PfSense with AWS over IPsec DNS - Need help :)
-
Hi guys,
First things first - I am aware that all clients should use the AD DNS as a primary DNS Server, but because we have no on-premises Server at all, the resolve time would go up from ~50ms to ~200ms because the request first goes over the IPSec tunnel to reach the Domain Controller.
Now I'm running into what I think is a DNS related issue. The setup is:
Internal Network ->pfSense ->IPSec ->AWS -> Server 2016 DC
So our Domain Controller resides inside of AWS. I can join computers to the domain, no problem.
pfSense handles DNS and DHCP. A Domain Override was set up on pfSense.
So as I said, I can join the Domain and as long as the user is local admin on the machine, I have no issues. When the user isn't local admin and tries to install something, it takes minutes until the UAC prompt pops up and asks for Domain Admin credentials.
Now I did not set any forwarders or did any configuration on the DC DNS at all. The clients that join the domain register in the DC DNS with the correct IP.
A few tests I did, lets call the DC DC1 and the domain mydomain.com
NSLOOKUP on DC1:
DC1: Doesn't look up
DC1.mydomain.com: Does look upNSLOOKUP on a Client in the internal network:
DC1: Does look up
DC1.mydomain.com: Does look up
mydomain.com: does look uppfSense Diagnotics / DNS Lookup:
DC1: Looks up over 127.0.0.1 0msec
DC1.mydomain.com: looks up over 127.0.0.1 0msecNow I just assume it could be a DNS issue. Everything works perfectly fine as long as the user is local admin, but that is not a desired state.
I'm really stuck here and need some advise :)