Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to assign Domain Controller to VLAN Systems

    Scheduled Pinned Locked Moved General pfSense Questions
    61 Posts 4 Posters 11.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • slkamathS
      slkamath @johnpoz
      last edited by

      @johnpoz

      I removed the Old Windows DC from the Network but still no luck.

      Lokesh Kamath

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Where did I say anything about the OLD DC? If you want help if figuring out what is wrong your going to have to give us some actually info to work with!!!

        Your smtp server is outside - can you not reach it, can you not resolve it?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        slkamathS 1 Reply Last reply Reply Quote 0
        • slkamathS
          slkamath @johnpoz
          last edited by

          @johnpoz
          Thank you John.

          Sorry.

          SMTP Server is resolving no issue with that.

          traceroute mail.laxmielectronics.com - Result

          Marketing-VLAN
          0_1538849746243_Traceroute MarketingVLAN.png

          Quality-VLAN
          0_1538849766175_Traceroute Quality VLAN.png

          Lokesh Kamath

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            That appears to be going via a completely different route. You don't even a 192.168.1.0/24 subnet on your pfSense firewall.

            I suggest that device at 192.168.1.1 is some other rogue gateway device. Do you even have an account with actcorp.in?

            Steve

            slkamathS 1 Reply Last reply Reply Quote 0
            • slkamathS
              slkamath @stephenw10
              last edited by slkamath

              @stephenw10
              Thanks Steve

              No We don't have actcorp ISP. I think the user has connected to his own wifi Internet due to it is showing like that.

              I am sorry for that. Please excuse me. I will once again post the right details tomorrow.

              Our ISP Spectra.

              Lokesh Kamath

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                hop 2 in that trace 10.253 at 1700ms ??? WTF?? Yeah no wonder they having problems.. Whatever it is they are doing they are not going through your pfsense.

                And a 13ms 1st hop is horrible - and most likely wifi.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by stephenw10

                  Yup, or cellular. 10.243 smells like CGN to me.
                  Wouldn't be the first phone configured as a hotspot I've seen breaking stuff. 😉

                  Steve

                  slkamathS 1 Reply Last reply Reply Quote 0
                  • slkamathS
                    slkamath @stephenw10
                    last edited by

                    @stephenw10 @johnpoz
                    Thank you very much.

                    I am sorry for giving wrong info.

                    Traceroute Output.

                    LAN Traceroute
                    0_1538976323669_LAN Traceroute.png

                    Marketing Traceroute
                    0_1538976333918_Marketing Traceroute.png

                    Purchase Traceroute
                    0_1538976344602_Purchase Traceroute.png

                    Lokesh Kamath

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      Does it work when you did those traceroutes?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      slkamathS 1 Reply Last reply Reply Quote 0
                      • slkamathS
                        slkamath @johnpoz
                        last edited by

                        @johnpoz
                        Thank you.

                        Yes it is working when i give traceroute mail.laxmielectronics.com.

                        Lokesh Kamath

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          Well there you go then you have your root cause - users not using your connection when they fail ;)

                          The HUGE delays in that network could be a problem, or more than likely that isp they are going out blocks outbound 25.. If that is the port your talking to vs say 465 or 587 which are typical ports talking to smtp server when using encryption..

                          So now you need to figure out why that one that was failing was using that other network..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          slkamathS 1 Reply Last reply Reply Quote 0
                          • slkamathS
                            slkamath @johnpoz
                            last edited by

                            @johnpoz
                            Thank you.

                            We are using most of the Ubuntu system 465 and windows system with 25 and Network Printers use 587 Pots.

                            Ubuntu can use 465 or587 no issues with that.

                            Windows Outlook will not work in 465,587 only work with 25.

                            Network printers will work in 587, 25 not in 465.

                            Those who are in LAN (nearly 30 Systems) dont have issues while sending mails or accessing Shared folder's. Only VLAN systems are having this issue.

                            Lokesh Kamath

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @slkamath
                              last edited by

                              @slkamath said in How to assign Domain Controller to VLAN Systems:

                              Windows Outlook will not work in 465,587 only work with 25.

