• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

How to assign Domain Controller to VLAN Systems

Scheduled Pinned Locked Moved General pfSense Questions
61 Posts 4 Posters 11.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    johnpoz LAYER 8 Global Moderator
    last edited by johnpoz Sep 28, 2018, 10:05 AM Sep 28, 2018, 9:58 AM

    @slkamath said in How to assign Domain Controller to VLAN Systems:

    Also I created Gateway for all the VLANS apart from WAN Gateway

    NO!!!

    Your telling pfsense the gateway to get to network xyz is itself?? NO!! there is no gateways setup on pfsense to talk to networks its directly attached too..

    Think about it for 2 freaking seconds.. How would 192.168.20 talk to 192.168.40 --- BOTH rfc1918 if you have rule that says hey BLOCK rfc1918 source from talking anywhere..

    Rules are evaluated as traffic enters an interface from the network its attached too, first rule to trigger wins, no other rules are evaluated... You have a rule right at the top that says hey your blocked!! No other rules are even looked at.

    And where could it EVER be possible to see a bogon as source on your own freaking network? Do you even understand what a bogon is? Why are you blocking it? You do understand rfc1918 is part of bogon ;) Pfsense pulls it out of the bogon table - but it is by definition a bogon. So You have 2 rules that state - HEY.. 192.168.x.x - your Blocked... So from those rules NOTHING would work, you couldn't even ask pfsense for dns with those rules.

    An intelligent man is sometimes forced to be drunk to spend time with his fools
    If you get confused: Listen to the Music Play
    Please don't Chat/PM me for help, unless mod related
    SG-4860 24.11 | Lab VMs 2.8, 24.11

    S 1 Reply Last reply Sep 29, 2018, 5:12 PM Reply Quote 0
    • S
      slkamath @johnpoz
      last edited by Sep 29, 2018, 5:12 PM

      @johnpoz
      Thank You Very Much.

      I removed the RFC1918 and also I removed all the Gateway for VLAN.

      Thank you so much. Now VLAN is talking with LAN.

      Every now & then they need to disconnect network & re-connect then only mails or shared server is working. Is that any rules issue?

      For that purpose i hive given access to all the Mails port (143, 993, 110, 465, 25, 995)

      Marketing-VLAN
      0_1538234562293_Marketing-VLAN.png

      Purchase-VLAN
      0_1538234580087_Purchase-VLAN.png

      Fin-VLAN is working apart Finance Software Tally. It says The Tally Server is not in the same Gateway

      Tally Server is in LAN. Tally Users are in Fin-VLAN

      Tally Server IP - 192.168.10.100 (ODBC Server port 9000, Tally Port 9999)
      Fin-VLAN - 192.168.20.50

      So any guidance.

      Lokesh Kamath

      1 Reply Last reply Reply Quote 0
      • J
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz Sep 29, 2018, 6:41 PM Sep 29, 2018, 6:41 PM

        You don't seem to understand how rules work. Rules are evaluated TOP down.. First rule to trigger wins and NO OTHER rules are evaluated.

        All of those allow rules are pointless because you have that allow purchase net tcp/udp any rule..

        And then you have 2 rules below that allow to specific sites?

        How would you ever get to the reject rules?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        S 1 Reply Last reply Sep 30, 2018, 1:38 PM Reply Quote 0
        • S
          slkamath @johnpoz
          last edited by Sep 30, 2018, 1:38 PM

          @johnpoz
          Thank you very much.

          What i understood was it will check 1st rule if it is not matching will go to 2nd like that so on. If the rule is not specified or not matching i thought it will be blocked. 😇

          Based on the idea given by you i have did few changes. Please correct me if i am wrong.

          Fin-VLAN
          0_1538314108468_Fin-VLAN.png

          Marketing-VLAN
          0_1538314140084_Marketing VLAN.png

          Purchase-VLAN
          0_1538314165255_Purchase VLAN.png

          Quality-VLAN
          0_1538314175450_Quality VLAN.png

          Allow Specific Sites are the sites of Government Sites which is required for few departments. Due to block of News & Social Media (Squid Guard) few sites will not work so created alias and allowing it (Don't know this is right or wrong).

          I thought if the rule is not specified means it will reject directly. No idea how to reject other than that. I think I am having very poor knowledge. 😖

          Lokesh Kamath

          J 1 Reply Last reply Sep 30, 2018, 3:08 PM Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator @slkamath
            last edited by johnpoz Sep 30, 2018, 3:12 PM Sep 30, 2018, 3:08 PM

            @slkamath said in How to assign Domain Controller to VLAN Systems:

            What i understood was it will check 1st rule if it is not matching will go to 2nd like that so on.

