• VLANs with bridged interfaces

    7
    0 Votes
    7 Posts
    1k Views
    imark77I

    @imark77 going by the hardware in the handle. I'm assuming the SuperMicro has for dedicated ports. If that's the case you'll need to create your desired VLANs on each hardware Port ID and then bridge those VLANs acrossed back together. And then a firewall rule to allow them to intercommunicate. ( Theoretically switching to rules on bridge would make the rules easier but I don't recommend that until I can confirm that it works on my end.... As that seems to be the problem I'm having ).

  • Making Best Use of Physical NICs & VLANs

    10
    0 Votes
    10 Posts
    1k Views
    JKnottJ

    @bingo600 said in Making Best Use of Physical NICs & VLANs:

    You should only have ONE dhcp server (per vlan) active at any time.
    Else you risk getting overlapping leases.

    Actually, multiple DHCP servers are permitted. While you can configure them with non-overlapping pools, Duplicate Address Detection is supposed to be used to avoid problems.

  • d'link AP with pfSense VLAN

    13
    0 Votes
    13 Posts
    1k Views
    GertjanG

    Or even no switch at all. Like daisy chain the AP's with their internal multipleLAN ports. Which, ok, are actually switches.

    Be definition, a switch that does not have an IP for itself, no GUI or console access, is a 'dumb' switch, like a smart hub. You can not interact with it. It will operate on MAC level at max, not IP.

    Btw : I don't get it.
    It took you a minute to create a (example) VLAN ID 100 on pfSense.
    It takes a minute to set up a device (= AP, or whatever) with a static IP setup for this VLAN100 (which means the IP should be in the VLAN100 network, the gateway should point to the VLAN100 pfSense IP - same thing for its DNS).
    Set up also the VLAN ID for your 'LAN' on the AP - if the AP supports VLAN.

    Hook up the AP, and analyse the traffic with firewall rules that log, or the packet sniffer or whatever, to assure yourself that LAN and VLAN traffic is separated.

    Or .... apply the keep-it-simple rule : take a 5 $ third NIC, create your physical separated wired LAN, hook up your switch and on the switch the 5 AP's and you can pas on to other things ;)

  • Setup for Routing - VLANS

    12
    0 Votes
    12 Posts
    960 Views
    johnpozJ

    No again you don't have to set routes for anything connected to pfsense directly.

    If you want to send a client out a vpn connection (vpn setup on pfsense to point to some service)

    Then you would just policy route that via a firewall rule. Just making sure that you put any rules above that to allow local access (if you want)..

    If you want to send clients trying to talk to 1.2.3.4 (publicIP) then sure you could create a route on pfsense for that dest network to use vpn connection. But that would really send any and all clients from behind pfsense out that vpn.

    Better option is to just policy route what you want to use the vpn. Be it via either their IP/Net, dest IP/net or dest port, etc.

    https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html

    Setting up a vpn client on pfsense creates a multiwan setup.. Since you have either your normal wan as gateway, or this vpn connection as a gateway.

  • Assigning network to port

    4
    0 Votes
    4 Posts
    440 Views
    kiokomanK

    indeed, it's an internal switch after all, you must use vlans

  • Don't get VLAN (DHCP) ip address on my Virtual Machine Guest

    6
    0 Votes
    6 Posts
    1k Views
    kiokomanK

    emp0s3 is using vlanid30 but i'm not so sure about igb0.30
    sorry it's only what is coming on my mind could be stupid, as I'm not in front of your stuff and i don't own a microtick i can't tell you exactly where to look but if i was me i will trace back until i see where the vlan30 stop working, tcpdump also can help

  • VLAN traffic not filter through pfblocker

    2
    0 Votes
    2 Posts
    388 Views
    S

    @rjamesm Do you have the VLANs selected in pfBlocker? By default it only selects the LAN. If you also want it to do the VLANs you'll need to add it under the IP tab.

