Wireless with VLAN not allowing traffic

JKnott

@johnpoz said in Wireless with VLAN not allowing traffic:

Bad idea to use 2 different dns that can respond differently - 222.222 does filtering, while 1.1.1.1 does not..

I have my main LAN configured to use the pfsense DNS server, but my guest WiFi points to Google's DNS. Separate subnets, no problem. However, they shouldn't be mixed on the same subnet.

johnpoz

Pointing different devices to 1 dns, and other device to a different dns is not what I was talking about at all.. That is fine.

The problem is if a client can use more than 1 NS, you have really no control over which one might be asked, be it your actual client, or the forwarder your pointing to (unbound/dnsmas) etc..

If the NS you could ask for something might resolve differently - filtered or not filtered, your going to have a bad day. Because you never know which one might get asked, it could be filtered when you don't want it to be, or or could be allowed when you want it filtered.

dridhas

@johnpoz im starting to believe the switch might be the culprit.

im getting hardwire to port1 where the WAP was and im getting a non-vlan ip.

and if i untag the port, i dont get any ip addresses...

johnpoz

@dridhas said in Wireless with VLAN not allowing traffic:

and if i untag the port, i dont get any ip addresses...

If your going to plug a computer into a port, this port would almost always be set to 1 vlan with it being untagged. Just put a port in vlan 90, untagged (cisco world calls this access port).

If you plugged some computer into the port where your WAP was connected where vlan 1 was untagged, and 90 was tagged. It should get an IP from your dhcp on the vlan 1..

For it to use vlan 90 where its tagged, you would have to tell the OS to use tag - which can be done in windows (depending on the driver for that nic)

But your mileage might very depending on the nic, and driver, etc. etc..

stephenw10

It's not a switch or VLAN issue. Clients are getting a DHCP lease in the correct subnet.

It's probably not a firewall issue either now that you have added a rule with the correct source.

What happens when you try to visit one of these sites? What is the exact error you see?

Steve

johnpoz

@stephenw10 he said " i dont get any ip addresses"

So who knows what he has going on or how he is setting it up... If he had 1 untagged and 90 tagged on the wap port, and he plugged just a PC into that port - then he should of gotten an IP on whatever the untagged vlan network is.. 192.168.20 I believe..

dridhas

@johnpoz this is the result of the nslookup on wifi/lan via VLAN90

and this is the error message on the browser:

stephenw10

@johnpoz said in Wireless with VLAN not allowing traffic:

@stephenw10 he said " i dont get any ip addresses"

But that's only when VLAN 90 is untagged, which is expected.

When it's tagged correctly it gets an IP. And we can see the client is able to connect to the VLAN 90 interface address and resolve those FQDNs.

So that looks like not DNS or the switch or anything vlan related.

Do you see the same thing with different browsers?

Can you traceroute to uber.com? Or ping it?

Steve

johnpoz

@dridhas well your clearly resolving them - but how ever your setup is borked if you ask me.. If you were asking unbound running on pfsense directly. It should resolve your pfsense name, not come back unknown.

like so

> duckduckgo.com
Server:  sg4860.local.lan
Address:  192.168.9.253

Non-authoritative answer:
Name:    duckduckgo.com
Address:  40.89.244.232

But that error is time out error.. So you looked it up, got an IP - and I show the same IP for duckduck.. So now you need to figure out why your having time out getting an answer. I would first sniff on wan and make sure traffic went out or not.. If you don't see it go out, then sniff on your pfsense lan side interface.. Do you see it get there? If so then pfsense should of sent it out..

dridhas

@stephenw10 ping does not work, im guessing uber has ICMP disabled.
on Edge i see something similar:

here are the results of tracert:

This is ping:

stephenw10

Hmm, interesting. That all looks OK.

And, to be clear, if you connect that same client to the LAN you can then reach those sites as expected?

dridhas

@stephenw10 yes, i can access it normally when im on the LAN network.

i ran a traceroute while on LAN and these are the results.

The only difference is the first hop:

JKnott

@dridhas said in Wireless with VLAN not allowing traffic:

im getting hardwire to port1 where the WAP was and im getting a non-vlan ip.

Any chance you have a TP-Link switch? Some models have problems with VLANs.

johnpoz

@dridhas said in Wireless with VLAN not allowing traffic:

im guessing uber has ICMP disabled.

yeah it doesn't answer ping here either

Pinging uber.com [104.36.195.150] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

And again - so troubleshoot the problem - does pfsense see/send the syn to where your trying to go, does it send it on? This is 30 seconds of sniffing (packet capture) to see what is happening.

Pfsense doesn't care if the traffic it sees is tagged or not tagged.. It sees traffic - it sends it on or it doesn't..

You need to validate that pfsense sees the syn to whatever IP your trying to send to, and if it sends it on and gets and answer or doesn't - be it that traffic pfsense sees is tagged or not tagged has nothing to do with it.

dridhas

@jknott i do... the model is TL-SG108PE, also the WAP is TPLINK model EAP225

johnpoz

@dridhas said in Wireless with VLAN not allowing traffic:

TL-SG108PE, also the WAP is TPLINK model EAP225

Both complete and utter POS! that have zero clue to what vlan is ;) heheheh

Yeah no wonder your having problems..

dridhas

@johnpoz oh my… I’ve had TPLink before and had no issues… this is the first time I’m having one that can do vlans and poe.

johnpoz

@dridhas search - there are many threads here even that talk about their complete lack of understanding of how vlans work.

But looks from what you posted that you could remove vlan 1, before they had an issue where you could not remove vlan 1 from ports. So on ports where you only wanted vlan X, there was still vlan 1..

I would get other gear.. Can you return that hardware?

dridhas

@johnpoz I could… what would y’all recommend that won’t leave me bankrupt?
Both devices need change (wap/switch)?

also, I was able to use the vlans desired on each port, as long as the nic I was using had that vlanid

JKnott

@dridhas said in Wireless with VLAN not allowing traffic:

@jknott i do... the model is TL-SG108PE, also the WAP is TPLINK model EAP225

I had a TP-Link AP that didn't handle VLANs properly but replaced it with a Unifi AP. I also have a Cisco switch and both devices are fine with VLANs.

In my case, the IPv6 multicasts were crossing from the main LAN to the VLAN, causing devices on my guest WiFi to get the wrong address.