Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Wireless with VLAN not allowing traffic

    Scheduled Pinned Locked Moved General pfSense Questions
    81 Posts 5 Posters 18.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dridhas
      last edited by

      @johnpoz im getting a bit confused now...
      is it supposed to run them untagged?
      if i use the tag i get the WAP to get to the correct subnet, otherwise it goes to the default lan

      1 Reply Last reply Reply Quote 0
      • D
        dridhas @johnpoz
        last edited by

        @johnpoz said in Wireless with VLAN not allowing traffic:

        @dridhas What is plugged into what exactly?

        WAN to pfsense machine
        pfsense machine to port 6 on the switch (LAN)
        WAP is plugged in to port 1 on the switch.

        And what are you changing on pfsense.. You can not just send tagged or untagged traffic to an interface in pfsense x.x.50.x or x.x.20.x those are different interfaces, etc.

        im not changing anything on pfsense... all changes are being made on WAP/Switch

        ahking19A 1 Reply Last reply Reply Quote 0
        • ahking19A
          ahking19 @dridhas
          last edited by

          @dridhas going to need to see the setup in pfSense for VLAN interface assignments. Which interface is trunk to switch?

          Port 6 of switch is setup as a trunk?

          D 1 Reply Last reply Reply Quote 0
          • D
            dridhas @ahking19
            last edited by

            @ahking19 so, the LAN cable from pfsense is going to port 5, not 6 (my bad).
            WAP is connected to poe port 1

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Since you have the 5GHz AP tagged to VLAN 50 you should be trunking that through the switch to a VLAN 50 interface defined in pfSense. That means VLAN 50 should be tagged on ports 1 and 5 in the switch.
              That is the situation where you are seeing issues accessing sites so it's probably working since it's connecting via a different logical interface in pfSense.

              However all of that is not the actual issue you're facing. You say that in that situation those sites do not resolve, so it's probably a DNS issue.
              You also said the DNS was the same on LAN and VLAN 50 but clearly it isn't. So how is the DNS configured for clients on VLAN 50?

              Steve

              1 Reply Last reply Reply Quote 1
              • JKnottJ
                JKnott @dridhas
                last edited by

                @dridhas

                You create additional SSIDs and connect them to the VLANs.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                D 1 Reply Last reply Reply Quote 0
                • JKnottJ
                  JKnott @johnpoz
                  last edited by

                  @johnpoz

                  I wonder if VLANs over WiFi are supported in the specs. The only significant difference is the content of the Ethertype/length field, though an AP could easily be designed to block VLANs. These days, WiFi links are often used to connect different sites and you'd want the WiFi to be transparent to everything, including VLANs. I guess I'll have to do some experiments some time.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  D 1 Reply Last reply Reply Quote 0
                  • D
                    dridhas @JKnott
                    last edited by

                    @jknott Yes, SSID for 5g and 2.4g were created on the WAP and the corresponding VLAN in pfsense

                    1 Reply Last reply Reply Quote 0
                    • D
                      dridhas @JKnott
                      last edited by

                      @jknott after created the VLANs in pfsense with their own dhcp/dns server and tagging the ports where the WAP and the main LAN cable are, the devices get connected successfully, but some websites are not accessible, like duckduckgo, if i untag the ports, duckduckgo works normally.

                      johnpozJ JKnottJ 2 Replies Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @dridhas
                        last edited by

                        @dridhas said in Wireless with VLAN not allowing traffic:

                        if i untag the ports, duckduckgo works normally.

                        Sorry it doesn't work that way! You must be filtering differently on this interface then.. A network being tagged or untagged has ZERO to do with if a website is allowed or not, or works or not, etc. It just doesn't - PERIOD!!

                        Not sure what rabbit hole you have lead yourself down - but tagged or not tagged has nothing to do with it.. If website works on network A, but not network B - then you have something different with dns, or filtering or firewall rules - it has zero to do with if the network is tagged or untagged.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        D 1 Reply Last reply Reply Quote 0
                        • D
                          dridhas @johnpoz
                          last edited by dridhas

                          @johnpoz yeah, i mightve done something to mess up that particular vlan...

                          after i nuked pfsense im planning on recreating one VLAN and test it and go from there.

