Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to set the same VLANs between the switch and PfSense

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    102 Posts 6 Posters 23.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @SteveITS
      last edited by johnpoz

      @steveits said in How to set the same VLANs between the switch and PfSense:

      Firewall rules don't sent traffic anywhere.

      Unless your policy routing ;)

      @jt40 said in How to set the same VLANs between the switch and PfSense:

      LAN5 (send everything from LAN5 network to WAN address)

      What does that even mean? That isn't going to get to the internet..

      WAN (accept everything that comes from LAN5 network

      How would the WAN ever see any traffic from LAN5?

      Rules are evaluated as traffic enters an interface from the network it is attached too... WAN could never see Lan5 traffic as source..

      Please post up these rules you created..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • J
        JT40 @Patch
        last edited by

        @patch said in How to set the same VLANs between the switch and PfSense:

        @jt40 said in How to set the same VLANs between the switch and PfSense:

        I don't have any other rule on that interface,

        The default settings are

        • WAN: Common functional default setting for a WAN
        • LAN: Common functional default setting for a LAN including an anti-lockout rule
        • OPT1... or VLAN: No rules other the default deny all rule.

        So if you add a VLAN or use OPT as an extra LAN you need rules similar to the default LAN rules. Similarly if you use OPT as an extra WAN you need rules similar to the default WAN rules.

        I removed all the default rules, plus when I create a new interface there is no rule at all.
        Is the "DENY ALL in INBOUND" rule implicit for each interface? If so, where I can see it?

        @johnpoz said in How to set the same VLANs between the switch and PfSense:

        @steveits said in How to set the same VLANs between the switch and PfSense:

        Firewall rules don't sent traffic anywhere.

        Unless your policy routing ;)

        @jt40 said in How to set the same VLANs between the switch and PfSense:

        LAN5 (send everything from LAN5 network to WAN address)

        What does that even mean? That isn't going to get to the internet..

        In my head, that means that every address of the network in the LAN5 interface can reach the WAN address, which is directly connected to a gateway. I don't know if I see it correctly, but this is how it makes sense for me :D .

        WAN (accept everything that comes from LAN5 network

        How would the WAN ever see any traffic from LAN5?

        I probably didn't mention it in this way, but due to the ISP router in front of, that WAN is actually a LAN.
        I'd be curious to know if it would have been different with a real WAN.

        Rules are evaluated as traffic enters an interface from the network it is attached too... WAN could never see Lan5 traffic as source..

        Strange, so how the routing would work?
        Where and how should I specify the rule to allow traffic from one LAN to internet?

        Please post up these rules you created..

        The rules are in the previous message, I didn't omit details or rules, I could give a screenshot but it's really what I described.

        S johnpozJ 2 Replies Last reply Reply Quote 0
        • S
          SteveITS Galactic Empire @JT40
          last edited by

          @jt40 said in How to set the same VLANs between the switch and PfSense:

          Where and how should I specify the rule to allow traffic from one LAN to internet?

          On interface LAN5 the default should be no rules. The implicit deny rule is not explicit, therefore not listed. Add a rule to allow from LAN5 Net to any. If you also want to block LAN5 from getting to LAN, add a rule above that rule, to deny from LAN5 Net to LAN Net.

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote ๐Ÿ‘ helpful posts!

          1 Reply Last reply Reply Quote 0
          • J
            JT40
            last edited by

            Oh ok, I think I was a bit drunk, if there is no rule then is DENY ALL, so all the INBOUND traffic is DENY currently because I have no rule as such, I think it works in this way as any other router :D , I tested it in the LAN just in case.

            P 1 Reply Last reply Reply Quote 0
            • J
              JT40
              last edited by

              This Askimet spam filter is against me, I didn't post any link and I still can't write the message I need :D

              Bob.DigB 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @JT40
                last edited by

                @jt40 said in How to set the same VLANs between the switch and PfSense:

                I could give a screenshot but it's really what I described.

                What you described doesn't make any sense - lan5 could not or would or could ever be source of traffic into the wan interface..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • J
                  JT40
                  last edited by JT40

                  In response to Steve -->
                  Is it not already disabled by default? Please look my message above.

                  If you talk about the same LAN instead (for example LAN2 to LAN2), I don't want the communication between the devices on the same LAN, but I also don't want the communication between different LANs for now.
                  At the moment, due to no rule in place I think it's DENY ALL between LANs, I need to check between the devices of the same LAN.

                  In any case, I'll configure such things in VLAN, where below that VLAN there will be a switch, which by itself will have the client isolation rule enabled.
                  I need to check what I need to do on the PfSense firewall about it...

                  johnpozJ S 2 Replies Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @JT40
                    last edited by johnpoz

                    @jt40 said in How to set the same VLANs between the switch and PfSense:

                    I don't want the communication between the devices on the same LAN

                    pfsense has nothing to do with communication between devices on the network (lan) Pfsense is a router, it routes and firewall traffic between networks. It is not involved in devices talking to each other on the same network, only for traffic wanting to leave a network.

