I can't join users of the VLAN on Windows Server domain

  • Hello :D

    I'm doing one practice with VLANs and Windows Server Domain, I have a problem when i want to join the users of the vlan with the domain.

    pfSense: LAN

    Windows Server:

    The LAN is in trunk port, the WAN in the modem, the Server in the native vlan port (VLAN 1), I have 3 VLANs:

    -VLAN 10:
    -VLAN 20:
    -VLAN 30:

    Users in vlan 1 can to join to domain, but if i have to try to join one user since vlan 20  i can´t.

    I tried to pass the Windows Server in the VLAN 20 and configure the rules in the firewall for have comunication between the VLANs, i have the ping between the Server with the VLAN but I CAN´T join to the domain.

    I don´t know what is the problem! Please HELP!!

  • if you can ping either way, then its more then likely a dns issue.

    easiest fix: adjust the dhcp-servers on your vlan-interfaces to set your domain-controller as dns server.

  • okay, it means  that i have to establish the domain's dns in the dhcp server in pfsense for every vlan, right?

  • LAYER 8 Global Moderator

    Yes any device that wants to join a domain is going to need ability to resolve that domain..  Yes you should point to your AD dns for all your vlans dhcp clients.

    What is your rules on your vlans for the firewall, if your any any then yeah not a firewall issue.

  • Thnks!

    Well I have this rules in the VLANs

    And this in the LAN

  • LAYER 8 Global Moderator

    well that rule from vlan 20 to vlan 20 is completely pointless..

    What is your DC IP??  Is it that  There are LOTS of ports required to join a domain…

  • Banned

    As said above, the ports there are not anywhere enough to get this working. Why are you shooting yourself in the foot with such restrictive rulesets?

  • johnpoz
    the DC IP is, the rule that have  and 3128 port is because I use a squidguard (proxy)

  • LAYER 8 Global Moderator

    And again where are the rules that allow the clients that want to join your AD and talk to the DC on ??  Keep in mind there are a shit load of ports required!

  • johnpoz, doktornotor…

    I don't know what rules I have to use for join the users with AD
    Can you help me in this part? the rules confuse me…

  • LAYER 8 Global Moderator

    Like I said there is a shit load of ports… Look them up.. Google say ports required to join domain..

    Off the top of the my head your going to need 135 tcp for rpc I would believe 389 for ldap, 636 for ldap over ssl, 88 for kerberos most likely, 445 most likely needed as well..  Not forgetting dns to be able query the AD dns, etc..  You might need to query the global catalog with I believe is 3268 and 3269... Been a long time since needed to look into requirements for a firewall between clients and the AD DC they are members of..  Not something you normally do..

    What I would suggest until you figure it out is just allow any any to your DC.. from this vlan, and then log it if your wanting to try and lock it down at future time.

  • Banned

    Active Directory and Active Directory Domain Services Port Requirements - requires additional messing with registry for RPC as those ports are dynamic by default.

  • LAYER 8 Netgate

    Actually there's a pass any any at the top of the VLAN 20 rules to all the subsequent rules are pointless.

    You might consider turning off DHCP on pfSense and using DHCP Relay to point at your DC too. Just let AD do DHCP and DNS.

  • LAYER 8 Global Moderator

    You are correct derelict – how did miss that?? ;)

    So is problem is most likely just can not resolve because he is not pointing to his AD dns.. Good catch..

Log in to reply