Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[craudiao]

Hi...

sorry the bad English / translated by google translator

I have the D-Link DFL-210.
I have to configure it to authenticate in the ldap in a Win AD ...
but following the manual this setting:

   Action    Src Interface Src Network    Dest Interface   Dest Network                       Service
1 Allow      lan               lannet            core                lan_ip                                  http-all
2 NAT       lan               trusted_users  wan                 all-nets                               http-all
3 NAT       lan               lannet            wan                 all-nets                               dns-all
4 SAT       lan               lannet            wan                 all-nets/all-to-one/127.0.0.1   http-all
5 Allow      lan               lannet            wan                all-nets                                http-all

happens that the browser opens the login and authenticate to AD correctly.
but only after connecting it simply can not surf on any site.
all it does is display the same sentence that I'm connected, regardless of the address I put ...

Can someone help me in this problem?

[scrubsguy]

please give your IP rules + Interface settings

[craudiao]

IP rules:

1     allow_httpauth    Allow         lan     lannet     core     lan_ip     http-all
2     allow_standard    NAT          lan     lan-auth     wan     all-nets     http-all
3     allow_dns           NAT          lan     lannet     wan     all-nets     dns-all
4     allow_httpauth    SAT          lan     lannet     wan     all-nets     http-all
5     allow_httpauth    Allow         lan     lannet     wan     all-nets     http-all

Interfaces settings:

 dmz     dmz_ip        dmznet                      No      (interface not usage)
 lan     lan_ip         lannet        wan_ip     No    
 wan     wan_ip       wannet       wan_gw     Yes    


Interface addresses

 dmz_ip    172.17.100.254                            IPAddress of interface dmz            (Interface not usage)
 dmznet    172.17.100.0/24                            The network on interface dmz        (interface not usage)
 gw-word    192.168.1.15         
 lan-auth    192.168.101.0/24    dcserver    
 lan_ip    192.168.101.1                           IPAddress of interface lan
 lannet    192.168.101.0/24                      The network on interface lan

wan interface is DHCP client and wan_gw = gw-word


the message that appears after the authentication is this:

Logged on
You, or possibly someone else from your IP address,
have been granted access.

Click here to log out.

And after that does not access any site, only appears this message.

[danilovav]

Change order of IP rules
3 allow_dns NAT lan/lannet wan/all-nets dns-all # pass DNS traffic without authorization
2 allow_standard NAT lan/lan-auth wan/all-nets http-all # this is authorized rule
1 allow_httpauth Allow lan/lannet core/lan_ip http-all # allow displaying of auth form
4 allow_httpauth SAT lan/lannet wan/all-nets http-all # replace unauthorized outgoing traffic by auth form - 1st
5 allow_httpauth Allow lan/lannet wan/all-nets http-all # replace unauthorized outgoing traffic by auth form - 2nd

[craudiao]

Thanks for replay danilovav

but the problem remains the same.
Once authenticated, all attempts to access site that give the same answer.

Logged on
You, or possibly someone else from your IP address,
have been granted access.

Click here to log out.

[danilovav]

Seems, rule allow_standard_NAT does not working. Check is lan-auth's settings correct - group should be the same with user auth settings
Do you have other IP rules? Can you show all of them?

[craudiao]

danilovav

I no have other IP rules.

is the first time I'm configuring it, and all I need is that this authentication works. do not use it for anything else.

as authentication,

authentication is working properly.
when I try to navigate the first time, it prompts a login and password.
if I type it the wrong login error, I enter it correctly it's ok.

but once authenticated, continues to translate all the ip http address of the router and tell me I'm logged in, go out instead of going to the right address.

sorry the bad English, I only speak Portuguese.

[danilovav]

Plz show IP rules, HTTP auth as screens

[craudiao]

danilovav, my screens of configuration:

[danilovav]

The reason of your problem is you got authenticated via LDAP, but DFL group (dcserver) havent assigned to user, as result lan_auth (2nd) rule doesnt working
Do you have group named "dcserver" on your AD? Does this user have it?
To check, try to change authorization to local, it should become to work

[craudiao]

yes, local authentication, it worked.
but even putting the User in a group of same name as the authentication rule, does not work with ldap.

You know what might be happening?

[danilovav]

To get 2nd (authorized) rule working, user should have group assigned
Seems, it's missed in LDAP configuration

>but even putting the User in a group of same name as the authentication rule, does not work with ldap.
Group name - dcserver?

[craudiao]

danilovav, Thank you very much

I had to reconfigure the ldap server configuration in "name attribute" of "uid" to "samaccountname".

Thanks...