@suicidegybe:
So what rules do you have to set to give vlans internet access, and how would you grant access from one vlan to another.
I don't mean to highjack this post but this is exactly what I'm trying to do too.
I have this right now: internet-pfsense-netgear gs724t-rest of network(data,voice,tv)
What I would like to do is separate data, voice, and tv out to their own vlans. I set three vlans on my pf sense box and generally understand how to configure the switch. But my issue is that I have two devices that need access to two separate vlans. My servers have the same need but only because the vm's need a different vlan so I will just tag the vm vlan and leave the host to be tagged by the switch, or is this not the way to do it? How would I access say the web gui for my PBX server if it is on a different vlan than say my work station? Is this configured through rules if so how? Same for all rdp type services. I would like to be able to manage all my devices from my work station but not be on all vlans?
Thanks
Determine what network addresses you want to use for each VLAN, create the necessary VLANs on your switch, apply them to the ports for devices you want on each VLAN, setup your trunk port on your switch, then create the VLAN interfaces in pfSense. Once you create the VLANs in pfSense you can go to the (assign) option under the Interfaces tab and create new interfaces for each VLAN. Then just assign an IP address on each new VLAN interface to your pfSense box, using an address from the network you want to use for that VLAN. At this point these new interfaces will be available under your Filters, so you can allow/deny traffic to/from each of your different VLANs from your LAN. It sounds like you want to allow your LAN to access your VLANs but not the other way around. In that case, just create block or reject rules on each new VLAN that prevent those networks from accessing your LAN.
To access the pfSense web interface from a device on that VLAN just open a browser or SSH session to the IP you assigned to pfSense on that VLAN. By default the filters will allow access to the web interface from each VLAN unless you disabled the anti-lockout option on the Advanced setup screen.
This page describes most of the setup quite nicely: http://doc.pfsense.org/index.php/Multi-WAN_using_VLANs_with_pfSense
Just note that site is for using Multi-WAN which isn't what you're after, so ignore the parts about assigning gateways for each VLAN as you're only creating LAN-type VLANs, not WAN-type (you only have a single WAN, so you only want a single gateway in pfSense). Good luck!
