• 10G copper connection drop on XG-71001U with Intel X540-T2 adapter

    3
    0 Votes
    3 Posts
    280 Views
    H
    Some extra info: I am running 2.4.5-RELEASE-p1 (amd64) If I move the vlan interfaces away from the 10G copper (ix0) onto the built-in 1G lagg0 (the internal switch), then connectivity is stable I followed advises here https://docs.netgate.com/pfsense/en/latest/hardware/tune.html#intel-ix-4-cards so my /boot/loader.conf.local currently looks like: hw.intr_storm_threshold=10000 hw.ix.flow_control=0 The below is advised in the doc but was already in /boot/loader.conf: kern.ipc.nmbclusters="1000000" kern.ipc.nmbjumbop="524288" TSO/LRO and hardware checksum are all disabled from the GUI. On latency: even though my WAN connection (pppoe) is on another NIC (ix5), it has increased latency beyond the avg for this link (rtt around 40ms, rttsd about 80ms). The latency goes away if I stop using the 10G port and move my server on a 1G port of the built-in switch of the XG-7100 (connected via LAGG0). When the physical interface ix0 is going down, other physical interfaces are still online and the pfsense box is still reachable via other logical interface (ie via some vlan interface over the lagg0 built-in switch).
  • DNS Resolution/Routing Issue on VLAN

    11
    0 Votes
    11 Posts
    577 Views
    W
    @johnpoz said in DNS Resolution/Routing Issue on VLAN: Oh good catch ;) Yeah client will say that is BAD.. Are you doing some sort of source nat? I suspected the reply from the resolver's other IP was problematic and thought I had indicated that in my original post. My apologies for wasting cycles having been unclear on that. Additionally, I am not doing any source or outbound NAT anywhere. @viragomann said in DNS Resolution/Routing Issue on VLAN: So the client is requesting the LAN IP, but pfSense is sending responses from the VLAN IP. Hence the client won't accept the response and the DNS request is failing. That's not the default behavior, even in a setup like yours. But I have no idea, what could be the reason for this. Possibly you have something miss-configurated with the VLAN or do a kind of outbound NAT? However, as I suggested above, simply use the VLAN IP as DNS on the clients and your headache will be gone. The VLAN is pretty simply configured on pfSense and both downstream switches. I've pored over each config for hours now. I can't find anything in them that leads me back to this issue. Why is pfSense/unbound coming back to that network through the other interface? Ugh. I suppose I'll acquiesce to changing the DNS configs on that VLAN to query unbound on the VLAN200 interface rather than LAN. That won't bode well for my curiosity, but sometimes you have to admit defeat.
  • HP printer across VLANs

    5
    0 Votes
    5 Posts
    1k Views
    F
    It started working even though I haven't changed anything in my config.
  • VLANs with bridged interfaces

    7
    0 Votes
    7 Posts
    1k Views
    imark77I
    @imark77 going by the hardware in the handle. I'm assuming the SuperMicro has for dedicated ports. If that's the case you'll need to create your desired VLANs on each hardware Port ID and then bridge those VLANs acrossed back together. And then a firewall rule to allow them to intercommunicate. ( Theoretically switching to rules on bridge would make the rules easier but I don't recommend that until I can confirm that it works on my end.... As that seems to be the problem I'm having ).
  • Making Best Use of Physical NICs & VLANs

    10
    0 Votes
    10 Posts
    1k Views
    JKnottJ
    @bingo600 said in Making Best Use of Physical NICs & VLANs: You should only have ONE dhcp server (per vlan) active at any time. Else you risk getting overlapping leases. Actually, multiple DHCP servers are permitted. While you can configure them with non-overlapping pools, Duplicate Address Detection is supposed to be used to avoid problems.
  • d'link AP with pfSense VLAN

