How to assign Domain Controller to VLAN Systems

slkamath · Oct 8, 2018, 9:35 AM

Yes it is working when i give traceroute mail.laxmielectronics.com.

Lokesh Kamath

johnpoz · Oct 8, 2018, 9:52 AM

Well there you go then you have your root cause - users not using your connection when they fail ;)

The HUGE delays in that network could be a problem, or more than likely that isp they are going out blocks outbound 25.. If that is the port your talking to vs say 465 or 587 which are typical ports talking to smtp server when using encryption..

So now you need to figure out why that one that was failing was using that other network..

slkamath · Oct 8, 2018, 10:14 AM

@johnpoz
Thank you.

We are using most of the Ubuntu system 465 and windows system with 25 and Network Printers use 587 Pots.

Ubuntu can use 465 or587 no issues with that.

Windows Outlook will not work in 465,587 only work with 25.

Network printers will work in 587, 25 not in 465.

Those who are in LAN (nearly 30 Systems) dont have issues while sending mails or accessing Shared folder's. Only VLAN systems are having this issue.

Lokesh Kamath

johnpoz · Oct 8, 2018, 10:22 AM

@slkamath said in How to assign Domain Controller to VLAN Systems:

Windows Outlook will not work in 465,587 only work with 25.

That is NOT true at all.. Sorry but BS... on that - windows outlook can and does work on those ports if correctly configured.

You just stated clients are working when you did those traceroute - NO shit they might not work if yous end them out so wifi hotspot connection..

If a client is not working before you go resetting its interface - do some basic 101 troubleshooting for gosh sake.. .How is it your in charge of the firewall and don't grasp basic connectivity troubleshooting?? If your client is using port XYZ and its not working... Sniff on the firewall is the client actually sending SYN on that port, is it being blocked? Do you allow it in your rules.. Sniff on your wan are you sending it out? etc. etc...

stephenw10 · Oct 8, 2018, 10:55 AM

Yes, we need to see a traceroute from a machine on one of the affected subnets when it is NOT working.

If you see no hops at all when you try that then check the connection information. Most likely it is no longer using pfSense as it's gateway.

Steve

slkamath · Oct 9, 2018, 10:20 AM

@stephenw10 @johnpoz
Thank you very much.

I am sorry I am configuring first time. I dont know anythng.

So most of the things i am searching in google and trying. Please dont mind. I am asking some basic help with very good experts. So Sorry for that.

Configured correctly in outlook. if I configure 465 and test it will fail. 587 is working fine.

Allowing & Blocked Ports mentioned already

If VLAN Clients are idle for 10 to 15 min we are facing the issue of disable & enable network.

Please find the below picture for better understanding.

Marketing-VLAN
When it is not working if i run traceroute command

Before Disable & Enable Network

After Nework Disable & Enable (in Picture you can see wired connection connected)

Traceroute After Nework Disable & Enable

===============================================================

Purchase-VLAN
When it is not working if i run traceroute command

Before Disable & Enable Network. Printing also holding. In picture you can see the print icon

After Nework Disable & Enable (in Picture you can see wired connection connected)

Printing is completed After Nework Disable & Enable

Traceroute Output after Nework Disable & Enable

johnpoz · Oct 9, 2018, 10:39 AM

So from that you can not just resolve it?

Can your clients resolve anything? Do a simple nslookup or dig for mail.laxmielectronics.com

Can you traceroute to its IP vs its name.. 142.4.7.34, Can you ping IP of pfsense - oh prob not because you are not even allowing basic icmp for troubleshooting..

And lets go over this yet AGAIN!!!~~ your rules are pretty much pointless... Those allow rules mean zero when below them you have an ANY ANY... Other than you saying your limiting bandwidth on that rule? Is that the case?

So your clients are pointing to DC for DNS? Thought you removed them? Where do the DCs get their dns - do they forward do they resolve? What network segment are they in? What are their rules for outbound to dns if resolving.

When you enable/disable the interface - what was it before?? Do a simple ifconfig output.. What was your IP of this device? What was its routing, do a simple netstat -nr

What version of linux you running can you run
systemd-resolve --status

Oh that looks like ubuntu... about about
nmcli dev show | grep DNS

I don't have a ubuntu handy with nmcli installed? or network manager

how about simple output of nslookup, it should tell you who your using - but more than likely just show you loopback as your prob running local cache. How about simple cat of resolv.conf

cat /etc/resolv.conf

stephenw10 · Oct 9, 2018, 11:52 AM

Yes, your firewall rules need rationalising at some point but they are not the cause of the issue here.

You are losing, at least, DNS resolution when the connection fails. The easiest thing to do here is to grab screenshot of the connection information from the Network Manager on a client when it is working and when it fails.

That will show the IP, subnet, gateway and DNS server(s) it's configured to use.

Steve

slkamath · Oct 10, 2018, 5:26 AM

@stephenw10 @johnpoz
Thank you very much.