                              That is NOT true at all.. Sorry but BS... on that - windows outlook can and does work on those ports if correctly configured.

                              You just stated clients are working when you did those traceroute - NO shit they might not work if yous end them out so wifi hotspot connection..

                              If a client is not working before you go resetting its interface - do some basic 101 troubleshooting for gosh sake.. .How is it your in charge of the firewall and don't grasp basic connectivity troubleshooting?? If your client is using port XYZ and its not working... Sniff on the firewall is the client actually sending SYN on that port, is it being blocked? Do you allow it in your rules.. Sniff on your wan are you sending it out? etc. etc...

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Yes, we need to see a traceroute from a machine on one of the affected subnets when it is NOT working.

                                If you see no hops at all when you try that then check the connection information. Most likely it is no longer using pfSense as it's gateway.

                                Steve

                                slkamathS 1 Reply Last reply Reply Quote 0
                                • slkamathS
                                  slkamath @stephenw10
                                  last edited by

                                  @stephenw10 @johnpoz
                                  Thank you very much.

                                  I am sorry I am configuring first time. I dont know anythng.

                                  So most of the things i am searching in google and trying. Please dont mind. I am asking some basic help with very good experts. So Sorry for that.

                                  Configured correctly in outlook. if I configure 465 and test it will fail. 587 is working fine.

                                  Allowing & Blocked Ports mentioned already
                                  0_1539078323081_Allowed Port.png

                                  0_1539078333192_Blocked Port.png

                                  If VLAN Clients are idle for 10 to 15 min we are facing the issue of disable & enable network.

                                  Please find the below picture for better understanding.

                                  Marketing-VLAN
                                  When it is not working if i run traceroute command

                                  Before Disable & Enable Network
                                  0_1539076308380_1.png

                                  After Nework Disable & Enable (in Picture you can see wired connection connected)
                                  0_1539076588545_2.png

                                  Traceroute After Nework Disable & Enable
                                  0_1539077028052_Traceroute.png

                                  ===============================================================

                                  Purchase-VLAN
                                  When it is not working if i run traceroute command

                                  Before Disable & Enable Network. Printing also holding. In picture you can see the print icon
                                  0_1539077592580_1.png

                                  After Nework Disable & Enable (in Picture you can see wired connection connected)
                                  0_1539077721348_2.png

                                  Printing is completed After Nework Disable & Enable
                                  0_1539077856501_3.png

                                  Traceroute Output after Nework Disable & Enable
                                  0_1539077953422_Traceroute 1.png

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    So from that you can not just resolve it?

                                    Can your clients resolve anything? Do a simple nslookup or dig for mail.laxmielectronics.com

                                    Can you traceroute to its IP vs its name.. 142.4.7.34, Can you ping IP of pfsense - oh prob not because you are not even allowing basic icmp for troubleshooting..

                                    And lets go over this yet AGAIN!!!~~ your rules are pretty much pointless... Those allow rules mean zero when below them you have an ANY ANY... Other than you saying your limiting bandwidth on that rule? Is that the case?

                                    So your clients are pointing to DC for DNS? Thought you removed them? Where do the DCs get their dns - do they forward do they resolve? What network segment are they in? What are their rules for outbound to dns if resolving.

                                    When you enable/disable the interface - what was it before?? Do a simple ifconfig output.. What was your IP of this device? What was its routing, do a simple netstat -nr

                                    What version of linux you running can you run
                                    systemd-resolve --status

                                    Oh that looks like ubuntu... about about
                                    nmcli dev show | grep DNS

                                    I don't have a ubuntu handy with nmcli installed? or network manager

                                    how about simple output of nslookup, it should tell you who your using - but more than likely just show you loopback as your prob running local cache. How about simple cat of resolv.conf

                                    cat /etc/resolv.conf

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Yes, your firewall rules need rationalising at some point but they are not the cause of the issue here.

