Please help me to get it floating quick vs Interface rules

johnpoz

@eeebbune said in Please help me to get it floating quick vs Interface rules:

TRUNKPORTS = Bridge between LAN(has IP address)-SERVERZONE (No ip address)

Huh?? If you have lan and server networks, why would you also bridge them?

ServerZone rules (Allow all inbound traffic)

Inbound to what, the interface yes.. But rules on that interface have nothing to do for inbound from other networks into the servernetwork

Traffic is evaluated as traffic enters an interface from the network its attached to... That rule you have on serverzone would have to do with stuff on the serverzone network talking outbound to something other than serverzone.. That rules has nothing to do with say something on lan wanting to talk to serverzone..

eeebbune

@johnpoz

Hello Johnpoz,

The bridge is for making trunk port.
ServerZone port is connected to L2 switch for several server connections so I have to create the interface port to trunk. (I gave the VLAN tag information to serverzone port)

One more question, how can I understand about serverzone network?
Actual serverzone interface port doesn't have IP / network range. they only knows about vlan tag number. Can I take the serverzone network means actual server's IP addresses?

johnpoz

@eeebbune said in Please help me to get it floating quick vs Interface rules:

The bridge is for making trunk port.

Bridge has nothing to do with making a trunk port.. Running multiple vlans over a port or even a lacp connection (multiple ports) has nothing to do with creating a bridge in pfsense - nothing!

eeebbune

@johnpoz

Really..? so, If I remove bridge between LAN - SERVERZONE interface port and just giving multiple vlan tags are enough to make trunk port, am I correctly understand?

eeebbune

@johnpoz

Wait, the rules in serverzone is nothing to do with outbound (other than serverzone), than what does my allow rule mean? I thought (any) to (Serverzone, traffic goes to server) is allowed.

johnpoz

@eeebbune said in Please help me to get it floating quick vs Interface rules:

am I correctly understand?

You would create a "trunk" port by putting vlans on specific interface.. Example you see my interface igb2, it has 3 networks on this "port/interface" it has my wlan which is 192.168.2/24 and then 2 vlans 4 and 6. which are 192.168.4/24 and 192.168.6/24

This is connected to a switch port, that is configured as "trunk" which allows for vlan (2) in my case this configured on the switch only.. Pfsense has no idea about his vlan ID because to pfsense this is an untagged vlan, just native directly on the igb2 interface.

In the case of vlans 4 and 6, pfsense knows about them and they ride on igb2, and tagged 4 and 6. The port on the switch is setup for vlan 2 to be the native and pvid vlan, and vlan 4 and 6 are tagged.

interface gigabitethernet5
 description "sg4860 WLan and vlans"
 switchport trunk allowed vlan add 4,6
 switchport trunk native vlan 2

There is no "bridge" in pfsense..

eeebbune

@johnpoz

Aha, now I get it clearly.
Do you have any rules in W_PSK, W_Guest?
if I create rule to W_PSK (VLAN4 on igb2), then packets which has tag#4 got caught and passing/blocking by rule?

johnpoz

@eeebbune Yeah I have rules on all of my interfaces to prevent them from talking to stuff.

Example here is my guest rules

Yes your switch would tag the vlans towards pfsense.

eeebbune

@johnpoz

I appreciate from the bottom of my heart.
I will change the configuration and check the server communication again.

Thank you so much.

johnpoz

@eeebbune Any questions - please just ask, here to help!