  • VLAN Priority Guidance

    1
    0 Votes
    1 Posts
    174 Views
    No one has replied
  • OPT as LAN Interface

    6
    0 Votes
    6 Posts
    1k Views
    R

    @johnpoz thanks. I added any any for opt1.

  • VLAN Routing with UniFi APs

    12
    0 Votes
    12 Posts
    2k Views
    bingo600B

    @johnpoz

    Luckily i'm in a controlled environment where only PC's and Desktop Phones approved by (me) are allowed to have access via WiFi.

    No phones or personal devices are allowed on that segment.

    /Bingo

  • VLANs with pfSense and Unifi gear

    1
    0 Votes
    1 Posts
    188 Views
    No one has replied
  • random broadcast storms

    5
    0 Votes
    5 Posts
    786 Views
    A

    @pfsenseuser2020 Looks like ports 137 and 138 are Netbios and/or Windows File Sharing CIFS ports. Do you maybe have a NAS or file server that's misbehaving, or infected?

    https://library.netapp.com/ecmdocs/ECMP1155586/html/GUID-4645E16A-6CB1-4A71-8420-05749894E857.html

    https://forum.netgate.com/topic/83433/log-flooded-with-port-137-138-udp

    But, I agree with @kiokoman, if possible, turn it off at the host's network card.

    Jeff

  • VLAN -> VLAN Routing Misbehaving

    6
    1 Votes
    6 Posts
    701 Views
    D

    @marvosa Yeah, it's a typo 192.168.x.0, the "x" is the VLAN #. For some reason I can't reliably edit my post, nor can I post comments it keeps telling me "Post content was flagged as spam by Akismet.com"... This forum really needs to address that...

    I have solved this problem. I had a floating rule that blocked private ranges, which of course was blocking subnet -> subnet routing.
  • Switch configuration

    3
    0 Votes
    3 Posts
    443 Views
    Z

    I would like to install xcp-ng as hypervisor and also have redundancy in case one of the nodes or one of the switches fails. I haven't done this before. css326 should serve mainly for making the connections with the patch panel and as failover if the crs326 switch would fail.
    Is the following plausible to setup or what would you recommended ?

    3.png

  • Can you filter multicast with a bridge?

    3
    0 Votes
    3 Posts
    293 Views
    senseivitaS

    Well, no exactly, I already got noisy stuff under one subnet. I'm just curious if it can be achieved by merely using a transparent firewall technique while keeping the rest of the L2s separated. This is the first time I've thought about pfSense filtering below L3 I believe.

    The switches I have, come with lots of stuff for multicast, fancy is actually a fitting word for it's a lot, from multicast filtering to routing to something in the middle (MVR) Plenty more features than for the other L2/L3 areas. But playing with these can easily lead to trouble, nothing too serious yet not far off--I traced a painfully slow network to the Avahi plugin when 2.4.5p1 was first released. It's been switched off since then.

    There is one multicast feature that I though seemed like a good compromise, in Ubiquiti-branded stuff it's called MVR, everywhere else is just Multicast VLAN, in Cisco it's probably named by its RFC # and then their licensed next to it. 😆 MVR is supposed to drop all multicast traffic regardless of source VLAN into a dedicated VLAN so traffic traffic won't bother other operations, setting up the ports' mode for it is contradictory in all documentation even it's got not router/source/whatever port designations. I tried so hard to make it work but I kept missing the almost-never-mentioned point: it only goes one-way, same as all other multicast protocols, they're designed to work in this waterfall-like fashion, as if source always were an IPTV operator for instances; remote from the Internet, doesn't care what you have to say. It's never a mesh or at least one-ways-for-all situation. The naming doesn't make it easier either, I know VLANs inside and out now, but when I go through these docs that aren't even for VLANs it makes me question how much do I really know about VLANs, ADHD kicks in and I've lost all day when I eventually l land in the document that triggered the spiral.

