Leopard being bad, or possibly me being bad.

[scorpioserve]

Well here is my situation, I have a mac that I am putting together for a client, and they have certain requirements as they all do, but I have reinstalled 3 times and still can not seem to get this kittycat to play nice, this is by no means the first server I have set up, in fact I have done about 50 of them and never really had too many problems; (That’s a Lie) but I have managed to get around problems before, this time I am stumped, so if you feel like reading one long winded write up, please continue.

Client requirements and fixed infrastructure on site.
Customer has 15 client macs (leopard), they want to have a central file server, AFP, an OD Master, with kerberos, a mail server to host multiple domains, and a web server also with multiple domains. Client macs need to connect to the internet through the server too.

I have an ADSL router connected to en0, and a wired/wireless broadband router connected to en1.
The ADSL Router has an internal IP Address of, 192.168.1.2/255.255.255.0 and gets a dynamic Public IP from my ISP, over PPPoE, DHCP is disabled. Only the server connects to this router.
The TP-Link Wired/Wireless broadband router has an IP Address of 192.168.2.1/255.255.255.0 there are 3 wired clients plugged into it, and the rest are wireless, and of course the second Network Interface of the server, DHCP is disabled.

I would like the client computers to connect to the 192.168.2 subnet and for it to connect to the server as a gateway and to use NAT to get to the 192.168.1 subnet to get internet, all through a firewall. Is this possible, I would assume so.

Ok from the top, I insert the os x server 10.5.0 disk and install, on a freshly formatted, HFS Extended partition, once done I reboot, and come to the
“server configuration” pages, choose “advanced”, “continue”.
Enter my serial number etc. “continue”,
Enter all the registration information, “continue”.
Enter all the other answers, “continue”.
Enter my Admin Account details, “continue”.
Network Address section,
I choose to manually enter my own details, for both network interfaces, “continue”.

en0: IP 192.168.1.100
Subnet: 255.255.255.0
Router: 192.168.1.2
DNS: 192.168.1.2

en1: IP 192.168.2.100
Subnet: 255.255.255.0
Router: 192.168.2.100
DNS: 192.168.1.100

“Continue”.
Then it asks about network names,
“Primary DNS Name: osxserver.example.com”,
“Computer Name: osxserver”,
Enable “Remote management” is “on”, “continue”.
Choose time zone, “continue”.
“Directory Usage” is set to “Standalone” server, “Continue”.
Click “Apply” and the system logs in.

First thing I do; at this point is ALL my software updates, and all the rebooting.

Okay so now I am fully updated to os x server 10.5.7 with all the other updates etc.
I start by opening “Server Admin”, connect server on 192.168.1.100,
go to services and select “AFP, DHCP, DNS, FIREWALL, MAIL, MYSQL, NAT, OPEN DIRECTORY, VPN, WEB”. click “save”.
The list propagates on the left under the server.
I click on “dns”, “zones”, “add zone” “primary”.
“Primary Zone Name: example.com.” Fully Qualified ON (NOT REALLY of course)
“Admin email: webmaster@example.com”
“Allow Zone Transfers:” OFF
“Nameservers: osxserver”
“Mail Exchangers: osxserver [10]”
arrow out the zone and click on the machine record.
“Machine Name: osxserver.example.com.” Fully Qualified ON
“IP Address: 192.168.1.100”
Go back, check it all again and then, and only then, click “save” and “start” dns.

Quit “Server Admin”, Go to “System Preferences”, “Network”, en0 and change my dns server to 192.168.1.100, “save” and reboot.
Login, go to terminal and run

sudo changeip -checkhostname

all comes back ok with 192.168.1.100 as osxserver.example.com (The names match there is nothing to change.)

Go back to “Server Admin” and remove the server 192.168.1.100, now reconnect on address “osxserver.example.com“.
Go to “Open Directory” and promote to ODM with default UID etc, but change “long name” and “short name” and enter a “password”.
It all comes up great. It auto completes the search base to “dc=osxserver,dc=example,dc=com” and the realm of “OSXSERVER.EXAMPLE.COM“.

Now I go change a few settings like under “policy” I select
“Password must differ from account name” and
“contain at least one letter“,

under “Binding” I select
“Enable authenticated directory binding” and
“Require authenticated binding between directory and clients“,

under “security” I select
“Disable clear text passwords“,
“Digitally sign all packets (requires Kerberos)“,
“Encrypt all packets (requires SSL or Kerberos)” and
“Block man-in-the-middle attacks (requires Kerberos)”
and that is it, now I “save” that.

