Let me preface this by saying I am completely unfamiliar with VLAN tagging. I understand the basic concept, but I lack any sort of real-world experience.

I am looking into installing FreeIPA for a homelab. I have a simple Active Directory setup with all hosts on same subnet.

Reading about FreeIPA, from what I understand it is best to have a separate domain name on a separate subnet, and create a trust relationship between AD and FreeIPA.

If I do this, how can the computers talk to one another? Aren't they isolated on separate subnets? Wouldn't this inhibit any sort of file sharing (e.g. samba, NFS, etc.)?

Has anyone who is using FreeIPA help me be less confused?

If possible, would love explanation to include (VLAN?) requirements for router (pfSense) and switches

Edit: Question in response to the first comment, then pfSense can configure the VLAN routing (e.g. "router on a stick") and allow routing as if on same subnet between separate subnets?

Then does switch have to be configured to allow VLAN tags (e.g. 10 for VLAN10 and 3 for VLAN20

  • I use FreeIPA in production, I would agree with separate domain, but separate subnet even though desirable is not necessary from technical point of view. Computers on one network in general talk to computers on another networks with help of routing(layer 3). If switch you have to which hosts are connected is layer3 then you can setup your static or dynamic routing there. – Danila Ladner Mar 22 '18 at 19:56
  • In order for your two subnets to communicate they need a router (the subnet's gateway). You only need VLANs if hosts within each subnet need to be located on different switches, in which case they're required in order for the broadcast domain to be routed. If hosts are located in the FreeIPA subnet need to access Samba resources in the AD subnet, they would not be able to see the share automatically without some kind of mDNS setup rebroadcasting the service. Unless there is a technical reason to separate them, then for simplicity using one subnet will save headaches. – brent Mar 22 '18 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.