Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to assign Domain Controller to VLAN Systems

    Scheduled Pinned Locked Moved General pfSense Questions
    61 Posts 4 Posters 11.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • slkamathS
      slkamath @johnpoz
      last edited by

      @johnpoz
      Thank you very much.

      How to put default deny rule (please find the pic below is it correct)?

      Again did some changes.

      Quality-VLAN
      0_1538325663826_Quality VLAN.png

      Gear Symbol is for Upload & Download limit set so it shows that symbol. In LAN there are nearly 10 IP's. All VLAN has to access those IP's (Shared Folder, Network Printer, Backup, Domain Controller, Tally).

      LAN
      0_1538325683153_LAN.png

      Can you suggest any book or something so that i will get some knowledge to make it correct.

      Lokesh Kamath

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        I suggest reading this chapter from the pfSense book:
        https://www.netgate.com/docs/pfsense/book/firewall/firewall-fundamentals.html

        Steve

        slkamathS 1 Reply Last reply Reply Quote 0
        • slkamathS
          slkamath @stephenw10
          last edited by

          @stephenw10
          Thank you Stephen.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            Did you post the wrong pic - your qual ne has the block rfc1918 and bogon again..

            Your lan rules everything below your any any is just pointless!! Not sure why this is so difficult to understand..

            Imagine a source IP:PORT and DESTIP:PORT and protocol - now run through your rules top to bottom.

            You have an ANY ANY rule - any protocol and source any dest.. So when would that rule not trigger and get to the safe_IP rule??

            When would something not trigger that any any rule and fall through to your block rules? Your any any allows ANY, so
            clearly ports 80 and 443 are part of ANY..

            If you don't want IPs getting to 80/443 then those rules go ABOVE your any any rule.. Those will then be blocked and other ports like say 123 would not trigger those rules and be allowed through the any any rule.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            slkamathS 1 Reply Last reply Reply Quote 0
            • slkamathS
              slkamath @johnpoz
              last edited by slkamath

              @johnpoz
              Thank you Very Much

              Sorry for the delay.

              I made few changes. Please have a look. Also any mistake please guide me.

              LAN - Allow Browsing is only for 5 IP's
              0_1538554995442_LAN.png

              LAN-UPDATED
              0_1538555698922_LAN.png

              Fin-VLAN
              0_1538555019321_Fin-VLAN.png

              Marketing-VLAN
              0_1538555032187_Marketing-VLAN.png

              Quality-VLAN
              0_1538555045354_Quality-VLAN.png

              One more issue that i am facing is
              All the VLAN systems need to Disable & Enable the network to Send/Receive Mails or Accessing Shared Folder else share folder or mails will not work. (timeline of 2 to 5 min we need to disable & enable network)
              Where I need to change this?

              Lokesh Kamath

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Looks like you still have an allow all rule on the Fin-VLAN interface that will catch all traffic before it hits any of the other rules.

                Steve

                slkamathS 1 Reply Last reply Reply Quote 0
                • slkamathS
                  slkamath @stephenw10
                  last edited by

                  @stephenw10
                  Thank you Stephen.

                  I will change the Fin-VLAN. Thanks. Other VLAN is correct?

                  Lokeh Kamath

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Well they don't look immediately wrong. Without knowing exactly what you need to do I can't say more than that.

                    Steve

                    slkamathS 1 Reply Last reply Reply Quote 0
                    • slkamathS
                      slkamath @stephenw10
                      last edited by

                      @stephenw10

                      Thank You Very Much Steve.

                      One more issue that i am facing is
                      All the VLAN systems need to Disable & Enable the network to Send/Receive Mails or Accessing Shared Folder else share folder or mails will not work. (timeline of 2 to 5 min we need to disable & enable network) Where I need to change this?

                      Lokesh Kamath

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        That does not seem like a pfSense setting.

                        Where are you enabling/disabling that?

                        Can they still reach websites etc without doing that?

                        Steve

                        slkamathS 1 Reply Last reply Reply Quote 0
                        • slkamathS
                          slkamath @stephenw10
                          last edited by

                          @stephenw10
                          Thank you Steve.

                          Without enable / Disable they cant use internet, mails, shared folder. In LAN there is no issue.

                          We are enabling / disabling in Client System Network.

