[Samba] getent not working after installing firewall

Mark Foley mfoley at ohprs.org
Mon Mar 4 20:47:23 UTC 2019

On Mon, 4 Mar 2019 21:28:19 +0100 Reindl Harald <h.reindl at thelounge.net> wrote:
> Am 04.03.19 um 21:18 schrieb Mark Foley via samba:
> >> It shouldn't, you normally only have one gateway, it is by definition
> >> the 'gateway' to the WAN & internet, so I would use the same one on all
> >> your machines.
> > 
> > The LAN host gateways are assiged by the dhcpd server.  Unless I hard-code static IP's I can't
> > really change that.  The Windows computers likewise show the AD/DC ( as the gateway
> > and they all work fine. 
> how does that matter?

No sure what you mean by "how does that matter?"

> your gateway is only part of the game when you try to reach an IP
> outside your LAN
> you said "Last evening I installed a Sonicwall firewall between the
> Internet and office LAN. The only change that I know of for the LAN
> workstations was that the gateway is now instead of
>" but above you said "The Windows computers likewise show the
> AD/DC ( as the gateway"
> so hell, what is the IP of your "Sonicwall firewall between the Internet
> and office LAN" and if it's that don't match "The Windows
> computers likewise show the AD/DC ( as the gateway"

Well, I figured someone might catch that, but I didn't want to muddy things further by posting
a follow-up. But, since you've noticed ... To clarify:

Without the Sonicwall, host (DC) had the ISP's gateway configured. 
All the LAN workstations had (DC) set as the gateway (route command output).  The
dhcpcd client sets the IP, mask, nameserver and gatway so *it* set the DC as the gateway, not
me directly.  Regardless, this had worked for years.

When I configured the Sonicwall (IP, it got configured with the ISP gateway.  I
configured the DC ( gateway with the Sonicwall's IP: 

Since the DC is still the DHCP server, it is still passing to clients' dhcpcd as
the gateway:

On a domain member:

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         mail.hprs.local         UG    202    0        0 eth0
loopback        *            U     0      0        0 lo     *        U     202    0        0 eth0
1 15:45:31 root at labrat:~

# host mail.hprs.local
mail.hprs.local has address

> the AD/DC *is not your gateway* - it's the "Sonicwall firewall"
> connecting your LAN to the internet and nothing else

Now, I could configure the Linux domain members to hard-code (Sonicwall) as the
gateway, and I'll try that as an experiment, but I'll repeat, none of the client workstation/
domain-members on the LAN are having any problem resolving names or getting outside the LAN. 
So, I don't think the gateway is the problem. 

If you see the message I sent later, I'm only having a problem with getent, and only for domain
members who had not previously logged onto a given Linux workstation. I don't think the gateway
is the issue with that.


More information about the samba mailing list