                    If you don't want devices talking to each other on the same network you would need to do that at your switch - lookup up a private vlan. Or via wireless this is often called AP or Client isolation.

                    https://en.wikipedia.org/wiki/Private_VLAN

                    https://support.denon.com/app/answers/detail/a_id/3746/~/wireless%2C-ap-or-client-isolation

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • S
                      SteveITS Galactic Empire @JT40
                      last edited by

                      @jt40 If you allow LAN2 to Any, that will allow to LAN5 as well. LAN5 is "any."

                      You can't do much about devices on the same network communicating. That normally is handled by a switch and those packets don't even get to the router.

                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                      Upvote ๐Ÿ‘ helpful posts!

                      1 Reply Last reply Reply Quote 2
                      • P
                        Patch @JT40
                        last edited by Patch

                        @jt40 said in How to set the same VLANs between the switch and PfSense:

                        if there is no rule then is DENY ALL, so all the INBOUND traffic is DENY currently because I have no rule as such

                        • Rules are evaluated from the top down.
                        • The first rule which matches is used and no further rules are evaluated.
                        • If no entered rules match the the packet is dropped / blocked.

                        So if no rules are entered every packet falls off the bottom of the rule list and is blocked.

                        I find it simplest to order my rules as

                        1. Allowed local traffic
                        2. Reject other local traffic
                        3. Allowed Internet traffic
                        4. Block other Internet traffic

                        An example of which for LAN2 is:
                        Firewall example.jpg

                        1 Reply Last reply Reply Quote 0
                        • Bob.DigB
                          Bob.Dig LAYER 8 @JT40
                          last edited by

                          @jt40 said in How to set the same VLANs between the switch and PfSense:

                          This Askimet spam filter is against me, I didn't post any link and I still can't write the message I need :D

                          I am with Akismet on this one. ๐Ÿ˜€

                          J 1 Reply Last reply Reply Quote 0
                          • J
                            JT40 @Bob.Dig
                            last edited by

                            @bob-dig said in How to set the same VLANs between the switch and PfSense:

                            @jt40 said in How to set the same VLANs between the switch and PfSense:

                            This Askimet spam filter is against me, I didn't post any link and I still can't write the message I need :D

                            I am with Akismet on this one. ๐Ÿ˜€

                            ๐Ÿ˜

                            @patch said in How to set the same VLANs between the switch and PfSense:

                            @jt40 said in How to set the same VLANs between the switch and PfSense:

                            if there is no rule then is DENY ALL, so all the INBOUND traffic is DENY currently because I have no rule as such

                            • Rules are evaluated from the top down.
                            • The first rule which matches is used and no further rules are evaluated.
                            • If no entered rules match the the packet is dropped / blocked.

                            So if no rules are entered every packet falls off the bottom of the rule list and is blocked.

                            I find it simplest to order my rules as

                            1. Allowed local traffic
                            2. Block other local traffic
                            3. Allowed Internet traffic
                            4. Block other Internet traffic

                            An example of which for LAN2 is:
                            Firewall example.jpg

                            Thank you.
                            I see that you have set also the REJECT rules, but my point is, is it not by default?
                            Precisely, I would expect DROP as by default, not REJECT.

                            Look at the simplest case, if I have a rule do to something, I expect that rule to be evaluated.
                            If the device asks for something else and the rule is not present, I expect the packets to be dropped automatically...
                            This is also the easiest way a firewall can work to make my life easier :D

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @JT40
                              last edited by johnpoz

                              @jt40 the default is drop, ie just block..

                              But internally it is sometime better to reject vs just drop. I want to let my internal client you can not go there right away - via a reject. Vs letting it bang its head with retrans trying to figure out why he is not getting an answer.

                              Externally no you would almost never want to send a reject to something out on the internet.. But internally - if your going to on purpose prevent something like vlan x from talking to vlan y.. its better to just let them know - hey stop trying to go there ;)

                              If the device asks for something else and the rule is not present, I expect the packets to be dropped automatically...

                              That is how it works.. If there is not allowed, then traffic dropped gone over this how many times already.. But yet to see a picture of your rules.. You have been told multiple times that pfsense will not route traffic unless there is an allow rule.

                              If the spam system is preventing you from uploading a picture - then link to it somewhere else, use something like my picture is here somewhere . domain . tld / whatever even if you have to but. But what I can tell you yet again yes default is deny. No rule to allow, traffic is dropped.

                              If you want to actually see it - then look at the full rule set. Since this default deny is not shown in the gui..

                              [21.05.2-RELEASE][admin@sg4860.local.lan]/root: pfctl -sr | grep "Default deny rule"
                              block drop in inet all label "Default deny rule IPv4"
                              block drop out inet all label "Default deny rule IPv4"
                              block drop in inet6 all label "Default deny rule IPv6"
                              block drop out inet6 all label "Default deny rule IPv6"
                              [21.05.2-RELEASE][admin@sg4860.local.lan]/root: 
                              

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 2
                              • P Patch referenced this topic on
                              • P Patch referenced this topic on
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.