pgb's questions

We are in the process of migrating our office servers to AWS to finally decommission. Since we are familiar with pfSense, we are using a mix of AWS services but want to use pfSense as a the OpenVPC server.

Our VPC has two subnets:

• Public: 192.168.16.0/24
• Private: 192.168.17.0/24

I created an EC2 instance running in pfSense with two interfaces: WAN -> 192.168.16.10, LAN -> 192.168.17.10.

Worth noting: we are not using pfSense as the NAT gateway for the private network, so the LAN interface in pfSense has a gateway configured at 192.168.17.1 (why so? because we only want to use pfSense as the VPN server, not as the NAT gateway at this point).

Then, we configured OpenVPN to listen on the WAN interface and with a tunnel network of 192.168.140.0/23 and IPv4 local networks of 192.168.17.0/24.

I ensured I have an outbound NAT rule on the LAN interface with 192.168.140.0/23 as source, and NAT set as either hybrid or manual (tried both).

On the EC2 instance, I stopped source destination check.

What works:

• I can connect to OpenVPN
• I can use pfSense as a DNS (not relevant now, but I want to use it later on)
• From a console in pfSense, I can ssh another server in my private network (192.168.17.30).
• From said server (192.168.17.30), I can ssh to pfSense.

What doesn't work:

• I can't ssh to a server on the private network (192.168.17.30).
  • If I enable logs on my firewall rules, I can confirm that pfSense is letting the packets in.

What I tried already:

• Wide open firewall rules.
• Wide open AWS security groups.
• Adding 192.168.140.0/23 to the route tables in my VPC (although since it's NATing, I understand I should not need it).

For diagnostics, I enabled packet capture. Here's the output when SSHing from the pfSense box:

18:59:06.034748 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 0
18:59:06.034969 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 0
18:59:06.035013 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 0
18:59:06.035538 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 38
18:59:06.035705 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 0
18:59:06.060000 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 41
18:59:06.060098 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 0
18:59:06.060752 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 1432
18:59:06.060905 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 0
18:59:06.062725 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 1056
18:59:06.063141 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 0
18:59:06.065800 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 48
18:59:06.065956 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 0
18:59:06.070607 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 508
18:59:06.070772 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 0
18:59:06.074492 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 16
18:59:06.074616 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 0
18:59:06.074640 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 44
18:59:06.074802 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 0
18:59:06.074818 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 44
18:59:06.074868 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 0
18:59:06.074920 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 68
18:59:06.081411 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 44
18:59:06.081477 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 0
18:59:06.081628 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 0
18:59:06.082931 IP 192.168.17.30.22 > 192.168.17.10.59085: tcp 0
18:59:06.082959 IP 192.168.17.10.59085 > 192.168.17.30.22: tcp 0

and the same packet capture when SSHing from an OpenVPN client:

18:57:12.126970 IP 192.168.17.10.7955 > 192.168.17.30.22: tcp 0
18:57:13.131702 IP 192.168.17.10.7955 > 192.168.17.30.22: tcp 0
18:57:14.135982 IP 192.168.17.10.7955 > 192.168.17.30.22: tcp 0
18:57:15.145506 IP 192.168.17.10.7955 > 192.168.17.30.22: tcp 0
18:57:16.159995 IP 192.168.17.10.7955 > 192.168.17.30.22: tcp 0
18:57:17.152084 IP 192.168.17.10.7955 > 192.168.17.30.22: tcp 0
18:57:19.158465 IP 192.168.17.10.7955 > 192.168.17.30.22: tcp 0

as you can see, NAT appears to be working, since the outgoing packet goes from 192.168.17.10, but no response is received from the server.

I posted a similar question on Netgate forums, but I included most of the information here.

I'm managing remote laptops connected to our self-hosted domain (Samba 4, in case it's importante, but I don't think so).

Windows PCs have a IKEv2 VPN configured, so from the login screen they can login using the Network Sign-in button. This works great, until for some reason we reset the password.

If the password is reset, Network Sign-in will connect to the VPN with the new password, but Windows 10 will fail to log-in as it has the old password cached.

The workaround, so far, is to login with the old password, and then execute something using runas to cache the updated password.

Is there a way for Network Sign-In to update the cached password when it properly connects to the VPN?

