samba 4 AD and pfsense

toni networking · Mar 9, 2019, 12:40 PM

I implemented pfsense on my network. more time the margins are not accommodated as shared folders on my file server (Samba). in the logs port 445 appeared TCP: SA, even authorizing the port!🔒 Log in to view

johnpoz · Mar 9, 2019, 12:46 PM

Points to asymmetrical seeing a Syn, Ack blocked like that.. Meaning the SYN hit your box 9.4 from 5.13 without going through pfsense to allow it to create the state.

Can you provide a drawing of your networks connections so we can figure why your seeing the SA on pfsense.. Do you have downstream router? Do you have boxes with wrong mask set on the same network? etc..

toni networking · Mar 9, 2019, 12:57 PM

Hello johnpoz
my topology is like
🔒 Log in to view

johnpoz · Mar 9, 2019, 1:12 PM

Yeah that is asymmetrical. You have your 3560 doing routing.. So 192.168.9/24 becomes your transit..

You would do it like this to prevent asymmetrical routing.

You could use 9/24 as your transit and move your samba box to new network
🔒 Log in to view

Or you could leave samba on 9/24 and create new transit between pfsense and your downstream router.

🔒 Log in to view

But what is happening is this.

🔒 Log in to view

Pfsense never sees the syn, because your 3560 is in the 9/24 so sends syn direct to samba box at 9.4 while samba has no idea how to get back to downstream networks, so sends to its gateway pfsense the syn,ack - pfsense says huh what? There is not state for that.

Other work around would be to do host routing on samba to say hey to get to 192.168.2, .3 and .4/24 talk to 192.168.9.254 on 3560... But that is not really best solution... But would be a work around until you can create correct transit network to 3560 from pfsense.

toni networking · Mar 9, 2019, 1:44 PM

I'm using proxmox to virtualize my server, samba and pfsense are sharing the same interface

johnpoz · Mar 9, 2019, 1:49 PM

Well create a NEW network in proxmox and put your VM samba server there.. Or use a vlan for your transit, etc.. Or get rid of your downstream router..

Your current configuration is asymmetrical.. If you want to run it like that - borked if you ask me! Then you would have to host route on your samba box like I suggested.

Or you would have to NAT on your 3560 so the downstream networks all look like they come from 9.254 so that your AD server would know how to talk back, etc.

There are many ways to skin this cat.. The correct way is not to do asymmetrical routing.

toni networking · Mar 11, 2019, 10:40 AM

Thanks johnpoz is working now