So far so good I hope, next I go to “AFP” and set “Authentication” to “Kerberos” and leave everything else as is. “save” and “start” service.
“MySql”, select “Allow network connections” ON and
“Set MySQL Root Password”, done “save” and “start” service.

Now for the fun.
I go to “NAT” and click “Gateway Setup Assistant“, read the info and click “continue”, it warns me about my settings changing and I tell it to overwrite,
I select Ethernet as my WAN this is en0 connected to the adsl router, and click “continue”.
It now asks me to select the adapter for my LAN, I select en1, connected to the Broadband router and “continue”,
I enable the VPN and enter a “Shared Secret” and “continue”.
It tells me in the next window, that it will change my LAN IP to 192.168.1.1 that is no good for my setup, but I allow this and click “continue”, it is not like it gives any alternative you know.

It sets it all up and turns on the VPN, NAT, Firewall and DHCP services. all good (sort of).
Now I have to go and alter some of what it has done, first is to go to my “System Preferences” and click on “network“, what it has done is set the service order and put my en1 above my en0 so it will not resolve dns if I go and -checkhostname, so I set them back to en0 first, and second en1, then I go to en1, that was 192.168.2.100 and now is 192.168.1.1 and set it back to where it was, the subnet remains at 255.255.255.0 and the router changes from 192.168.2.100 to 192.168.1.1, so I set that back too, dns I set to 192.168.1.100. Quit System Preferences, go back to terminal and do a -checkhostname, cool all clear.
Now I go back to Server Admin and click on DHCP, it has auto set a subnet name of 192.168.1 so I change that to 192.168.2, the start ip I set to 192.168.2.220 and end at 192.168.2.240, it had auto set these at start of 192.168.1.1 and end 192.168.1.123, I can leave the subnet at 255.255.255.0, The network interface is correct as is, on en1, and I change the router from 192.168.1.1 to 192.168.2.100.
Under the sub-menu of dns still in DHCP I see it has set the dns server as 192.168.1.1, I change it to 192.168.1.100 and a search domain of example.com
Under the LDAP subdirectory, it has nothing set so I set this as;
Server Name OSXSERVER.EXAMPLE.COM and a
Search Base of dc=osxserver,dc=example,dc=com and I leave
LDAP over SSL off and the port blank to use the default.
Under the wins sub-directory I leave it as off or default. Click save to all, and it asks to reboot the dhcp service, ok

Now I go to VPN, Select Settings and it is all auto set Enable L2TP over IPsec is on and it has a start ip of 192.168.1.124 and end of 192.168.1.254, all i change is the start to 192.168.1.241, under client information I set the dns server as 192.168.1.100 and the search domain as example.com now click save.

On to Firewall, settings address groups, i see it set to
any – any
192.168-net – 192.168.0.0/16
192.168.1-net – 192.168.1.1/255.255.255.0 I change this to 192.168.2.1/24
10.0.0 – 10.0.0/16
VPN-net – 192.168.1.1:255.255.255.0

under services all of them are set to “Allow all traffic from “xxx.xxx.x…”” except for the “any” address group
This only has a couple of the ports on and they are set to “Allow only traffic from “any” to these ports:“, I have to alter this to get mail working later on as there are not enough on.

Now I save everything and reboot, after reboot I check one of the client systems to check if it can see internet, nope, so I change the network details to 192.168.2.50 subnet 255.255.255.0 router to 192.168.2.1 and the dns to 192.168.1.100 still nope, reboot the client system and try again still nothing on internet, I try to ping 192.168.1.50 yes that works, ping the router 192.168.2.1 yes that works, ping the servers en1 NIC 192.168.2.100 nope. So for now I have just left that alone for later, if anyone here knows why please let me know.

Next back at the server I go to setup mail, but first I do not have a static public ip address so I go to my custom dns account at dyndns and make sure that is all set and working, then I go to the web configuration of my adsl router and port forward ports 25, 53, 80, 110, 143, 995 on tcp and udp to en0 on the server 192.168.1.100.
Next I install a copy of DNSUpdate and add the user with my dyndns account datails, then add the host example.com to the external interface with a host type of custom, I do not know what the “enable wildcard” does so I leave it off as with the “back mx” button. and save. ok so now I have a public ip that is forwarding back to the server each time it changes, cool.

