How to assign Domain Controller to VLAN Systems
-
@johnpoz
Thank you Very MuchSorry for the delay.
I made few changes. Please have a look. Also any mistake please guide me.
LAN - Allow Browsing is only for 5 IP's
LAN-UPDATED
Fin-VLAN
Marketing-VLAN
Quality-VLAN
One more issue that i am facing is
All the VLAN systems need to Disable & Enable the network to Send/Receive Mails or Accessing Shared Folder else share folder or mails will not work. (timeline of 2 to 5 min we need to disable & enable network) Where I need to change this?Lokesh Kamath
-
Looks like you still have an allow all rule on the Fin-VLAN interface that will catch all traffic before it hits any of the other rules.
Steve
-
@stephenw10
Thank you Stephen.I will change the Fin-VLAN. Thanks. Other VLAN is correct?
Lokeh Kamath
-
Well they don't look immediately wrong. Without knowing exactly what you need to do I can't say more than that.
Steve
-
Thank You Very Much Steve.
One more issue that i am facing is
All the VLAN systems need to Disable & Enable the network to Send/Receive Mails or Accessing Shared Folder else share folder or mails will not work. (timeline of 2 to 5 min we need to disable & enable network) Where I need to change this?Lokesh Kamath
-
That does not seem like a pfSense setting.
Where are you enabling/disabling that?
Can they still reach websites etc without doing that?
Steve
-
@stephenw10
Thank you Steve.Without enable / Disable they cant use internet, mails, shared folder. In LAN there is no issue.
We are enabling / disabling in Client System Network.
Lokesh Kamath
-
that makes ZERO sense and has zero to do with pfsense.. Is your client getting a different IP, new info like dns, etc.. Pointing to pfsense when it wasn't before, etc.
-
Mmm, I could believe it was a rogue dhcp server setting a bad gateway.
Steve
-
@stephenw10
Thank you very much Steve.I have not mentioned any Gateway in DHCP Server.
Please find the below pictures.
FIN-DHCP
FIN-DNS-GATEWAY
Marketing DHCP
Marketing-DNS-GATEWAY
Purchase-DHCP
Purchase-DNS-GATEWAY
Moulding-DHCP
Moulding-DNS-GATEWAY
Quality_DHCP
Quality-DNS-GATEWAY
Should I Specify Gateway? If Yes pfSense LAN IP is the Gateway right. Also Should I add pfSense LAN IP in Gateway (Routing - Gateway)?
Lokesh Kamath
-
@stephenw10
Thank you very much Steve.I had given Gateway as mentioned below to each VLAN, but not mentioned in Routing - Gateways Please guide me if anything wrong.
Marketing DNS-GATEWAY
Purchase DNS-GATEWAY
Moulding DNS-GATEWAY
Quality DNS-GATEWAY
Lokesh Kamath
-
Dude who told you to put in a gateway - there is ZERO reason to do that. What he stated was there might a ROGUE dhcp server handing out the WRONG info!!
-
@johnpoz
Thank you very much John.I will remove that immediately.
@johnpoz, @stephenw10
I do not have any idea on that. please guide me.Lokesh Kamath
-
Before you go restarting your machines interfaces when something doesn't work... How about you troubleshoot WHY!!!
Are these machines windows? If so then simple
ipconfig /all
from cmd prompt will give you all the info for networking.. Does it show the proper info, what does it show for your dhcp server?
Can machine ping the box your trying to talk to for smtp? Can it resolve its FQDN? Where is this smtp server in your network? Is it outside your network?
-
@johnpoz
Thank you very muchWhen it is not working
1st I will check in pfSense machine will go to ping and select the VLAN and ping the LAN & Google.
2nd I will check in my machine is it working.
3rd I will tell then to disable & enable the network. Then it will work. Now users understood that everytime it is not working then they only disable & enable.All these machines are UBUNTU. No Windows.
Regarding SMTP i have not tried pinging from client. But I tried pinging google.com & it is pinging.
SMTP is outside network. It's in BIGROCK.IN
Lokesh Kamath
-
So when one machine is failing check the Connection Information in Network Manager.
A rogue DHCP server is some other device that has DHCP enabled on your network that is handing out leases instead of pfSense. Like a soho router you might be using as an access point for example.
Steve
-
@stephenw10
Thank you very much.Ok. Then we initially had an DHCP with Windows DC. but now I unauthorized it from DHCP (6 months back). may be that is the cause i think. If i can remove that machine from network my issue will be solved.
I will do that tomorrow and I will inform you.
Lokesh Kamath
-
If the boxes are ubuntu.. you can still view the same info just different way. Network Manager would be the gui way.
