• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

I can't join users of the VLAN on Windows Server domain

Scheduled Pinned Locked Moved General pfSense Questions
14 Posts 5 Posters 4.3k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • F
    Frida Jo
    last edited by Dec 11, 2015, 10:26 PM

    Hello :D

    I'm doing one practice with VLANs and Windows Server Domain, I have a problem when i want to join the users of the vlan with the domain.

    pfSense: LAN 10.10.10.8
                  WAN 192.168.1.254

    Windows Server: 10.10.10.1

    The LAN is in trunk port, the WAN in the modem, the Server in the native vlan port (VLAN 1), I have 3 VLANs:

    -VLAN 10: 10.10.96.1
    -VLAN 20: 10.10.16.1
    -VLAN 30: 10.10.48.1

    Users in vlan 1 can to join to domain, but if i have to try to join one user since vlan 20  i can´t.

    I tried to pass the Windows Server in the VLAN 20 and configure the rules in the firewall for have comunication between the VLANs, i have the ping between the Server with the VLAN but I CAN´T join to the domain.

    I don´t know what is the problem! Please HELP!!

    1 Reply Last reply Reply Quote 0
    • H
      heper
      last edited by Dec 11, 2015, 10:43 PM

      if you can ping either way, then its more then likely a dns issue.

      easiest fix: adjust the dhcp-servers on your vlan-interfaces to set your domain-controller as dns server.

      1 Reply Last reply Reply Quote 0
      • F
        Frida Jo
        last edited by Dec 12, 2015, 3:05 AM

        okay, it means  that i have to establish the domain's dns in the dhcp server in pfsense for every vlan, right?

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by Dec 12, 2015, 10:02 AM

          Yes any device that wants to join a domain is going to need ability to resolve that domain..  Yes you should point to your AD dns for all your vlans dhcp clients.

          What is your rules on your vlans for the firewall, if your any any then yeah not a firewall issue.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 0
          • F
            Frida Jo
            last edited by Dec 14, 2015, 3:48 PM

            Thnks!

            Well I have this rules in the VLANs

            And this in the LAN

            1 Reply Last reply Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator
              last edited by Dec 14, 2015, 3:58 PM

              well that rule from vlan 20 to vlan 20 is completely pointless..

              What is your DC IP??  Is it that 10.10.10.8?  There are LOTS of ports required to join a domain…

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by Dec 14, 2015, 4:38 PM

                As said above, the ports there are not anywhere enough to get this working. Why are you shooting yourself in the foot with such restrictive rulesets?

                1 Reply Last reply Reply Quote 0
                • F
                  Frida Jo
                  last edited by Dec 14, 2015, 5:19 PM

                  johnpoz
                  the DC IP is 10.10.10.1, the rule that have 10.10.10.8  and 3128 port is because I use a squidguard (proxy)

                  1 Reply Last reply Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator
                    last edited by Dec 14, 2015, 5:32 PM

                    And again where are the rules that allow the clients that want to join your AD and talk to the DC on 10.10.10.1 ??  Keep in mind there are a shit load of ports required!

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    1 Reply Last reply Reply Quote 0
                    • F
                      Frida Jo
                      last edited by Dec 14, 2015, 8:19 PM

                      johnpoz, doktornotor…

                      I don't know what rules I have to use for join the users with AD
                      Can you help me in this part? the rules confuse me…

                      1 Reply Last reply Reply Quote 0
                      • J
                        johnpoz LAYER 8 Global Moderator
                        last edited by Dec 14, 2015, 8:33 PM

                        Like I said there is a shit load of ports… Look them up.. Google say ports required to join domain..

                        Off the top of the my head your going to need 135 tcp for rpc I would believe 389 for ldap, 636 for ldap over ssl, 88 for kerberos most likely, 445 most likely needed as well..  Not forgetting dns to be able query the AD dns, etc..  You might need to query the global catalog with I believe is 3268 and 3269... Been a long time since needed to look into requirements for a firewall between clients and the AD DC they are members of..  Not something you normally do..

                        What I would suggest until you figure it out is just allow any any to your DC.. from this vlan, and then log it if your wanting to try and lock it down at future time.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by Dec 14, 2015, 10:32 PM

                          Active Directory and Active Directory Domain Services Port Requirements - requires additional messing with registry for RPC as those ports are dynamic by default.

                          1 Reply Last reply Reply Quote 0
                          • D
                            Derelict LAYER 8 Netgate
                            last edited by Dec 14, 2015, 10:50 PM

                            Actually there's a pass any any at the top of the VLAN 20 rules to all the subsequent rules are pointless.

                            You might consider turning off DHCP on pfSense and using DHCP Relay to point at your DC too. Just let AD do DHCP and DNS.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator
                              last edited by Dec 15, 2015, 4:38 AM

                              You are correct derelict – how did miss that?? ;)

                              So is problem is most likely just can not resolve because he is not pointing to his AD dns.. Good catch..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              1 Reply Last reply Reply Quote 0
                              1 out of 14
                              • First post
                                1/14
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                This community forum collects and processes your personal information.
                                consent.not_received