@nohairitguy Another interim suggestion I would make is to ditch the port specific list and just allow all ports through to the printer's address. There is little value in trying to restrict individual ports to a printer, but if you want to do that I'd get it working without a port list first and add the port list after.

@aaronouthier Technically you could use VALN1 in this situation. Not optimal but if you don't have much other gear, I think it is ok. I still would use a hard-coded IP-address on the OpenWRT. All in all your problems are not with pfSense but with OpenWRT. Edit: This is FreshTomato, not OpenWRT. But VLAN1 is still the LAN from this Device. pfSense is a Client on VLAN1. The other VLANs are passed through from pfSense though, this is what you wanted. [image: 1790097931569-screenshot-2026-09-22-at-19-19-58-freshtomato-advanced-vlan.png]

@SteveITS migration was successful after I download a copy of 2.9 installer. Initially I was using an existing older version of the installer on usb stick. It was failing to install. Restoring from backup got the router 80% to original settings. For some reasons, static mapping and a few firewall rules did not carry over.

i see the problem now thanx for the replay .

@rtadams89 if me I would just trash those shit switches.. But yeah going to have a problem if you are looking to arp the IP of an interface that is native (untagged) and switch is tagging the arp.

You can stay with Netgear if you want, but if you want those circled IoT devices in the garage on your untrusted VLAN, and the cameras on trusted, then yes you definitely need a managed switch over there. It is possible to have a single SSID assign devices to different VLANs depending on their MAC address, if you use something like RADIUS. But I doubt you'd be setting that up. So yes- you'd create a dedicated SSID for IoT devices as long as your APs support that (TP-Link should be fine)

Ah, yes, static ARP is almost always a bad idea IMO. If anything changes MAC address it just breaks and it difficult to troubleshoot. I'm not sure why it would make any difference between 24.11 and 25.X though.

confirming what @Edson-Victor-da-cruz highlighted after running "show log | grep -i pppoe"...shows "authentication error"...so where or how do i correct that?

UPDATE: I restarted the switch and my config works now of course. I added a third VLAN to verify and it worked. Thanks for the help everyone!

@VioletDragon i am running 2.8.1 and current patches with my Cisco switch doing the L3 switching and it seems to be working. This is different but possible solution. Untagged traffic should flow to the default VLAN. This sometimes throws things off.

Greetings All, Thanks for your help. It thawed out my brain freeze. Your help got me on the right track and I'm now good to go. Thanks

@CharlesT This worked for me with the correction described by @keyser. Thanks so much for describing this!

@McMurphy Well, its common to configure the native lan with eg jumbo frames ~9000 and then specify smaller mtu for vlans. 1504 is common to support native 1500 mtu on pppoe. I suppose the interface is not in passthrough to pf, just bridges. I can't say how xen exaclty handles this, but in kvm is as above.

It's probably the VLAN setting propergating to the parent NICs and then getting applied to all VLANs on it. You can usually work around that by explicitly setting an MTU value on the parent interface first. But you may need to temporarily remove the lower MTU on the VLAN to do so.

@root0day8004 if you search the forum 'bridge vlan' you'll find a few posts about that. The TL;DR: put VLANs onto the interface first, then bridge the interfaces. But: avoid bridges whenever possible, the performance will take a hit. Buy a cheap switch.

@publictoiletbowl said in transparent bridge: You want to snort on your WAN (ISP1 & ISP2) interfaces but let the 3rd party router do all other tasks. Transparent bridging does work, see in the Netgate documentation. Not sure about the performance penalty of it, what upstream speed to you get from your ISPs? https://docs.netgate.com/pfsense/en/latest/bridges/index.html#internal-external-bridges The 3rd party router will get the public IPs from ISP1 and ISP2 and you will want to setup one of the other interfaces as admin interfaces to be able to access the pfSense.

You have a strange setup. First off, I have never worked with MicroTik, so if they do something weird, I can't help with that. My experience with QinQ is with a telecom company providing a connection to a customer over fibre. Since fibre has so much bandwidth, it's usually split before reaching the customer. The first method it to use different wavelengths, with an optical filter located near the customer. Then QinQ (C tag)¹ is used to separate different customers. Depending on the connection, the 2nd VLAN (S tag) can be used to further subdivide the bandwidth or passed on to the customer. In the jobs I worked on, there was a media converter to convert between fibre and Ethernet and used the 2nd VLAN to connect it to a Cisco router, which then provided IP over Ethernet to the customer. So, I'm surprised you'd have QinQ on the WAN. As for MTU that's determined by whatever the interface is configured for. As I mentioned earlier, VLAN tags do not affect that, since they're ahead of the Ethertype field. On my own network, while I can set the MTU on the native LAN, I can't on the VLAN. It just follows whatever the native LAN provides. I also checked adding a VLAN and found I can only add them to an interface, not on top of another VLAN. You found similar with the bridge. It's just not something pfSense can do, as far as I can tell. As for connecting the VLANs between sites, that's normally done by routing the subnets, through a VPN if necessary. Do you actually have Ethernet between sites? Or just IP? If Ethernet, do you have something like MPLS to carry it? Is there anyone else here who knows MicroTik? C tag = carrier level VLAN S tag = subscriber level VLAN.

@yctn me neither, but they mention it some at https://docs.netgate.com/pfsense/en/latest/hardware/tune.html#mbuf-exhaustion 2.7.2 is over 2 years old, why not try a later version?