                          ideal layout would be to have a vlan for IoT devices, one for 2.4g and one for 5g wifi

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @dridhas
                            last edited by

                            @dridhas if something isn't working on vlan X or network Y.. Then troubleshoot that thing - not that its tagged or not tagged.

                            If there was something wrong with the tagging - then nothing would work.. There is no possible way the tag could effect some websites not working while others do - just not possible.

                            If you had your tagging messed up - then you wouldn't be on that network..

                            You flipping your client to network Y and works, but move it to network X and something doesn't work - then troubleshoot that something. Firewall rule, dns - something, zero to do with X being a tagged vlan or untagged network/vlan.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            D 1 Reply Last reply Reply Quote 0
                            • D
                              dridhas @johnpoz
                              last edited by

                              @johnpoz based on that comment:
                              ive seen these 2 options:
                              d38cd56a-3d8f-4b1b-a5a4-52bf1581987e-image.png
                              i have those enabled on the WAN interface, would they also need to be on the LAN + additional VLANs?
                              im unsure if i had them there before.

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @dridhas
                                last edited by

                                @dridhas said in Wireless with VLAN not allowing traffic:

                                would they also need to be on the LAN + additional VLANs?

                                What does it say right there on them ;)

                                blocks.jpg

                                Are you using public space on your lan and vlans? I have to assume your using rfc1918 space.. Which you feel you need to hide with your x.x.50.x ? Or did you pull public space out of thin air and and think you could use it on your local networks? That could cause you not to get to some websites, if the network overlaps with what their public IP.

                                Bogon would never be used internally..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                D 1 Reply Last reply Reply Quote 0
                                • JKnottJ
                                  JKnott @dridhas
                                  last edited by

                                  @dridhas said in Wireless with VLAN not allowing traffic:

                                  like duckduckgo, if i untag the ports, duckduckgo works normally

                                  VLANs wouldn't do that. Your problem is elsewhere. The VLAN tags don't make it beyond pfsense, so the other end wouldn't know you're using them.

                                  PfSense running on Qotom mini PC
                                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                  UniFi AC-Lite access point

                                  I haven't lost my mind. It's around here...somewhere...

                                  D 1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    There's no mystery here. It works when you untag VLAN 50 at the switch because that just puts it in the LAN subnet.
                                    When it's correctly tagged all clients using it are in the VLAN 50 subnet and use the DHCP you have have configured for that with whatever settings that has. That includes whatever DNS you are passing there.

                                    Previously you said clients in VLAN 50 are not able to resolve those sites, which is clearly a DNS issue, but did you mean just unable to connect?

                                    I agree, if you used a public subnet for VLAN 50 that could conflict with the real public IPs and cause this.

                                    Steve

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      dridhas @johnpoz
                                      last edited by

                                      @johnpoz no, im not using a public ip, i got lazy to type the whole ip, but it is 192.168.50.x for VLAN 50

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        dridhas @JKnott
                                        last edited by

                                        @jknott im starting to believe that there is a DNS configuration error or a DNS conflict.

                                        on the VLAN in pfsense i used 208.67.222.222 and 1.1.1.1 which are the same for the DNS Server settings under System > General Setup:
                                        521c4e51-5ab8-4234-8dee-a2b8a11a5efc-image.png

                                        not sure if that could possible conflict.

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @dridhas
                                          last edited by

                                          @dridhas said in Wireless with VLAN not allowing traffic:

                                          not sure if that could possible conflict.

                                          Bad idea to use 2 different dns that can respond differently - 222.222 does filtering, while 1.1.1.1 does not..

                                          If your going to have clients or forward to dns, you need to make sure they will always answer in the same way. One that filters and one that doesn't is not good idea - unless you are 100% sure they filter the exact same stuff. Since you can never be sure when more than 1 NS is provided to use, you have no idea which 1 will actually be used for any specific query.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          JKnottJ 1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by stephenw10

                                            Yeah, try just not specifying any DNS servers in the DHCP config for VLAN 50. Clients will use the interface IP and hence Unbound in pfSense by default.

                                            What do you have set for DNS in the LAN DHCP settings?

                                            The servers you have defined in General Setup are probably not being used unless you have set the resolver to forwarding mode.
                                            But if you have you also have 'DNS Server Overide' set so your ISPs DNS servers might be in use.

                                            Steve

                                            D 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.