    Not that useful for something like a remote app, or Spotify Connect/AirPlay, all relying heavily on multicast, treated like broadcast but even less smart. Some just assume your wireless network is the same as the wired one or the most infuriating are those incompatible Enterprise WPAs that expects the other device setting it up to connect to the same SSID otherwise it won't take it. It drives me insane this Harmony Hub I use for domo losses connectivity I have to go get a step ladder to pair it over Bluetooth, to then failing its "tests" to give you an IP input field only at the very end while you wait balancing on the ladder. 🤬

    Got sidetracked there, sorry. Avahi and mDNS Repeater seem to be the only tools available for this but they're not really protocols, are they? They're included everywhere, well, Avahi is, but it's banned from switches it seems. They only router appliance I've seen that dealt with this type is in the Ubiquiti USG line, Ubiquiti as a brand sort of constantly readjusts its priorities (or has no direction), so it doesn't really count. So I'm exploring option to see what could be done if I didn't have or didn't know how to setup a RADIUS server (and pfSense didn't have one right in there). There's a lot more happening at L2 beyond ethenet so I'm curious.

    I'd love to get my hands on one of those old ATM cards though I woulnd't know what to do with it 5 seconds later. I think my ISP is still using ATM despite delivering fiber I have this hunch. All of their naming still hints to ATM stuff. :)

    I don't think you know how much I appreciate those little bits about Plex and preemptive filtering 'cause it's the first kind of thing that pops in my mind when I run into trouble. Thanks for the help!

  • Periodic connection drops for specific client

    13
    0 Votes
    13 Posts
    2k Views
    A

    I'm seeing the same behavior on my network for both wired and wireless clients.
    https://forum.netgate.com/topic/157090/periodic-drops/4

    Thank you for this post, it let me isolate the cause of the network disruption. I'm still not sure what the root cause is, but at least I have a starting point.

  • Troubleshooting VLAN Connection

    2
    0 Votes
    2 Posts
    339 Views
    TheMetManT

    SOLVED it myself in the end!!!
    For anyone else out there with the same problem.......
    It was Enable 802.1q VLAN mode in the Switch Settings on the SG-3100.

    Interfaces->Switch->VLANS

    I unchecked this so it was using Port Mode, left it at the default, and I can now connect.

  • Unable to connect to wireless SSID with VLAN

    5
    0 Votes
    5 Posts
    450 Views
    I

    @Inxsible said in Unable to connect to wireless SSID with VLAN:

    However, I am no longer getting access to the internet when I am connected to the SSIDs with VLAN ids.... Do you see anything wrong with my Firewall rules in the above post?

    I had to add Outbound NAT rules because I have mine set up as Manual. Once I added those and the allow rule to access the firewall for DNS, I was able to access the internet from the devices connected to the VLANed SSIDs

  • Cannot set Switch Port for multiple VLANs

    7
    0 Votes
    7 Posts
    693 Views
    TheMetManT

    @JKnott OK, thanks I understand that now. I do not have any media to change so 'Switch port' can be left alone.
    As for the section below, and looking at the pfSense Book, I don't think I need to add a gateway.
    Thanks very much for your input.

  • Speed Interface error in QinQ interface

    8
    0 Votes
    8 Posts
    391 Views
    DaddyGoD

    @prx said in Speed Interface error in QinQ interface:

    In the GUI under Assignments -> Interfaces I can only select "autoselect"

    Due to the nature of "LAG", both sides require the same - next:

    -Be of the same speed
    -Have the same Duplex settings

    When negotiating the LAG speed (merged), only "auto" can be considered, because of the above.

    Just think along, two parent interface, which is 1Gig
    in LAG (with LACP) 2 Gig

    if one of the parent interfaces becomes detached, the combined speed will again be only 1 Gig, so the speed of the LAG interface cannot be predefined, but depends on the group members (from their number / speed)

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.