I have three sites connected with two IPSec tunnels:

Site A - 192.168.10.0/24
        |
    IPSec tunnel
        |
Site B - 192.168.0.0/24
        |
    IPSec tunnel
        |
Site C - 10.0.0.0/8

This works great, and I can reach Site A and Site C from Site B. What I need is to reach Site C from Site A. Is that possible with my current setup?

Our office is set in two different floors. Both floors have managed switches, with a single ethernet wire connecting them. Here are some bullets of what I have on each floor:

1st floor

• Firewall
• Switch A (48 port)
• Server A
• ISP Modem 1
• ISP Modem 2
• ISP Modem 3

2nd floor

• Switch B (24 port)
• Server B

The firewall is acting as my DHCP server. The subnet I'm using is 192.168.0.0/24.

ISP Modem 3 is usually connected to Server A (in the same floor). I need to temporarily connect it to Server B, which is in the 2nd floor instead, and I can't easily route a secondary cable for this between the floors.

Can I use VLANs for this? I tried the following:

• I picked port 25 of Switch A and configured it with VLAN 9 (tagged).
• I picked port 21 of Switch B and configured it with VLAN 9 (tagged).
• On the upstream ports (Switch A port 49, and Switch B port 25) I added VLAN 9 tagged.

I did not change anything on the ISP Modem (I can't) nor on the Server B (I think I don't need to). I assumed this simple VLAN setup would act as a simple wire across the floors.

Am I correct with my assumptions? I'm asking, of course, because I don't seem to have connectivity between Server B and ISP Modem 3 as I expected.

I have all my network (wired and WiFi) in the same VLAN. I just bought a new Access Point, and am trying to set WiFi Clients to be in VLAN 2.

On the AP, I set it to assign VLAN 2 to the clients, and on my pfSense firewall, I configured a VLAN for WiFi on the same NIC where the LAN is. I also enabled DHCP for the WIFI VLAN, using a different subnet (192.168.2.0/24) than the existing LAN (192.168.0.0/24).

When I connect with a client to WiFi, my client doesn't get an IP address.

The AP is connected to a switch, which is connected to the LAN NIC of the pfSense. As far as I know, those are untagged for VLAN.

I tried restarting pfSense, as I read adding VLANs might require it, but the issue persisted.

My network has two switches. A Baseline Switch 2250-SFP Plus and a Baseline Switch 2226-SFP Plus.

pfSense is plugged to the 2250 in port 3, and port 49 is used to cascade to port 25 of the 2226. The UniFi is plugged to port 17 of the 2226.

I've created the VLAN 2 in both the 2250 and the 2226, and added ports 3 and 49 of the 2250 and 17 and 25 of the 2226 as VLAN 2 tagged.

The UniFi gets its IP address though DHCP, and is only getting an IP address of the wired subnet (which I believe is ok).

I can connect to WiFi just fine, but I can't get an IP address.

I'm moving my WiFi to WPA-Enterprise, using a Freeradius server that authenticates with our Samba 4 directory.

I'm currently using a self-signed certificate, but want to move to a purchased certificate instead. I understand the proper way would be to have my own CA and distribute its certificate through Group Policy, but to simplify things, I'll trade that risk for the simplicity of not having to add the CA's cert to each client.

My question is: will any SSL Certificate do? I'm looking, for example, at this one: https://www.namecheap.com/security/ssl-certificates/domain-validation.aspx (the PositiveSSL).

If so, is there any requirement on the domain name to enter?

I understand Windows XP is picky with the certificate, but we don't have any XP computers around on WiFi (nor I expect to have to support them)

I currently have a pfSense firewall that redirects port 80 and 443 to an internal Apache that acts as a reverse proxy for several subdomains on our company.

Since pfSense provides a reverse proxy through Squid3, I'd like to get rid of the Apache server and route everything with pfSense instead.

My current Apache configuration is something like this:

<VirtualHost *:80 *:443>
    RewriteEngine   on
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

    ServerName trac.mycompany.com
    SSLProxyEngine on

    SetEnv force-proxy-request-1.0 1
    SetEnv proxy-nokeepalive 1

    ProxyPreserveHost On
    ProxyPass / https://trac.mycompany.com/
    ProxyPassReverse / https://trac.mycompany.com/
    ProxyVia on
</VirtualHost>

<VirtualHost *:80 *:443>
    ServerName svn.mycompany.com
    ProxyPass / http://svn.mycompany.com/
    ProxyPassReverse / http://svn.mycompany.com/
    ProxyVia On
</VirtualHost>

As you can see, both are pretty straight forward. I know that using virtual hosts with HTTPS and a single external IP address limits me to use self signed certificates, and I'm aware of the risks, but at this moment don't care (I just want the usernames and password to be sent encrypted).

