I can't join users of the VLAN on Windows Server domain
-
Thnks!
Well I have this rules in the VLANs
And this in the LAN
-
well that rule from vlan 20 to vlan 20 is completely pointless..
What is your DC IP?? Is it that 10.10.10.8? There are LOTS of ports required to join a domain…
-
As said above, the ports there are not anywhere enough to get this working. Why are you shooting yourself in the foot with such restrictive rulesets?
-
johnpoz
the DC IP is 10.10.10.1, the rule that have 10.10.10.8 and 3128 port is because I use a squidguard (proxy) -
And again where are the rules that allow the clients that want to join your AD and talk to the DC on 10.10.10.1 ?? Keep in mind there are a shit load of ports required!
-
johnpoz, doktornotor…
I don't know what rules I have to use for join the users with AD
Can you help me in this part? the rules confuse me… -
Like I said there is a shit load of ports… Look them up.. Google say ports required to join domain..
Off the top of the my head your going to need 135 tcp for rpc I would believe 389 for ldap, 636 for ldap over ssl, 88 for kerberos most likely, 445 most likely needed as well.. Not forgetting dns to be able query the AD dns, etc.. You might need to query the global catalog with I believe is 3268 and 3269... Been a long time since needed to look into requirements for a firewall between clients and the AD DC they are members of.. Not something you normally do..
What I would suggest until you figure it out is just allow any any to your DC.. from this vlan, and then log it if your wanting to try and lock it down at future time.
-
Active Directory and Active Directory Domain Services Port Requirements - requires additional messing with registry for RPC as those ports are dynamic by default.
-
Actually there's a pass any any at the top of the VLAN 20 rules to all the subsequent rules are pointless.
You might consider turning off DHCP on pfSense and using DHCP Relay to point at your DC too. Just let AD do DHCP and DNS.
-
You are correct derelict – how did miss that?? ;)
So is problem is most likely just can not resolve because he is not pointing to his AD dns.. Good catch..