                          Lokesh Kamath

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            that makes ZERO sense and has zero to do with pfsense.. Is your client getting a different IP, new info like dns, etc.. Pointing to pfsense when it wasn't before, etc.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Mmm, I could believe it was a rogue dhcp server setting a bad gateway.

                              Steve

                              slkamathS 1 Reply Last reply Reply Quote 0
                              • slkamathS
                                slkamath @stephenw10
                                last edited by

                                @stephenw10
                                Thank you very much Steve.

                                I have not mentioned any Gateway in DHCP Server.

                                Please find the below pictures.

                                FIN-DHCP
                                0_1538711320458_Finance DHCP.png

                                FIN-DNS-GATEWAY
                                0_1538711437781_DNS & Gateway.png

                                Marketing DHCP
                                0_1538711447104_Marketing DHCP.png

                                Marketing-DNS-GATEWAY
                                0_1538711458922_DNS & Gateway.png

                                Purchase-DHCP
                                0_1538711509385_Purchase DHCP.png

                                Purchase-DNS-GATEWAY
                                0_1538711518611_DNS & Gateway.png

                                Moulding-DHCP
                                0_1538711527342_Moulding DHCP.png

                                Moulding-DNS-GATEWAY
                                0_1538711535242_DNS & Gateway.png

                                Quality_DHCP
                                0_1538711544623_Quality DHCP.png

                                Quality-DNS-GATEWAY
                                0_1538711553691_DNS & Gateway.png

                                Should I Specify Gateway? If Yes pfSense LAN IP is the Gateway right. Also Should I add pfSense LAN IP in Gateway (Routing - Gateway)?

                                Lokesh Kamath

                                slkamathS 1 Reply Last reply Reply Quote 0
                                • slkamathS
                                  slkamath @slkamath
                                  last edited by slkamath

                                  @stephenw10
                                  Thank you very much Steve.

                                  I had given Gateway as mentioned below to each VLAN, but not mentioned in Routing - Gateways Please guide me if anything wrong.

                                  Marketing DNS-GATEWAY
                                  0_1538717584757_Marketing DNS & Gateway.png

                                  Purchase DNS-GATEWAY
                                  0_1538717591964_Purchase DNS & Gateway.png

                                  Moulding DNS-GATEWAY
                                  0_1538717603411_Moulding DNS & Gateway.png

                                  Quality DNS-GATEWAY
                                  0_1538717687591_Quality DNS & Gateway.png

                                  Lokesh Kamath

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    Dude who told you to put in a gateway - there is ZERO reason to do that. What he stated was there might a ROGUE dhcp server handing out the WRONG info!!

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    slkamathS 1 Reply Last reply Reply Quote 0
                                    • slkamathS
                                      slkamath @johnpoz
                                      last edited by

                                      @johnpoz
                                      Thank you very much John.

                                      I will remove that immediately.

                                      @johnpoz, @stephenw10
                                      I do not have any idea on that. please guide me.

                                      Lokesh Kamath

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        Before you go restarting your machines interfaces when something doesn't work... How about you troubleshoot WHY!!!

                                        Are these machines windows? If so then simple

                                        ipconfig /all

                                        from cmd prompt will give you all the info for networking.. Does it show the proper info, what does it show for your dhcp server?

                                        Can machine ping the box your trying to talk to for smtp? Can it resolve its FQDN? Where is this smtp server in your network? Is it outside your network?

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        slkamathS 1 Reply Last reply Reply Quote 0
                                        • slkamathS
                                          slkamath @johnpoz
                                          last edited by

                                          @johnpoz
                                          Thank you very much

                                          When it is not working
                                          1st I will check in pfSense machine will go to ping and select the VLAN and ping the LAN & Google.
                                          2nd I will check in my machine is it working.
                                          3rd I will tell then to disable & enable the network. Then it will work. Now users understood that everytime it is not working then they only disable & enable.

                                          All these machines are UBUNTU. No Windows.

                                          Regarding SMTP i have not tried pinging from client. But I tried pinging google.com & it is pinging.

                                          SMTP is outside network. It's in BIGROCK.IN

                                          Lokesh Kamath

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            So when one machine is failing check the Connection Information in Network Manager.

                                            A rogue DHCP server is some other device that has DHCP enabled on your network that is handing out leases instead of pfSense. Like a soho router you might be using as an access point for example.

                                            Steve

                                            slkamathS 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.