    13
    0 Votes
    13 Posts
    1k Views
    GertjanG
    Or even no switch at all. Like daisy chain the AP's with their internal multipleLAN ports. Which, ok, are actually switches. Be definition, a switch that does not have an IP for itself, no GUI or console access, is a 'dumb' switch, like a smart hub. You can not interact with it. It will operate on MAC level at max, not IP. Btw : I don't get it. It took you a minute to create a (example) VLAN ID 100 on pfSense. It takes a minute to set up a device (= AP, or whatever) with a static IP setup for this VLAN100 (which means the IP should be in the VLAN100 network, the gateway should point to the VLAN100 pfSense IP - same thing for its DNS). Set up also the VLAN ID for your 'LAN' on the AP - if the AP supports VLAN. Hook up the AP, and analyse the traffic with firewall rules that log, or the packet sniffer or whatever, to assure yourself that LAN and VLAN traffic is separated. Or .... apply the keep-it-simple rule : take a 5 $ third NIC, create your physical separated wired LAN, hook up your switch and on the switch the 5 AP's and you can pas on to other things ;)
  • Setup for Routing - VLANS

    12
    0 Votes
    12 Posts
    970 Views
    johnpozJ
    No again you don't have to set routes for anything connected to pfsense directly. If you want to send a client out a vpn connection (vpn setup on pfsense to point to some service) Then you would just policy route that via a firewall rule. Just making sure that you put any rules above that to allow local access (if you want).. If you want to send clients trying to talk to 1.2.3.4 (publicIP) then sure you could create a route on pfsense for that dest network to use vpn connection. But that would really send any and all clients from behind pfsense out that vpn. Better option is to just policy route what you want to use the vpn. Be it via either their IP/Net, dest IP/net or dest port, etc. https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html Setting up a vpn client on pfsense creates a multiwan setup.. Since you have either your normal wan as gateway, or this vpn connection as a gateway.
  • Assigning network to port

    4
    0 Votes
    4 Posts
    443 Views
    kiokomanK
    indeed, it's an internal switch after all, you must use vlans
  • Don't get VLAN (DHCP) ip address on my Virtual Machine Guest

    vlan to lan
    6
    0 Votes
    6 Posts
    1k Views
    kiokomanK
    emp0s3 is using vlanid30 but i'm not so sure about igb0.30 sorry it's only what is coming on my mind could be stupid, as I'm not in front of your stuff and i don't own a microtick i can't tell you exactly where to look but if i was me i will trace back until i see where the vlan30 stop working, tcpdump also can help
  • VLAN traffic not filter through pfblocker

    2
    0 Votes
    2 Posts
    389 Views
    S
    @rjamesm Do you have the VLANs selected in pfBlocker? By default it only selects the LAN. If you also want it to do the VLANs you'll need to add it under the IP tab.
  • VLAN Priority Guidance

    1
    0 Votes
    1 Posts
    174 Views
    No one has replied
  • OPT as LAN Interface

    6
    0 Votes
    6 Posts
    1k Views
    R
    @johnpoz thanks. I added any any for opt1.
  • VLAN Routing with UniFi APs

    netgear unifi vlan
    12
    0 Votes
    12 Posts
    2k Views
    bingo600B
    @johnpoz Luckily i'm in a controlled environment where only PC's and Desktop Phones approved by (me) are allowed to have access via WiFi. No phones or personal devices are allowed on that segment. /Bingo
  • VLANs with pfSense and Unifi gear

    1
    0 Votes
    1 Posts
    188 Views
    No one has replied
  • random broadcast storms

    5
    0 Votes
    5 Posts
    794 Views
    A
    @pfsenseuser2020 Looks like ports 137 and 138 are Netbios and/or Windows File Sharing CIFS ports. Do you maybe have a NAS or file server that's misbehaving, or infected? https://library.netapp.com/ecmdocs/ECMP1155586/html/GUID-4645E16A-6CB1-4A71-8420-05749894E857.html https://forum.netgate.com/topic/83433/log-flooded-with-port-137-138-udp But, I agree with @kiokoman, if possible, turn it off at the host's network card. Jeff
  • VLAN -> VLAN Routing Misbehaving

    6
    1 Votes
    6 Posts
    707 Views
    D
    @marvosa Yeah, it's a typo 192.168.x.0, the "x" is the VLAN #. For some reason I can't reliably edit my post, nor can I post comments it keeps telling me "Post content was flagged as spam by Akismet.com"... This forum really needs to address that... I have solved this problem. I had a floating rule that blocked private ranges, which of course was blocking subnet -> subnet routing.
  • Switch configuration

    3
    0 Votes
    3 Posts
    446 Views
    Z
    I would like to install xcp-ng as hypervisor and also have redundancy in case one of the nodes or one of the switches fails. I haven't done this before. css326 should serve mainly for making the connections with the patch panel and as failover if the crs326 switch would fail. Is the following plausible to setup or what would you recommended ? [image: 1602082162135-3.png]
  • Can you filter multicast with a bridge?

