samba 4 AD and pfsense
-
I implemented pfsense on my network. more time the margins are not accommodated as shared folders on my file server (Samba). in the logs port 445 appeared TCP: SA, even authorizing the port!
-
Points to asymmetrical seeing a Syn, Ack blocked like that.. Meaning the SYN hit your box 9.4 from 5.13 without going through pfsense to allow it to create the state.
Can you provide a drawing of your networks connections so we can figure why your seeing the SA on pfsense.. Do you have downstream router? Do you have boxes with wrong mask set on the same network? etc..
-
Hello johnpoz
my topology is like
-
Yeah that is asymmetrical. You have your 3560 doing routing.. So 192.168.9/24 becomes your transit..
You would do it like this to prevent asymmetrical routing.
You could use 9/24 as your transit and move your samba box to new network
Or you could leave samba on 9/24 and create new transit between pfsense and your downstream router.
But what is happening is this.
Pfsense never sees the syn, because your 3560 is in the 9/24 so sends syn direct to samba box at 9.4 while samba has no idea how to get back to downstream networks, so sends to its gateway pfsense the syn,ack - pfsense says huh what? There is not state for that.
Other work around would be to do host routing on samba to say hey to get to 192.168.2, .3 and .4/24 talk to 192.168.9.254 on 3560... But that is not really best solution... But would be a work around until you can create correct transit network to 3560 from pfsense.
-
I'm using proxmox to virtualize my server, samba and pfsense are sharing the same interface
-
Well create a NEW network in proxmox and put your VM samba server there.. Or use a vlan for your transit, etc.. Or get rid of your downstream router..
Your current configuration is asymmetrical.. If you want to run it like that - borked if you ask me! Then you would have to host route on your samba box like I suggested.
Or you would have to NAT on your 3560 so the downstream networks all look like they come from 9.254 so that your AD server would know how to talk back, etc.
There are many ways to skin this cat.. The correct way is not to do asymmetrical routing.
-
Thanks johnpoz is working now
