Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense with AWS over IPsec DNS - Need help :)

    Scheduled Pinned Locked Moved DHCP and DNS
    1 Posts 1 Posters 454 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      ceofreak
      last edited by

      Hi guys,

      First things first - I am aware that all clients should use the AD DNS as a primary DNS Server, but because we have no on-premises Server at all, the resolve time would go up from ~50ms to ~200ms because the request first goes over the IPSec tunnel to reach the Domain Controller.

      Now I'm running into what I think is a DNS related issue. The setup is:

      Internal Network ->pfSense ->IPSec ->AWS -> Server 2016 DC

      So our Domain Controller resides inside of AWS. I can join computers to the domain, no problem.

      pfSense handles DNS and DHCP. A Domain Override was set up on pfSense.

      So as I said, I can join the Domain and as long as the user is local admin on the machine, I have no issues. When the user isn't local admin and tries to install something, it takes minutes until the UAC prompt pops up and asks for Domain Admin credentials.

      Now I did not set any forwarders or did any configuration on the DC DNS at all. The clients that join the domain register in the DC DNS with the correct IP.

      A few tests I did, lets call the DC DC1 and the domain mydomain.com

      NSLOOKUP on DC1:

      DC1: Doesn't look up
      DC1.mydomain.com: Does look up

      NSLOOKUP on a Client in the internal network:

      DC1: Does look up
      DC1.mydomain.com: Does look up
      mydomain.com: does look up

      pfSense Diagnotics / DNS Lookup:

      DC1: Looks up over 127.0.0.1 0msec
      DC1.mydomain.com: looks up over 127.0.0.1 0msec

      Now I just assume it could be a DNS issue. Everything works perfectly fine as long as the user is local admin, but that is not a desired state.

      I'm really stuck here and need some advise :)

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.