    3
    0 Votes
    3 Posts
    296 Views
    senseivitaS
    Well, no exactly, I already got noisy stuff under one subnet. I'm just curious if it can be achieved by merely using a transparent firewall technique while keeping the rest of the L2s separated. This is the first time I've thought about pfSense filtering below L3 I believe. The switches I have, come with lots of stuff for multicast, fancy is actually a fitting word for it's a lot, from multicast filtering to routing to something in the middle (MVR) Plenty more features than for the other L2/L3 areas. But playing with these can easily lead to trouble, nothing too serious yet not far off--I traced a painfully slow network to the Avahi plugin when 2.4.5p1 was first released. It's been switched off since then. There is one multicast feature that I though seemed like a good compromise, in Ubiquiti-branded stuff it's called MVR, everywhere else is just Multicast VLAN, in Cisco it's probably named by its RFC # and then their licensed next to it. MVR is supposed to drop all multicast traffic regardless of source VLAN into a dedicated VLAN so traffic traffic won't bother other operations, setting up the ports' mode for it is contradictory in all documentation even it's got not router/source/whatever port designations. I tried so hard to make it work but I kept missing the almost-never-mentioned point: it only goes one-way, same as all other multicast protocols, they're designed to work in this waterfall-like fashion, as if source always were an IPTV operator for instances; remote from the Internet, doesn't care what you have to say. It's never a mesh or at least one-ways-for-all situation. The naming doesn't make it easier either, I know VLANs inside and out now, but when I go through these docs that aren't even for VLANs it makes me question how much do I really know about VLANs, ADHD kicks in and I've lost all day when I eventually l land in the document that triggered the spiral. Not that useful for something like a remote app, or Spotify Connect/AirPlay, all relying heavily on multicast, treated like broadcast but even less smart. Some just assume your wireless network is the same as the wired one or the most infuriating are those incompatible Enterprise WPAs that expects the other device setting it up to connect to the same SSID otherwise it won't take it. It drives me insane this Harmony Hub I use for domo losses connectivity I have to go get a step ladder to pair it over Bluetooth, to then failing its "tests" to give you an IP input field only at the very end while you wait balancing on the ladder. 🤬 Got sidetracked there, sorry. Avahi and mDNS Repeater seem to be the only tools available for this but they're not really protocols, are they? They're included everywhere, well, Avahi is, but it's banned from switches it seems. They only router appliance I've seen that dealt with this type is in the Ubiquiti USG line, Ubiquiti as a brand sort of constantly readjusts its priorities (or has no direction), so it doesn't really count. So I'm exploring option to see what could be done if I didn't have or didn't know how to setup a RADIUS server (and pfSense didn't have one right in there). There's a lot more happening at L2 beyond ethenet so I'm curious. I'd love to get my hands on one of those old ATM cards though I woulnd't know what to do with it 5 seconds later. I think my ISP is still using ATM despite delivering fiber I have this hunch. All of their naming still hints to ATM stuff. :) I don't think you know how much I appreciate those little bits about Plex and preemptive filtering 'cause it's the first kind of thing that pops in my mind when I run into trouble. Thanks for the help!
  • Periodic connection drops for specific client

    13
    0 Votes
    13 Posts
    2k Views
    A
    I'm seeing the same behavior on my network for both wired and wireless clients. https://forum.netgate.com/topic/157090/periodic-drops/4 Thank you for this post, it let me isolate the cause of the network disruption. I'm still not sure what the root cause is, but at least I have a starting point.
  • Troubleshooting VLAN Connection

    2
    0 Votes
    2 Posts
    340 Views
    TheMetManT
    SOLVED it myself in the end!!! For anyone else out there with the same problem....... It was Enable 802.1q VLAN mode in the Switch Settings on the SG-3100. Interfaces->Switch->VLANS I unchecked this so it was using Port Mode, left it at the default, and I can now connect.
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.