Wireless with VLAN not allowing traffic
-
@johnpoz said in Wireless with VLAN not allowing traffic:
@stephenw10 he said " i dont get any ip addresses"
But that's only when VLAN 90 is untagged, which is expected.
When it's tagged correctly it gets an IP. And we can see the client is able to connect to the VLAN 90 interface address and resolve those FQDNs.
So that looks like not DNS or the switch or anything vlan related.
Do you see the same thing with different browsers?
Can you traceroute to uber.com? Or ping it?
Steve
-
@dridhas well your clearly resolving them - but how ever your setup is borked if you ask me.. If you were asking unbound running on pfsense directly. It should resolve your pfsense name, not come back unknown.
like so
> duckduckgo.com Server: sg4860.local.lan Address: 192.168.9.253 Non-authoritative answer: Name: duckduckgo.com Address: 40.89.244.232But that error is time out error.. So you looked it up, got an IP - and I show the same IP for duckduck.. So now you need to figure out why your having time out getting an answer. I would first sniff on wan and make sure traffic went out or not.. If you don't see it go out, then sniff on your pfsense lan side interface.. Do you see it get there? If so then pfsense should of sent it out..
-
@stephenw10 ping does not work, im guessing uber has ICMP disabled.
on Edge i see something similar:
here are the results of tracert:
This is ping:
-
Hmm, interesting. That all looks OK.
And, to be clear, if you connect that same client to the LAN you can then reach those sites as expected?
-
@stephenw10 yes, i can access it normally when im on the LAN network.
i ran a traceroute while on LAN and these are the results.
The only difference is the first hop:
-
@dridhas said in Wireless with VLAN not allowing traffic:
im getting hardwire to port1 where the WAP was and im getting a non-vlan ip.
Any chance you have a TP-Link switch? Some models have problems with VLANs.
-
@dridhas said in Wireless with VLAN not allowing traffic:
im guessing uber has ICMP disabled.
yeah it doesn't answer ping here either
Pinging uber.com [104.36.195.150] with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out.And again - so troubleshoot the problem - does pfsense see/send the syn to where your trying to go, does it send it on? This is 30 seconds of sniffing (packet capture) to see what is happening.
Pfsense doesn't care if the traffic it sees is tagged or not tagged.. It sees traffic - it sends it on or it doesn't..
You need to validate that pfsense sees the syn to whatever IP your trying to send to, and if it sends it on and gets and answer or doesn't - be it that traffic pfsense sees is tagged or not tagged has nothing to do with it.
-
@jknott i do... the model is TL-SG108PE, also the WAP is TPLINK model EAP225
-
@dridhas said in Wireless with VLAN not allowing traffic:
TL-SG108PE, also the WAP is TPLINK model EAP225
Both complete and utter POS! that have zero clue to what vlan is ;) heheheh
Yeah no wonder your having problems..
-
@johnpoz oh my… I’ve had TPLink before and had no issues… this is the first time I’m having one that can do vlans and poe.
-
@dridhas search - there are many threads here even that talk about their complete lack of understanding of how vlans work.
But looks from what you posted that you could remove vlan 1, before they had an issue where you could not remove vlan 1 from ports. So on ports where you only wanted vlan X, there was still vlan 1..
I would get other gear.. Can you return that hardware?
-
@johnpoz I could… what would y’all recommend that won’t leave me bankrupt?
Both devices need change (wap/switch)?also, I was able to use the vlans desired on each port, as long as the nic I was using had that vlanid
-
@dridhas said in Wireless with VLAN not allowing traffic:
@jknott i do... the model is TL-SG108PE, also the WAP is TPLINK model EAP225
I had a TP-Link AP that didn't handle VLANs properly but replaced it with a Unifi AP. I also have a Cisco switch and both devices are fine with VLANs.
In my case, the IPv6 multicasts were crossing from the main LAN to the VLAN, causing devices on my guest WiFi to get the wrong address.
-
@jknott imma take a wild guess and say the AP is working fine and that the switch is the one having the issues with the hard coded vlan1
-
Given TP-Link's history, I don't know that you can say that. However, try just the switch and see what happens. Or temporarily connect only the AP to pfsense and try that.
-
@jknott ive connected directly to the switch using a cable and its the same behaviour for both VLANs... something's fishy with the switch
-
@johnpoz i tried doing a packet capture thru pfsense for vlan90 (i changed the PVID on the switch to an specific port) and i dont see any SYN records
i see something like this on the results:
-
@dridhas that is 1 ack.. That is all you saw?
Close your browser..
Start your sniff, make sure its set to log more than 100 packets, or limited to where your trying to go say the duckduckgo IP.
Then start up your browser and hit duckduckgo.com - if you do not see anything in pfsense.. Then no there is no way its going to work.
(i changed the PVID on the switch to an specific port)
Huh? What did you do? When you put a port access mode in say vlan 90, then yes the pvid on that port should be 90.. This tells the switch, hey when you see ingress traffic into this port that is untagged, it is vlan 90 traffic.
Some switches will auto do that for you.. But has been a while since I have played with the POS that is tplink.. The one I had is currently being used as just a dumb switch behind my tv for the tv and shield.. Have not swapped it out with the unifi flex mini I got as of yet..
-
At this point I would be amazed if this is a VLAN problem with either the switch or the access point. Yes TP-Link have produced some badly behaved stuff in the past but we have no specific reason to think these are one of them.
Layer 2 issues like that just don't present like this. It would be broken to everywhere for all layer 3 connections.
Here we are seeing some websites are not responding but, as I understand it, most are working fine. Traceroute works. Ping works (to other sites).
This is not a VLAN problem!
Like John said, work the issue. Run a packet capture on VLAN 90 and try to open one of the failing sites. Make sure you are seeing the SYN/ACK TCP handshake. If not where is it failing?
Test again but pcap on the WAN, make sure you see it there.Some websites failing to connect is usually and IP conflict (doesn't seem to apply here) or some MTU issue.
We have also seen cases where something in the AP is causing a problem. Some filtering happening there that should be disabled for example.Steve
-
@stephenw10 said in Wireless with VLAN not allowing traffic:
It would be broken to everywhere for all layer 3 connections.
exactly my thoughts.
