I can't join users of the VLAN on Windows Server domain

Frida Jo · Dec 11, 2015, 10:26 PM

Hello :D

I'm doing one practice with VLANs and Windows Server Domain, I have a problem when i want to join the users of the vlan with the domain.

pfSense: LAN 10.10.10.8
WAN 192.168.1.254

Windows Server: 10.10.10.1

The LAN is in trunk port, the WAN in the modem, the Server in the native vlan port (VLAN 1), I have 3 VLANs:

-VLAN 10: 10.10.96.1
-VLAN 20: 10.10.16.1
-VLAN 30: 10.10.48.1

Users in vlan 1 can to join to domain, but if i have to try to join one user since vlan 20 i can´t.

I tried to pass the Windows Server in the VLAN 20 and configure the rules in the firewall for have comunication between the VLANs, i have the ping between the Server with the VLAN but I CAN´T join to the domain.

I don´t know what is the problem! Please HELP!!

heper · Dec 11, 2015, 10:43 PM

if you can ping either way, then its more then likely a dns issue.

easiest fix: adjust the dhcp-servers on your vlan-interfaces to set your domain-controller as dns server.

Frida Jo · Dec 12, 2015, 3:05 AM

okay, it means that i have to establish the domain's dns in the dhcp server in pfsense for every vlan, right?

johnpoz · Dec 12, 2015, 10:02 AM

Yes any device that wants to join a domain is going to need ability to resolve that domain.. Yes you should point to your AD dns for all your vlans dhcp clients.

What is your rules on your vlans for the firewall, if your any any then yeah not a firewall issue.

Frida Jo · Dec 14, 2015, 3:48 PM

Thnks!

Well I have this rules in the VLANs

And this in the LAN

johnpoz · Dec 14, 2015, 3:58 PM

well that rule from vlan 20 to vlan 20 is completely pointless..

What is your DC IP?? Is it that 10.10.10.8? There are LOTS of ports required to join a domain…

doktornotor · Dec 14, 2015, 4:38 PM

As said above, the ports there are not anywhere enough to get this working. Why are you shooting yourself in the foot with such restrictive rulesets?

Frida Jo · Dec 14, 2015, 5:19 PM

johnpoz
the DC IP is 10.10.10.1, the rule that have 10.10.10.8 and 3128 port is because I use a squidguard (proxy)

johnpoz · Dec 14, 2015, 5:32 PM

And again where are the rules that allow the clients that want to join your AD and talk to the DC on 10.10.10.1 ?? Keep in mind there are a shit load of ports required!

Frida Jo · Dec 14, 2015, 8:19 PM

johnpoz, doktornotor…

I don't know what rules I have to use for join the users with AD
Can you help me in this part? the rules confuse me…

johnpoz · Dec 14, 2015, 8:33 PM

Like I said there is a shit load of ports… Look them up.. Google say ports required to join domain..

Off the top of the my head your going to need 135 tcp for rpc I would believe 389 for ldap, 636 for ldap over ssl, 88 for kerberos most likely, 445 most likely needed as well.. Not forgetting dns to be able query the AD dns, etc.. You might need to query the global catalog with I believe is 3268 and 3269... Been a long time since needed to look into requirements for a firewall between clients and the AD DC they are members of.. Not something you normally do..

What I would suggest until you figure it out is just allow any any to your DC.. from this vlan, and then log it if your wanting to try and lock it down at future time.

doktornotor · Dec 14, 2015, 10:32 PM

Active Directory and Active Directory Domain Services Port Requirements - requires additional messing with registry for RPC as those ports are dynamic by default.

Derelict · Dec 14, 2015, 10:50 PM

Actually there's a pass any any at the top of the VLAN 20 rules to all the subsequent rules are pointless.

You might consider turning off DHCP on pfSense and using DHCP Relay to point at your DC too. Just let AD do DHCP and DNS.

johnpoz · Dec 15, 2015, 4:38 AM

You are correct derelict – how did miss that?? ;)

So is problem is most likely just can not resolve because he is not pointing to his AD dns.. Good catch..