On pfSense, I configured it as follows:

The reverse proxy is on. Both trac and svn run on the same local server (192.168.0.26). The problem is that when the proxy hits the internal server, the local server Apache always tries to serve the trac subdomain, instead of matching by name.

Is this something I can accomplish with the Reverse Proxy module of pfSense? Am I missing something obvious here?

I have two pfSense 2.1 servers running with LANs of 192.168.0.0/24 and 192.168.10.0/24. The pfSense servers are 192.168.0.1 and 192.168.10.1

I just configured an OpenVPN site to site tunnel, that appears to be working fine. From each of the pfSense servers I can ping the other (from 192.168.0.1 I can ping 192.168.10.1 and the other way around) but from the computers on my LAN, I can't reach the other LAN.

What could be causing that?

I have a pfSense firewall and I need to connect to a remote site (form my client). I'm running into several issues, and don't see traffic flowing in any way.

Here's my setup:

• LAN is 192.168.0.0/16
• I have a WAN interface as the default gateway.
• I have a WAN2 interface, that I'd like to use for the tunnel to the remote site.
• The remote site is asking my to connect using local IPs of 172.27.10.0/24, as the won't be able to route my traffic otherwise. Their IP range (remote) is 10.100.0.0/16.

This is what I did already

• Set up the IPSec tunnel. This works, and I can connect.
• I created a Virtual IP (Firewall -> Virtual IPs) of type IP Alias, in the LAN interface with IP Addresses of 172.27.10.0/24.
• I added routes in System -> Routing, so 10.100.0.0/16 goes through WAN2. Same for 172.27.10.0/24, I added a route for that traffic to go through WAN2.
• On Firewall -> NAT, Outbount, I created a rule for WAN2, source 192.168.0.0/16, Destination 10.100.0.0/16 and Translation Address the IP Alias I created (172.27.10.0).

With all this setup, I can't connect to any remote address. Even more, I don't see the tunnel connecting, so I guess it's not getting the traffic it needs.

I'm also not seeing any useful information in the firewall log.

Am I doing things right? (or slightly close to right?).

I have two offices set in two distant locations, connected through a IPSec VPN (using pfSense). On one office, I have an Asterisk PBX where all the extensions connect, and the Asterisk PBX is configured with a Flowroute trunk.

Here's some ascii diagram:

--------------          ---------------             -------------
| office 1   |  IPSec   |  office 2   |    lan      | Asterisk  |
|  pfsense   | -------- |   pfsense   |-------------|           |
--------------          ---------------             -------------
      |                        |
      |                        |
internet link 1           internet link 2

When I make calls from office 2 through Flowroute, they work perfectly fine. However, when I make calls from office 1, there's some echo. I'm using IP phones, so the echo is not caused by analog terminals.

My guess is that the SIP traffic from office 1 is going through the VPN and then routed to Flowroute (through internet link 2).

How can I make it so the traffic is routed through internet link 1 instead? I only want to use SIP traffice over IPSec for internal calls (extensions on office 1 calling extensions on office 2, where some echo is acceptable).

I'm setting up a new Asterisk PBX, and I'm on the process of buying IP phones. I plan to add phones as needed, as we can't afford to buy them all at once. However, I do want to create a single extension for each person in the company, so we can start distributing them to clients.

My plan is to create multiple extensions, one for each person in the company, but have about half the phones. The phones support a single line. On Asterisk (using FreePBX), I would configure something like this:

Extensions
  2001 -> Phone connected
  2002 -> Phone connected
  2003
  2004

Routes
  2001 -> Rings extension 2001
  2002 -> Rings extension 2002
  2003 -> Rings extension 2001
  2004 -> Rings extension 2002

After we buy more phones, I will unfold the routes, so each number goes to its actual extension.

Will this work in practice? Does anyone have experiences doing something similar to this?