Rules of Marketing-VLAN

Rules of Purchase-VLAN

System Info
Marketing

System Info
Purchase

IFCONFIG
Marketing

IFCONFIG
Purchase

DIG & NSLOOKUP
Marketing - - - -> dig mail.laxmielectronics.com & dig 142.4.7.34

DIG & NSLOOKUP
Purchase - - - -> dig mail.laxmielectronics.com & dig 142.4.7.34

Before Network - Disable/Enable - NSLOOKUP

After Network - Disable/Enable - NSLOOKUP

NETSTAT
Marketing

NETSTAT
Purchase

CAT/ETC/RESOLV.CONF
Marketing

CAT/ETC/RESOLV.CONF
Purchase

TRACEROUTE
Marketing

after the traceroute 142.4.7.34 -- traceroute mail.laxmielectronics.com is working

TRACEROUTE
Purchase

Lokesh Kamath

johnpoz · Oct 10, 2018, 10:45 AM

So your pointing to local cache for dns... Doesn't actually tell you where your dns points to...

When did I ever say do a dns lookup of the IP?? Dude - how are you in this field??? I don't need to see every freaking screenshot when it works!!! Or doesn't work for gosh sake... Can you not take basic info and understand what is happening??

I you can not resolve the name - then NO shit your never going to get there..

You need to figure out WHY you can not resolve.. Is your local dns cache is failing or the actual dns?? Do a simple nslookup for the name to the actual dns server vs the local cache.. of 127.0.0.1

Pfsense is your dns right??? So

dig @ipaddressofpfsenseforthatvlan mail.laxmielectronics.com

If that fails - then WHY????? That is your problem...

stephenw10 · Oct 10, 2018, 1:34 PM

Ok, so I think what you are showing there is that the machine in the Marketing VLAN is working and the machine in the Purchase VLAN was not able to resolve the mail server until you disabled/enabled the adapter, right?

Both those machines are configured to use external DNS servers. If that Connection Information screenshot was taken when it was not working it looks OK though. So you have some DNS issue.

Is there some reason you're not handing out the interface IP as DNS in DHCP?

Also both those machines are now out of date, the one in Purchase by a long way!

Steve

slkamath · Oct 12, 2018, 6:17 AM

@stephenw10 @johnpoz
Thank you very much.

I think initially pfsense IP (192.168.10.1) was not been set as DNS. Now I removed External DNS fom LAN & VLAN and kept blank. Now I am getting Primary DNS as pfSense IP.

dig 192.168.10.1 mail.laxmielectronics.com
did this from Purchase-VLAN and i am getting answer for both.

dig 192.168.40.1 mail.laxmielectronics.com
did this from Purchase-VLAN and i am getting answer for both.

I did some changes:

Removed External DNS from LAN.
Now LAN IF CONFIG - IP: 192.168.10.2 SUBNET: 24 Gateway: 192.168.10.1 Primary DNS: 192.168.10.1 (No Secondary DNS) I think now pfSense is pointing as DNS
Removed External DNS (ISP Provided) from all VLANS.
Now VLAN IFCONFIG - IP: 192.168.30.60 SUBNET: 24 Gateway: 192.168.30.1 Primary DNS: 192.168.30.1 (No Secondary DNS)
Firewall VLAN Rules did few changes. (Same for other VLAN too)

I will test this today and update you.

Once again thanks for your time.

Lokesh Kamath

johnpoz · Oct 12, 2018, 5:41 PM

@slkamath said in How to assign Domain Controller to VLAN Systems:

Removed External DNS (ISP Provided) from all VLANS.

Your clients that are members of AD... Ie you have domain controllers should be pointing to your DC that running dns for your domain.. This will be the authoritative NS for your AD.. And have all your AD records in it..

This or these NS if you have more than 1 running your AD dns will either forward or resolve any domains it is not authoritative for.. Member machines of AD should always point to the NS for your AD.. That would not be pfsense out of the box running unbound.. You could prob do with the bind package.. But when you have AD, it makes little sense to not just run DNS for on one of the DCs if not multiples of them.

Pointing client machines to more than 1 NS that can not resolve the same stuff is going to lead you to nothing but problems since you can never be sure which NS your client is going to ask for specific query.

If your clients were pointing to multiple NS and 1 of them could not resolve your smtp servers fqdn, then yeah a reset of the interface would prob force it to query the 1st vs the 2nd, etc. Or who knows how you had them setup..

If your going to point your clients to pfsense for dns and you running an AD, your going to want to make sure you setup all the domain overrides for your AD dns, or your going to want to make sure pfsense points to your AD nameserver(s)..

slkamath · Oct 12, 2018, 5:41 PM

@johnpoz
Thank you very much.

I really forgotten the AD clients. Thank you so much for reminding.

Still disable & enable is must for only VLAN Clients.

Lokesh Kamath

johnpoz · Oct 12, 2018, 6:06 PM

Dude where are they pointing for DNS?? You do understand that showing 127.0.0.1 is pointing them to their own local running copy of dnsmasq - you need to know where that points!!!

slkamath · Oct 12, 2018, 6:17 PM

@johnpoz
Thank you very much.

In LAN few Ubuntu systems are there and those system also shows 127.0.0.1 but no issue with those (if system idle for anytime next moment it is working).

Those VLAN clients DNS pointing can I manually change to pfSense ??

Lokesh Kamath

johnpoz · Oct 12, 2018, 6:38 PM

Your clients should point to your AD for dns..

My point is your clients showing that they point to loopback doesn't tell you where they point... They are pointing to their own local cache..

slkamath · Oct 12, 2018, 6:43 PM

@johnpoz
Thank you so much.

I will do the changes by monday and let you know.

Once again thanks for your time.

Lokesh Kamath