN. Then compare the pcap results. It would be best to run as few things as possible while performing the capture with the smbdiagnose command. Close all apps and background agents / daemons except for your VPN. Disable all sharing, etc. The less traffic you have to sift through in the pcap the better. You will still capture a ton of data that would be irrelevant.