Very simple test would be traceroute fqdn of smtp server
Where does it fail? Does it even fail to resolve? Does it not get paste hop 1, you should do this test when working - does it take another path when not working, etc. etc.
-
-
-
Where did I say anything about the OLD DC? If you want help if figuring out what is wrong your going to have to give us some actually info to work with!!!
Your smtp server is outside - can you not reach it, can you not resolve it?
-
@johnpoz
Thank you John.Sorry.
SMTP Server is resolving no issue with that.
traceroute mail.laxmielectronics.com - Result
Marketing-VLAN
Quality-VLAN
Lokesh Kamath
-
That appears to be going via a completely different route. You don't even a 192.168.1.0/24 subnet on your pfSense firewall.
I suggest that device at 192.168.1.1 is some other rogue gateway device. Do you even have an account with actcorp.in?
Steve
-
@stephenw10
Thanks SteveNo We don't have actcorp ISP. I think the user has connected to his own wifi Internet due to it is showing like that.
I am sorry for that. Please excuse me. I will once again post the right details tomorrow.
Our ISP Spectra.
Lokesh Kamath
-
hop 2 in that trace 10.253 at 1700ms ??? WTF?? Yeah no wonder they having problems.. Whatever it is they are doing they are not going through your pfsense.
And a 13ms 1st hop is horrible - and most likely wifi.
-
Yup, or cellular. 10.243 smells like CGN to me.
Wouldn't be the first phone configured as a hotspot I've seen breaking stuff.Steve
-
@stephenw10 @johnpoz
Thank you very much.I am sorry for giving wrong info.
Traceroute Output.
LAN Traceroute
Marketing Traceroute
Purchase Traceroute
Lokesh Kamath
-
Does it work when you did those traceroutes?
-
@johnpoz
Thank you.Yes it is working when i give traceroute mail.laxmielectronics.com.
Lokesh Kamath
-
Well there you go then you have your root cause - users not using your connection when they fail ;)
The HUGE delays in that network could be a problem, or more than likely that isp they are going out blocks outbound 25.. If that is the port your talking to vs say 465 or 587 which are typical ports talking to smtp server when using encryption..
So now you need to figure out why that one that was failing was using that other network..
-
@johnpoz
Thank you.We are using most of the Ubuntu system 465 and windows system with 25 and Network Printers use 587 Pots.
Ubuntu can use 465 or587 no issues with that.
Windows Outlook will not work in 465,587 only work with 25.
Network printers will work in 587, 25 not in 465.
Those who are in LAN (nearly 30 Systems) dont have issues while sending mails or accessing Shared folder's. Only VLAN systems are having this issue.
Lokesh Kamath
-
@slkamath said in How to assign Domain Controller to VLAN Systems:
Windows Outlook will not work in 465,587 only work with 25.
That is NOT true at all.. Sorry but BS... on that - windows outlook can and does work on those ports if correctly configured.
You just stated clients are working when you did those traceroute - NO shit they might not work if yous end them out so wifi hotspot connection..
If a client is not working before you go resetting its interface - do some basic 101 troubleshooting for gosh sake.. .How is it your in charge of the firewall and don't grasp basic connectivity troubleshooting?? If your client is using port XYZ and its not working... Sniff on the firewall is the client actually sending SYN on that port, is it being blocked? Do you allow it in your rules.. Sniff on your wan are you sending it out? etc. etc...
-
Yes, we need to see a traceroute from a machine on one of the affected subnets when it is NOT working.
If you see no hops at all when you try that then check the connection information. Most likely it is no longer using pfSense as it's gateway.
Steve
-
@stephenw10 @johnpoz
Thank you very much.I am sorry I am configuring first time. I dont know anythng.
So most of the things i am searching in google and trying. Please dont mind. I am asking some basic help with very good experts. So Sorry for that.
Configured correctly in outlook. if I configure 465 and test it will fail. 587 is working fine.
Allowing & Blocked Ports mentioned already
If VLAN Clients are idle for 10 to 15 min we are facing the issue of disable & enable network.
Please find the below picture for better understanding.
Marketing-VLAN
When it is not working if i run traceroute commandBefore Disable & Enable Network
After Nework Disable & Enable (in Picture you can see wired connection connected)
Traceroute After Nework Disable & Enable
===============================================================
Purchase-VLAN
When it is not working if i run traceroute commandBefore Disable & Enable Network. Printing also holding. In picture you can see the print icon
After Nework Disable & Enable (in Picture you can see wired connection connected)
Printing is completed After Nework Disable & Enable
Traceroute Output after Nework Disable & Enable
-
So from that you can not just resolve it?