I have an old Samba 3 + LDAP server installed that needs to be rebuilt. I'm weighting my options, and Windows Server seems too expensive at the moment, and Samba 4 appeared to be a nice option, coupled with the last Bind 9 that can dynamically add the computers to the DNS.

I have about 30 workstations, so I still consider it a small network.

My questions are:

1. Is Samba 4 stable enough for production? It seems as if the Samba team is too cautious on when to call their version final, or even beta, as compared with other open source projects.
2. What Linux distribution would you recommend to set it up? I usually use Ubuntu Server, but may use another one if installing / maintaining Samba 4 is better on that one.

I currently have a Windows 2003 server installed with SQL Server 2000 and 2005 on it.

We have the disk partitioned in two:

• C: contains the operating system and applications
• E: contains the DB files

I need to reinstall the server due to license changes, and reinstall the databases as well. Is it possible to do this:

1. Reinstall Windows on C:
2. Reinstall SQL Server 2000 and 2005 (ok, maybe only 2005)
3. Reattach all the DBs and have the server work as if nothing had happened to it.

When we started our software development company, we decided to use Samba as a PDC for the few Windows workstations we had. We use Samba with OpenLDAP, and it has been a good replacement for AD for almost 6 years now (using Windows XP workstations).

Now I'm facing a few problems with our setup:

• The Linux server where the PDC runs is very outdated (and is a Gentoo install, don't ask why!)
• We started using Windows 7 on some of the workstations, and these can't join the Samba domain (there's a workaround, I know)

Our company has grown a bit, and we have now about 20 workstations (and plan to have more in the near future).

I have to reinstall our PDC, and was thinking on updating to another Linux distro and the latest Samba 3.4. However, I started having second thoughts, and now I think going to a Windows Server for the PDC is the way to go. The main drivers to opt for a Windows Server would be its easy administration and the ability to use Windows 7 out of the box, without any registry hacks.

My question(s) then is(are):

• How should I do this migration?
• Can I keep the same domain name?
• What will happen to the users? Will they be recreated and won't be identified by the workstations as being the same user, even if the actual username is the same?

What steps would you recommend me to migrate from Samba to Windows Server?

Bonus question: If you think staying in Samba is the way to go with my current setup, I'm also interested on your thoughts.

I'm setting up an Ubuntu 10.04 server to run KVM. I need the virtual machines to have bridged networking, since they will be part of my main LAN. In addition, eth0 (the main network interface on the server) is using DHCP to get a static IP from the DHCP server (that way, I have a central point to change the IPs of my servers).

When trying to add a br0 interface (as described here http://wiki.libvirt.org/page/Networking#Bridged_networking_.28aka_.22shared_physical_device.22.29) I changed my /etc/network/interfaces as follows:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet dhcp

# The bridge network interface, used by kvm
auto br0
iface br0 inet manual
bridge_ports eth0
bridge_stp yes
bridge_fd 0
bridge_maxwait 0

I also added the following lines to sysctl.conf:

net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

As soon as I reboot the server, I loose connectivity to eth0 (outgoing and ingoing).

What's wrong with this configuration? What's the recommended setup?

What tool can I use to generate a Windows wallpaper at logon that contains user info? I've seen it in several places, like in the screenshot.

I found whoami, but it looks different and with less information than the screenshot I uploaded. (maybe the screenshot is a heavily configured version of it)

I've seen the same information in several Windows installs, but couldn't find the tool to do it.

Any pointer?

My network architecture is very simple:

firewall - 192.168.0.1 running IPCop

vmware - 192.168.0.10 running Ubuntu Server

Both computers are connected to a switch, as well as several workstations in the company (about 20 computers total) and a wireless access point.

At some point (which I haven't been able to determine yet), our Internet connection stops working. If I log into the firewall via SSH it's dead slow (you can barely type on the terminal). To my surprise, as soon as I unplug the VMWare Server from the network, the network goes back to normal.

We tried swapping the firewall for another computer and the problem remained. Any hint on how to track it down? I couldn't find anything relevant on the server logs.

Update with more information:

• The VMWare box has 1 physical NIC and is running about 3 to 5 computers with bridged mode.
• When the connection fails, running top on the firewall does not report huge CPU activity.
• The firewall does not show any information on the logs when this problem happens.
• I can't ping outside from the firewall when this failure manifests.