How to assign Domain Controller to VLAN Systems
-
You don't seem to understand how rules work. Rules are evaluated TOP down.. First rule to trigger wins and NO OTHER rules are evaluated.
All of those allow rules are pointless because you have that allow purchase net tcp/udp any rule..
And then you have 2 rules below that allow to specific sites?
How would you ever get to the reject rules?
-
@johnpoz
Thank you very much.What i understood was it will check 1st rule if it is not matching will go to 2nd like that so on. If the rule is not specified or not matching i thought it will be blocked.
Based on the idea given by you i have did few changes. Please correct me if i am wrong.
Fin-VLAN
Marketing-VLAN
Purchase-VLAN
Quality-VLAN
Allow Specific Sites are the sites of Government Sites which is required for few departments. Due to block of News & Social Media (Squid Guard) few sites will not work so created alias and allowing it (Don't know this is right or wrong).
I thought if the rule is not specified means it will reject directly. No idea how to reject other than that. I think I am having very poor knowledge.
Lokesh Kamath
-
@slkamath said in How to assign Domain Controller to VLAN Systems:
What i understood was it will check 1st rule if it is not matching will go to 2nd like that so on.
Exactly - but what is the point of allowing X, above a rule that allows ALL? And blocking something below a rule that allow ALL will never be evaluated.
And yes there is a default deny that is not shown - so if you run through your rules and its not allowed then it will be blocked.
Your block rules on the end of your quality net are pointless.. They would just be blocked by the default deny if not allowed above. So unless you wanted to specifically log them or reject them vs just deny those rules are pointless.
What option do you have set in that allow to lan net? The gear symbol. That rule makes no sense because it allows all lan net, so what is the point of allowing to a specific lan IP?
-
@johnpoz
Thank you very much.How to put default deny rule (please find the pic below is it correct)?
Again did some changes.
Quality-VLAN
Gear Symbol is for Upload & Download limit set so it shows that symbol. In LAN there are nearly 10 IP's. All VLAN has to access those IP's (Shared Folder, Network Printer, Backup, Domain Controller, Tally).
LAN
Can you suggest any book or something so that i will get some knowledge to make it correct.
Lokesh Kamath
-
I suggest reading this chapter from the pfSense book:
https://www.netgate.com/docs/pfsense/book/firewall/firewall-fundamentals.htmlSteve
-
@stephenw10
Thank you Stephen. -
Did you post the wrong pic - your qual ne has the block rfc1918 and bogon again..
Your lan rules everything below your any any is just pointless!! Not sure why this is so difficult to understand..
Imagine a source IP:PORT and DESTIP:PORT and protocol - now run through your rules top to bottom.
You have an ANY ANY rule - any protocol and source any dest.. So when would that rule not trigger and get to the safe_IP rule??
When would something not trigger that any any rule and fall through to your block rules? Your any any allows ANY, so
clearly ports 80 and 443 are part of ANY..If you don't want IPs getting to 80/443 then those rules go ABOVE your any any rule.. Those will then be blocked and other ports like say 123 would not trigger those rules and be allowed through the any any rule.
-
@johnpoz
Thank you Very MuchSorry for the delay.
I made few changes. Please have a look. Also any mistake please guide me.
LAN - Allow Browsing is only for 5 IP's
LAN-UPDATED
Fin-VLAN
Marketing-VLAN
Quality-VLAN
One more issue that i am facing is
All the VLAN systems need to Disable & Enable the network to Send/Receive Mails or Accessing Shared Folder else share folder or mails will not work. (timeline of 2 to 5 min we need to disable & enable network) Where I need to change this?Lokesh Kamath
-
Looks like you still have an allow all rule on the Fin-VLAN interface that will catch all traffic before it hits any of the other rules.
Steve
-
@stephenw10
Thank you Stephen.I will change the Fin-VLAN. Thanks. Other VLAN is correct?
Lokeh Kamath
-
Well they don't look immediately wrong. Without knowing exactly what you need to do I can't say more than that.
Steve
-
Thank You Very Much Steve.
One more issue that i am facing is
All the VLAN systems need to Disable & Enable the network to Send/Receive Mails or Accessing Shared Folder else share folder or mails will not work. (timeline of 2 to 5 min we need to disable & enable network) Where I need to change this?Lokesh Kamath
-
That does not seem like a pfSense setting.
Where are you enabling/disabling that?
Can they still reach websites etc without doing that?
Steve
-
@stephenw10
Thank you Steve.Without enable / Disable they cant use internet, mails, shared folder. In LAN there is no issue.
We are enabling / disabling in Client System Network.
Lokesh Kamath
-
that makes ZERO sense and has zero to do with pfsense.. Is your client getting a different IP, new info like dns, etc.. Pointing to pfsense when it wasn't before, etc.
-
Mmm, I could believe it was a rogue dhcp server setting a bad gateway.
Steve
-
@stephenw10
Thank you very much Steve.I have not mentioned any Gateway in DHCP Server.
Please find the below pictures.
FIN-DHCP
FIN-DNS-GATEWAY
Marketing DHCP
Marketing-DNS-GATEWAY
Purchase-DHCP
Purchase-DNS-GATEWAY
Moulding-DHCP
Moulding-DNS-GATEWAY
Quality_DHCP
Quality-DNS-GATEWAY
Should I Specify Gateway? If Yes pfSense LAN IP is the Gateway right. Also Should I add pfSense LAN IP in Gateway (Routing - Gateway)?
Lokesh Kamath
-
@stephenw10
Thank you very much Steve.I had given Gateway as mentioned below to each VLAN, but not mentioned in Routing - Gateways Please guide me if anything wrong.
Marketing DNS-GATEWAY
Purchase DNS-GATEWAY
Moulding DNS-GATEWAY
Quality DNS-GATEWAY
Lokesh Kamath
-
Dude who told you to put in a gateway - there is ZERO reason to do that. What he stated was there might a ROGUE dhcp server handing out the WRONG info!!
-
@johnpoz
Thank you very much John.I will remove that immediately.
@johnpoz, @stephenw10
I do not have any idea on that. please guide me.Lokesh Kamath