Can your clients resolve anything? Do a simple nslookup or dig for mail.laxmielectronics.com
Can you traceroute to its IP vs its name.. 142.4.7.34, Can you ping IP of pfsense - oh prob not because you are not even allowing basic icmp for troubleshooting..
And lets go over this yet AGAIN!!!~~ your rules are pretty much pointless... Those allow rules mean zero when below them you have an ANY ANY... Other than you saying your limiting bandwidth on that rule? Is that the case?
So your clients are pointing to DC for DNS? Thought you removed them? Where do the DCs get their dns - do they forward do they resolve? What network segment are they in? What are their rules for outbound to dns if resolving.
When you enable/disable the interface - what was it before?? Do a simple ifconfig output.. What was your IP of this device? What was its routing, do a simple netstat -nr
What version of linux you running can you run
systemd-resolve --statusOh that looks like ubuntu... about about
nmcli dev show | grep DNSI don't have a ubuntu handy with nmcli installed? or network manager
how about simple output of nslookup, it should tell you who your using - but more than likely just show you loopback as your prob running local cache. How about simple cat of resolv.conf
cat /etc/resolv.conf
-
Yes, your firewall rules need rationalising at some point but they are not the cause of the issue here.
You are losing, at least, DNS resolution when the connection fails. The easiest thing to do here is to grab screenshot of the connection information from the Network Manager on a client when it is working and when it fails.
That will show the IP, subnet, gateway and DNS server(s) it's configured to use.
Steve
-
@stephenw10 @johnpoz
Thank you very much.Rules of Marketing-VLAN
Rules of Purchase-VLAN
System Info
Marketing
System Info
Purchase
IFCONFIG
Marketing
IFCONFIG
Purchase
DIG & NSLOOKUP
Marketing - - - -> dig mail.laxmielectronics.com & dig 142.4.7.34
DIG & NSLOOKUP
Purchase - - - -> dig mail.laxmielectronics.com & dig 142.4.7.34
Before Network - Disable/Enable - NSLOOKUP
After Network - Disable/Enable - NSLOOKUP
NETSTAT
Marketing
NETSTAT
Purchase
CAT/ETC/RESOLV.CONF
Marketing
CAT/ETC/RESOLV.CONF
Purchase
TRACEROUTE
Marketing
after the traceroute 142.4.7.34 -- traceroute mail.laxmielectronics.com is working
TRACEROUTE
Purchase
Lokesh Kamath
-
So your pointing to local cache for dns... Doesn't actually tell you where your dns points to...
When did I ever say do a dns lookup of the IP?? Dude - how are you in this field??? I don't need to see every freaking screenshot when it works!!! Or doesn't work for gosh sake... Can you not take basic info and understand what is happening??
I you can not resolve the name - then NO shit your never going to get there..
You need to figure out WHY you can not resolve.. Is your local dns cache is failing or the actual dns?? Do a simple nslookup for the name to the actual dns server vs the local cache.. of 127.0.0.1
Pfsense is your dns right??? So
dig @ipaddressofpfsenseforthatvlan mail.laxmielectronics.com
If that fails - then WHY????? That is your problem...
-
Ok, so I think what you are showing there is that the machine in the Marketing VLAN is working and the machine in the Purchase VLAN was not able to resolve the mail server until you disabled/enabled the adapter, right?
Both those machines are configured to use external DNS servers. If that Connection Information screenshot was taken when it was not working it looks OK though. So you have some DNS issue.
Is there some reason you're not handing out the interface IP as DNS in DHCP?
Also both those machines are now out of date, the one in Purchase by a long way!
Steve
-
@stephenw10 @johnpoz
Thank you very much.I think initially pfsense IP (192.168.10.1) was not been set as DNS. Now I removed External DNS fom LAN & VLAN and kept blank. Now I am getting Primary DNS as pfSense IP.
dig 192.168.10.1 mail.laxmielectronics.com
did this from Purchase-VLAN and i am getting answer for both.dig 192.168.40.1 mail.laxmielectronics.com
did this from Purchase-VLAN and i am getting answer for both.I did some changes:
- Removed External DNS from LAN.
- Now LAN IF CONFIG - IP: 192.168.10.2 SUBNET: 24 Gateway: 192.168.10.1 Primary DNS: 192.168.10.1 (No Secondary DNS) I think now pfSense is pointing as DNS
- Removed External DNS (ISP Provided) from all VLANS.
- Now VLAN IFCONFIG - IP: 192.168.30.60 SUBNET: 24 Gateway: 192.168.30.1 Primary DNS: 192.168.30.1 (No Secondary DNS)
- Firewall VLAN Rules did few changes. (Same for other VLAN too)
I will test this today and update you.
Once again thanks for your time.
Lokesh Kamath