                                      You are losing, at least, DNS resolution when the connection fails. The easiest thing to do here is to grab screenshot of the connection information from the Network Manager on a client when it is working and when it fails.

                                      That will show the IP, subnet, gateway and DNS server(s) it's configured to use.

                                      Steve

                                      slkamathS 1 Reply Last reply Reply Quote 0
                                      • slkamathS
                                        slkamath @stephenw10
                                        last edited by

                                        @stephenw10 @johnpoz
                                        Thank you very much.

                                        Rules of Marketing-VLAN
                                        0_1539146552186_Marketing VLAN.png

                                        Rules of Purchase-VLAN
                                        0_1539146560589_Purchase VLAN.png

                                        System Info
                                        Marketing

                                        0_1539147158962_About Info.png

                                        System Info
                                        Purchase

                                        0_1539147169945_About Info.png

                                        IFCONFIG
                                        Marketing
                                        0_1539148268143_IPconfig.png
                                        0_1539147092312_Network Connections.png

                                        IFCONFIG
                                        Purchase
                                        0_1539147054648_IFConfig.png
                                        0_1539147063800_NW Connection.png

                                        DIG & NSLOOKUP
                                        Marketing - - - -> dig mail.laxmielectronics.com & dig 142.4.7.34
                                        0_1539146859717_dig mail.laxmielectronics.com.png
                                        0_1539147337556_nslookup.png

                                        DIG & NSLOOKUP
                                        Purchase - - - -> dig mail.laxmielectronics.com & dig 142.4.7.34
                                        0_1539148320274_Dig mail.laxmielectronics.com.png
                                        0_1539148383528_Dig 142.4.7.34.png
                                        Before Network - Disable/Enable - NSLOOKUP
                                        0_1539148214529_nslookup.png

                                        After Network - Disable/Enable - NSLOOKUP
                                        0_1539148175749_NW Disable Enable NSLookup 1.png

                                        NETSTAT
                                        Marketing

                                        0_1539147705659_Netstat.png

                                        NETSTAT
                                        Purchase

                                        0_1539147690670_Netstat.png

                                        CAT/ETC/RESOLV.CONF
                                        Marketing
                                        0_1539147778356_Resolv.conf.png

                                        CAT/ETC/RESOLV.CONF
                                        Purchase
                                        0_1539147789619_Resolv.conf.png

                                        TRACEROUTE
                                        Marketing

                                        0_1539147881734_Traceroute.png
                                        0_1539147917143_Traceroute IP.png
                                        after the traceroute 142.4.7.34 -- traceroute mail.laxmielectronics.com is working
                                        0_1539147970950_After Traceroute IP.png

                                        TRACEROUTE
                                        Purchase

                                        0_1539148076269_Traceroute.png

                                        Lokesh Kamath

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          So your pointing to local cache for dns... Doesn't actually tell you where your dns points to...

                                          When did I ever say do a dns lookup of the IP?? Dude - how are you in this field??? I don't need to see every freaking screenshot when it works!!! Or doesn't work for gosh sake... Can you not take basic info and understand what is happening??

                                          I you can not resolve the name - then NO shit your never going to get there..

                                          You need to figure out WHY you can not resolve.. Is your local dns cache is failing or the actual dns?? Do a simple nslookup for the name to the actual dns server vs the local cache.. of 127.0.0.1

                                          Pfsense is your dns right??? So

                                          dig @ipaddressofpfsenseforthatvlan mail.laxmielectronics.com

                                          If that fails - then WHY????? That is your problem...

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Ok, so I think what you are showing there is that the machine in the Marketing VLAN is working and the machine in the Purchase VLAN was not able to resolve the mail server until you disabled/enabled the adapter, right?

                                            Both those machines are configured to use external DNS servers. If that Connection Information screenshot was taken when it was not working it looks OK though. So you have some DNS issue.

                                            Is there some reason you're not handing out the interface IP as DNS in DHCP?

                                            Also both those machines are now out of date, the one in Purchase by a long way!

                                            Steve

                                            slkamathS 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.