Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    I can't join users of the VLAN on Windows Server domain

    Scheduled Pinned Locked Moved General pfSense Questions
    14 Posts 5 Posters 4.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      Frida Jo
      last edited by

      Hello :D

      I'm doing one practice with VLANs and Windows Server Domain, I have a problem when i want to join the users of the vlan with the domain.

      pfSense: LAN 10.10.10.8
                    WAN 192.168.1.254

      Windows Server: 10.10.10.1

      The LAN is in trunk port, the WAN in the modem, the Server in the native vlan port (VLAN 1), I have 3 VLANs:

      -VLAN 10: 10.10.96.1
      -VLAN 20: 10.10.16.1
      -VLAN 30: 10.10.48.1

      Users in vlan 1 can to join to domain, but if i have to try to join one user since vlan 20  i can´t.

      I tried to pass the Windows Server in the VLAN 20 and configure the rules in the firewall for have comunication between the VLANs, i have the ping between the Server with the VLAN but I CAN´T join to the domain.

      I don´t know what is the problem! Please HELP!!

      1 Reply Last reply Reply Quote 0
      • H
        heper
        last edited by

        if you can ping either way, then its more then likely a dns issue.

        easiest fix: adjust the dhcp-servers on your vlan-interfaces to set your domain-controller as dns server.

        1 Reply Last reply Reply Quote 0
        • F
          Frida Jo
          last edited by

          okay, it means  that i have to establish the domain's dns in the dhcp server in pfsense for every vlan, right?

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Yes any device that wants to join a domain is going to need ability to resolve that domain..  Yes you should point to your AD dns for all your vlans dhcp clients.

            What is your rules on your vlans for the firewall, if your any any then yeah not a firewall issue.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • F
              Frida Jo
              last edited by

              Thnks!

              Well I have this rules in the VLANs

              And this in the LAN

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                well that rule from vlan 20 to vlan 20 is completely pointless..

                What is your DC IP??  Is it that 10.10.10.8?  There are LOTS of ports required to join a domain…

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned
                  last edited by

                  As said above, the ports there are not anywhere enough to get this working. Why are you shooting yourself in the foot with such restrictive rulesets?

                  1 Reply Last reply Reply Quote 0
                  • F
                    Frida Jo
                    last edited by

                    johnpoz
                    the DC IP is 10.10.10.1, the rule that have 10.10.10.8  and 3128 port is because I use a squidguard (proxy)

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      And again where are the rules that allow the clients that want to join your AD and talk to the DC on 10.10.10.1 ??  Keep in mind there are a shit load of ports required!

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      • F
                        Frida Jo
                        last edited by

                        johnpoz, doktornotor…

                        I don't know what rules I have to use for join the users with AD
                        Can you help me in this part? the rules confuse me…

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          Like I said there is a shit load of ports… Look them up.. Google say ports required to join domain..

                          Off the top of the my head your going to need 135 tcp for rpc I would believe 389 for ldap, 636 for ldap over ssl, 88 for kerberos most likely, 445 most likely needed as well..  Not forgetting dns to be able query the AD dns, etc..  You might need to query the global catalog with I believe is 3268 and 3269... Been a long time since needed to look into requirements for a firewall between clients and the AD DC they are members of..  Not something you normally do..

                          What I would suggest until you figure it out is just allow any any to your DC.. from this vlan, and then log it if your wanting to try and lock it down at future time.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned
                            last edited by

                            Active Directory and Active Directory Domain Services Port Requirements - requires additional messing with registry for RPC as those ports are dynamic by default.

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Actually there's a pass any any at the top of the VLAN 20 rules to all the subsequent rules are pointless.

                              You might consider turning off DHCP on pfSense and using DHCP Relay to point at your DC too. Just let AD do DHCP and DNS.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                You are correct derelict – how did miss that?? ;)

                                So is problem is most likely just can not resolve because he is not pointing to his AD dns.. Good catch..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.