caffrey Posted June 17, 2015 Posted June 17, 2015 I'm playing with a pfsense box trying to set it up as a router like this ----pfsense-----smoothwall------internet I've got the routing working on the pfsense, and I've got the smoothwall working now I just need to route traffic from the pfsense box to the smoothwall box. I can ping the Smoothwall box no problem so the routing is working
newpersn Posted June 17, 2015 Posted June 17, 2015 Check you lan settings. Make sure you have a default gateway on both interfaces. I have a backup broadband line which i run like this DSL router > PfSense box > School network IT Vlan. (only staff on IT Vlan can access the backup line) only access if you type the ipaddress of the pfsense in the proxy area of IE, (running on pfsense though squid) 1
caffrey Posted June 17, 2015 Author Posted June 17, 2015 Thanks, There wasn't a gateway, what does it need to be ? The IP of the pfsense box ?
psydii Posted June 17, 2015 Posted June 17, 2015 What role is the smoothwall playing? What role is the pfsense playing? On what IP networks are each interface?
caffrey Posted June 17, 2015 Author Posted June 17, 2015 Sorted it now thanks, changed WAN to same range as the Smoothwall and added the Smoothwall IP as its gateway - seems to be working I'm basically setting up a pfsense as a layer 3 switch to route traffic between lans and vlans(wifi) to a smoothwall Eventually I'll have pfsense router----smoothwall------pfsense firewall------internet Would be easier with a layer 3 switch but I can only do what budgets allow
psydii Posted June 18, 2015 Posted June 18, 2015 Glad to hear it works. Surprised you can afford a Smoothie yet they won't pay for even a HP 1920 (HP 1920-8G Switch - HP Store UK), which would be fine internal router for a network with less that 8000 hosts. Still you can virtualise the pfsense, and do a lot more with it, so perhaps its no bad thing. Networks as software and all that 2015 jazz.
caffrey Posted June 18, 2015 Author Posted June 18, 2015 Smoothwall takes a fair chunk out of the budget! I saw that switch and saw it was a 2+ and didn't think it would route (until I just read the sentence buried in the overview), still with pfsense I get logging and a lot more I guess. We were looking at getting a 2920-24G last year and got turned down so I'm looking at cheaper (or free) alternatives
caffrey Posted June 18, 2015 Author Posted June 18, 2015 Hrrm actually I have one stumbling block, I can't access Active Directory from the smoothwall box (pinging the DC's fails) how do I reach the LAN/AD from the WAN ?
psydii Posted June 18, 2015 Posted June 18, 2015 You will need to set up some rules to allow the smoothwall to communicate on the AD ports back to your DCs Probably using the the WAN tab on the Firewall Rules page.
caffrey Posted June 19, 2015 Author Posted June 19, 2015 Any ideas on what the rule would look like ? Tried a few combinations to no avail
psydii Posted June 19, 2015 Posted June 19, 2015 Is the smoothwall using your DCs as its DNS server? Port requirements: https://technet.microsoft.com/en-us/library/dd772723(WS.10).aspx Any port that is only for REPLICATION is not required, and neither is dynamic UDP range for Group Policy. As a test set a rule on the WAN interface to allow all ports from the smoothwall internal ip to each of your DCs. Is the pfsense routing traffic to the smoothwall or is it NATing it? i'm not familiar enough with a smoothwall to know if it can have additional static routes as well as the default to the internet to ensure it knows how to talk to the DCs specifically. If NATing then you will need to set up some 1:1 NAT rules for the DCs, though I don't know whether Kerberos etc works through NAT (I suspect it is at best, difficult). 1
caffrey Posted June 19, 2015 Author Posted June 19, 2015 No it's not, I've tried that rule and a few others and nothing appears to work I can ping the gateway from the smoothwall box but nothing beyond. The pfsense seems to be routing fine, I can connect a device to a wifi VLAN and it's filtered fine by the Smoothwall box and goes out to the internet no NATing being done at all. I may go back to the drawing board and turn the firewall off on the pfsense and try routing instead, really frustrating as this is the last hurdle!
caffrey Posted June 19, 2015 Author Posted June 19, 2015 Turned off firewall, same issue I can ping the DC from the LAN interface (like it should) but not from the WAN interface and I can also ping the LAN gateway from smoothwall (eg 192.168.5.80) but not the DC (eg 192.168.5.2) - must be something stupid I'm missing...
caffrey Posted June 19, 2015 Author Posted June 19, 2015 I think I've fixed it, since I'm trying to do this in a none production setup I had to add the gateway on the DC... then I could ping it
caffrey Posted June 23, 2015 Author Posted June 23, 2015 Still struggling with this, it worked for about 2 minutes and now nothing, gone round in circles - how are other people connecting smoothwall to talk to their AD ?
caffrey Posted June 23, 2015 Author Posted June 23, 2015 Been a learning curve this one, but I've sorted it now - just needed an extra nic and a conditional DNS forwarder (this is new to update 90) and I get the green tick - no zone bridging needed
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now