            Exactly - but what is the point of allowing X, above a rule that allows ALL? And blocking something below a rule that allow ALL will never be evaluated.

            And yes there is a default deny that is not shown - so if you run through your rules and its not allowed then it will be blocked.

            Your block rules on the end of your quality net are pointless.. They would just be blocked by the default deny if not allowed above. So unless you wanted to specifically log them or reject them vs just deny those rules are pointless.

            What option do you have set in that allow to lan net? The gear symbol. That rule makes no sense because it allows all lan net, so what is the point of allowing to a specific lan IP?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            S 1 Reply Last reply Sep 30, 2018, 4:47 PM Reply Quote 0
            • S
              slkamath @johnpoz
              last edited by Sep 30, 2018, 4:47 PM

              @johnpoz
              Thank you very much.

              How to put default deny rule (please find the pic below is it correct)?

              Again did some changes.

              Quality-VLAN
              0_1538325663826_Quality VLAN.png

              Gear Symbol is for Upload & Download limit set so it shows that symbol. In LAN there are nearly 10 IP's. All VLAN has to access those IP's (Shared Folder, Network Printer, Backup, Domain Controller, Tally).

              LAN
              0_1538325683153_LAN.png

              Can you suggest any book or something so that i will get some knowledge to make it correct.

              Lokesh Kamath

              1 Reply Last reply Reply Quote 0
              • S
                stephenw10 Netgate Administrator
                last edited by Sep 30, 2018, 6:08 PM

                I suggest reading this chapter from the pfSense book:
                https://www.netgate.com/docs/pfsense/book/firewall/firewall-fundamentals.html

                Steve

                S 1 Reply Last reply Sep 30, 2018, 6:09 PM Reply Quote 0
                • S
                  slkamath @stephenw10
                  last edited by Sep 30, 2018, 6:09 PM

                  @stephenw10
                  Thank you Stephen.

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz Oct 1, 2018, 11:04 AM Oct 1, 2018, 11:02 AM

                    Did you post the wrong pic - your qual ne has the block rfc1918 and bogon again..

                    Your lan rules everything below your any any is just pointless!! Not sure why this is so difficult to understand..

                    Imagine a source IP:PORT and DESTIP:PORT and protocol - now run through your rules top to bottom.

                    You have an ANY ANY rule - any protocol and source any dest.. So when would that rule not trigger and get to the safe_IP rule??

                    When would something not trigger that any any rule and fall through to your block rules? Your any any allows ANY, so
                    clearly ports 80 and 443 are part of ANY..

                    If you don't want IPs getting to 80/443 then those rules go ABOVE your any any rule.. Those will then be blocked and other ports like say 123 would not trigger those rules and be allowed through the any any rule.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    S 1 Reply Last reply Oct 3, 2018, 8:31 AM Reply Quote 0
                    • S
                      slkamath @johnpoz
                      last edited by slkamath Oct 3, 2018, 8:35 AM Oct 3, 2018, 8:31 AM

                      @johnpoz
                      Thank you Very Much

                      Sorry for the delay.

                      I made few changes. Please have a look. Also any mistake please guide me.

                      LAN - Allow Browsing is only for 5 IP's
                      0_1538554995442_LAN.png

                      LAN-UPDATED
                      0_1538555698922_LAN.png

                      Fin-VLAN
                      0_1538555019321_Fin-VLAN.png

                      Marketing-VLAN
                      0_1538555032187_Marketing-VLAN.png

                      Quality-VLAN
                      0_1538555045354_Quality-VLAN.png

                      One more issue that i am facing is
                      All the VLAN systems need to Disable & Enable the network to Send/Receive Mails or Accessing Shared Folder else share folder or mails will not work. (timeline of 2 to 5 min we need to disable & enable network)
                      Where I need to change this?

                      Lokesh Kamath

                      1 Reply Last reply Reply Quote 0
                      • S
                        stephenw10 Netgate Administrator
                        last edited by Oct 3, 2018, 4:23 PM

                        Looks like you still have an allow all rule on the Fin-VLAN interface that will catch all traffic before it hits any of the other rules.

                        Steve

                        S 1 Reply Last reply Oct 3, 2018, 6:34 PM Reply Quote 0
                        • S
                          slkamath @stephenw10
                          last edited by Oct 3, 2018, 6:34 PM

                          @stephenw10
                          Thank you Stephen.

                          I will change the Fin-VLAN. Thanks. Other VLAN is correct?