Back in “Server Admin” to set up mail service, under settings general
Domain Name: example.com
Host Name: osxserver.example.com
enable pop OFF
enable IMAP ON with 0 connections
Deliver to /var/mail when POP & IMAP are disabled OFF

enable SMTP ON
Allow incoming mail ON
All the rest OFF

Relay tab
Accept SMTP relays only from these hosts and networks:
127.0.0.0/8
192.168.1.0/24
192.168.2.0/24
All the rest OFF

Filters
Scan for junk ON with 3 hits
Junk mail should be DELIVERED and attach subject of ***POSSIBLE JUNK MAIL*** ON
Encapsulate as MIME attachment OFF
Scan for viruses ON
Infected messages should be BOUNCED and Notify Recipients ON
Update virus DB “2” times a day

Quotas Tab OFF
Mailing List Tab OFF
Logging Tab Debug for all

Advanced Tab / Security all OFF except for SMTP and IMAP – Kerberos and CRAM-MD5
Advanced Tab / Hosting I want to host multiple mail domains in the end, but for now I just want the main one working, so I set this to Local Host Aliases (localhost, example.com, osxserver.example.com)
Advanced Tab / Database I left this as default, on the 3rd try just in-case, but once I get it all working would like to set this up, figure I will need to use osx.topicdesk mailbfr for this.
Advanced Tab / Clustering, I WISH, but nothing set here.

OK Save and start service.

Go to Workgroup Manager login with the directory administrator account details, and set up only one account for testing purposes. This might seem strange but keep in mind that I would like to host multiple websites with a webmaster for each in general, so it looks a bit odd.
Name: “Webmaster example”
User ID: default from OS
Short Names: webmasterexample
webmaster@example.com
Passwords
User Can Administer this server OFF
User Can Access Account ON

Privileges tab is set to none, advanced tab I only turned off the “allow simultaneous login on managed computers” check box otherwise everything else is default, User Password Type is set to OD
Groups, Home, Print Quota, Info and Windows all set as default

Mail Tab, is set to enabled,
Mail Server: osxserver.example.com,
Mail Quota is 0 and
Mail Access is IMAP only,
not using alternate partition until i get over all these problems.

OK so in my opinion it should all now work, so I go to my mail application on the server machine and add an IMAP account with cram md5, and smtp with cram md5 with no ssl, and I make sure the username is set to webmaster@example.com and the incoming and outgoing mail servers are set to osxserver.example.com, go to connection doctor and I get a green light for both, cool.
So I send a mail to an account I have with my isp and the smtp log says no no no, my MTA has a poor reputation according to zen spamhaus, now this is probably due to my dynamic ip address, so I go to spamhaus and check the error with them, they say that all i have to do is make sure that authentication is on, and it already is using cram md 5, so I try kerberos, and the same thing happens, so i go back to cram md5 and set up an ssl certificate that is self signed, not that I really know what i am doing in that, but I do it, and set the mail client to use it and still nope.
So I login to my email address with my ISP through their webmail system and try to send myself a message to webmaster@example.com, and nothing comes in, the smtp log on my server says that I do not have a mailbox, so I send another one, this time to webmasterexample@example.com, as it is set with the first short name in WGM and it works, so that terrible, why is the other not working, how do I get more than one domain with more than one webmaster if the first short name needs to be webmaster. So I set a second account the same way as the first, but this time I set the account up and save first, then quit WGM and reboot send a mail to the silly incorrect short name, that I do not even want, and it works as expected, well not really it delivered the mail into the same account as the webmaster account, and they are 2 separate accounts within the mail application. Anyway I leave that problem for now and I go back to WGM and set the new short name with the @ symbol and . symbol with the correct domain like this user@example.com, try send a mail to that address and still it says, no such mailbox.

So I am stopping at this point, going to bed and hopefully when I awake there might be an answer, cause this is now day 4 at this. Thanks for reading. Sorry it was all so long. But I warned you in the beginning that I was long winded, and at least you do not have to guess what I have done. And my punctuation is terrible, sorry. english no me strong suit just only wan i know.

[guitar24t]

I believe you cannot access the internet because your dns server is not setup to forward non-authoritative lookups to other servers. Add these IPs under the forwarders list box on the dns setup tab

208.67.222.222
208.67.220.220

These are OpenDNS servers’ ips and work well for WAN.

If I had to bet, I would say the problem with your mail accounts was the firewall. I have had multiple problems with OSX firewall. I got so fed up, I turned it off and all my problems went away (literally). I had allow all traffic and all the ports I needed open and still nothing worked. I then setup a WAN firewall (in a router) and now turn off all the firewalls on all my servers (windows, linux or mac!).

Try turning off the firewall and check sending your mail again. Also, verify the dns settings on the client machines are provided correctly from the DHCP.

Sorry for not being able to do more; I don’t do much with mail, but the write-up was very descriptive 😀
Good Luck, Robert

[Author]

Posts