Done, but unfortunatelly with no luck. Apparently shorewall/firewall is still blocking the join domain of the remote server on the vpn network while it remains pingable. I’d like to share some log to help debugging this.
Whats strange is that even though the ip of the primary nethserver and from it’s nsdc container are pingable, cockpit started to claim that one or multiple domain servers do not reply, as soon as I added them on the remote server as dns entries, . What makes me think that shorewall might be the problem is that issuing shorewall clear immediatly removes the blocker and I could join the domain even without those two ips as dns, but I doubt I should as I 'd like to first have a correct networkconfiguration. The message about dns servers not replying is persisting though, even with shorewall stopped and even though they successfully reply to pings, even with shorewall started and indeed dns name resolution stopped working with those two ips added…
Maybe a problem on my router/vpn configuration? By the way I wanted to create a site-to-site vpn tunnel on the green network interface (3rd network called nethlan in my opnsense config where pdc neth is dc and dhcp server). While I was able to ping everything from the pdc / company site direction to the hosted server / backup domain controler, the way back did not work, meaning I could not get a ping reply from anything on the internal network when pinging ressources from the hosted side.
That’s why I created a site-to-site vpn with the standard lan interface of opnsense which represents the red network for the backupdomain controller and with this vpn I can ping in both directions, so on OPNsense router there obviously is some difference on the network interfaces nethlan and lan and its corresponding rules or configuration, that prevents network connectivity from nethlan interface to the vpn, while it works from vpn to nethlan. And as said, this problem does not occur if I use the lan interface for tunneling instead.
It’s a pitty, as if I would succeed to solve the OPNsense interfaces problem, I could have a connection directly to the green interface, which probably would also solve the nethserver, as I imagine that it would trust a connection coming through the green interface instead of comming from red…
Or do you think, I should joing the domain anyway while shorewall is stopped and the fact of the being in the same domain would make my pdc controller and its firewall behave well with the remote nethserver? Out of couriosity and frustration I joined domain anyway and it was forseable that signal-event firewall-adjust has the effect, that I cannot open Users & Groups menu as it obviously blocks query…
Another thing, I might try tommorrow is to establish a direct vpn connection from nethserver to nethserver, and see where it gets…
Anyway, it makes me sad that everything I touch seems to attract Murphy, and everything that can go wrong always goes wrong. So I waste a hell of a lot of time, hopefully at least learning from it…