                          Lokeh Kamath

                          1 Reply Last reply Reply Quote 0
                          • S
                            stephenw10 Netgate Administrator
                            last edited by Oct 3, 2018, 7:09 PM

                            Well they don't look immediately wrong. Without knowing exactly what you need to do I can't say more than that.

                            Steve

                            S 1 Reply Last reply Oct 4, 2018, 5:46 AM Reply Quote 0
                            • S
                              slkamath @stephenw10
                              last edited by Oct 4, 2018, 5:46 AM

                              @stephenw10

                              Thank You Very Much Steve.

                              One more issue that i am facing is
                              All the VLAN systems need to Disable & Enable the network to Send/Receive Mails or Accessing Shared Folder else share folder or mails will not work. (timeline of 2 to 5 min we need to disable & enable network) Where I need to change this?

                              Lokesh Kamath

                              1 Reply Last reply Reply Quote 0
                              • S
                                stephenw10 Netgate Administrator
                                last edited by Oct 4, 2018, 5:16 PM

                                That does not seem like a pfSense setting.

                                Where are you enabling/disabling that?

                                Can they still reach websites etc without doing that?

                                Steve

                                S 1 Reply Last reply Oct 4, 2018, 5:53 PM Reply Quote 0
                                • S
                                  slkamath @stephenw10
                                  last edited by Oct 4, 2018, 5:53 PM

                                  @stephenw10
                                  Thank you Steve.

                                  Without enable / Disable they cant use internet, mails, shared folder. In LAN there is no issue.

                                  We are enabling / disabling in Client System Network.

                                  Lokesh Kamath

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by Oct 4, 2018, 6:05 PM

                                    that makes ZERO sense and has zero to do with pfsense.. Is your client getting a different IP, new info like dns, etc.. Pointing to pfsense when it wasn't before, etc.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      stephenw10 Netgate Administrator
                                      last edited by Oct 4, 2018, 8:18 PM

                                      Mmm, I could believe it was a rogue dhcp server setting a bad gateway.

                                      Steve

                                      S 1 Reply Last reply Oct 5, 2018, 3:57 AM Reply Quote 0
                                      • S
                                        slkamath @stephenw10
                                        last edited by Oct 5, 2018, 3:57 AM

                                        @stephenw10
                                        Thank you very much Steve.

                                        I have not mentioned any Gateway in DHCP Server.

                                        Please find the below pictures.

                                        FIN-DHCP
                                        0_1538711320458_Finance DHCP.png

                                        FIN-DNS-GATEWAY
                                        0_1538711437781_DNS & Gateway.png

                                        Marketing DHCP
                                        0_1538711447104_Marketing DHCP.png

                                        Marketing-DNS-GATEWAY
                                        0_1538711458922_DNS & Gateway.png

                                        Purchase-DHCP
                                        0_1538711509385_Purchase DHCP.png

                                        Purchase-DNS-GATEWAY
                                        0_1538711518611_DNS & Gateway.png

                                        Moulding-DHCP
                                        0_1538711527342_Moulding DHCP.png

                                        Moulding-DNS-GATEWAY
                                        0_1538711535242_DNS & Gateway.png

                                        Quality_DHCP
                                        0_1538711544623_Quality DHCP.png

                                        Quality-DNS-GATEWAY
                                        0_1538711553691_DNS & Gateway.png

                                        Should I Specify Gateway? If Yes pfSense LAN IP is the Gateway right. Also Should I add pfSense LAN IP in Gateway (Routing - Gateway)?

                                        Lokesh Kamath

                                        S 1 Reply Last reply Oct 5, 2018, 5:33 AM Reply Quote 0
                                        • S
                                          slkamath @slkamath
                                          last edited by slkamath Oct 5, 2018, 5:35 AM Oct 5, 2018, 5:33 AM

                                          @stephenw10
                                          Thank you very much Steve.

                                          I had given Gateway as mentioned below to each VLAN, but not mentioned in Routing - Gateways Please guide me if anything wrong.

                                          Marketing DNS-GATEWAY
                                          0_1538717584757_Marketing DNS & Gateway.png

                                          Purchase DNS-GATEWAY
                                          0_1538717591964_Purchase DNS & Gateway.png

                                          Moulding DNS-GATEWAY
                                          0_1538717603411_Moulding DNS & Gateway.png

                                          Quality DNS-GATEWAY
                                          0_1538717687591_Quality DNS & Gateway.png

                                          Lokesh Kamath

                                          1 Reply Last reply Reply Quote 0
                                          26 out of 61
                                          • First post
                                            26/61
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received