Same Networks in different VLANs

viragomann

@lucderheld
Bridging interfaces is basically only recommended if there is no other option, i.e. if your really need both sides to be in the same L2 network. From your upper post, I was thinking you're looking for this.

@lucderheld said in Same Networks in different VLANs:

@viragomann
Hmm, I want to keep the networks separated from each other. Is this possible too?

Yes, you can still filter on member interfaces after they are added to a bridged.

In System > Advanced > System Tunables there are two tunes which control the filtering typ:

net.link.bridge.pfil_member
link.bridge.pfil_bridge

By default filtering on interface member is enabled.

JKnott

@lucderheld said in Same Networks in different VLANs:

Oh that’s easy: the subnets have different vlan tags.

Routers filter on address, not VLAN tag. A VLAN is no different than another interface in this respect. You're still back at the point of deciding which way to go when standing in front of the two apartment buildings.

JKnott

@lucderheld

You can have as many VLANs as you want. You can't have the same subnet on them, if you expect routing to work.

lucderheld

@jknott said in Same Networks in different VLANs:

@lucderheld said in Same Networks in different VLANs:

Oh that’s easy: the subnets have different vlan tags.

Routers filter on address, not VLAN tag. A VLAN is no different than another interface in this respect. You're still back at the point of deciding which way to go when standing in front of the two apartment buildings.

Hmm. Two different Interfaces and two different vlans. This should be somehow doable.

In your apartment example you would have two apartments with the same number in two different buildings.

If this is not possible at the moment hopefully someone will build it. Like QinQ is doing it with vlans.

lucderheld

@viragomann

Sounds interesting! I will give it a try, but for now start with different subnets. Thanks for your input.

JKnott

@lucderheld said in Same Networks in different VLANs:

Hmm. Two different Interfaces and two different vlans. This should be somehow doable.

There is no way pfSense or any other router can have the same subnet on more than one interface/VLAN. It just won't work!

dotdash

@jknott
Not pfSense, correct, but any enterprise router has support for multiple routing tables. With Cisco, you can group interfaces by VRF- each VRF has a separate routing table. As I mentioned before FreeBSD supports this, and a feature request to put support in pfSense was submitted and ignored years ago. For more information, see the man page https://www.freebsd.org/cgi/man.cgi?query=setfib&apropos=0&sektion=0&manpath=FreeBSD+12.3-stable&arch=default&format=html

johnpoz

@dotdash said in Same Networks in different VLANs:

but any enterprise router has support for multiple routing tables

Not sure I would say any ;) But sure most enterprise layer 3 switches or actual routers most likely do have support for VRF.. Those normally come with a pretty hefty price tag as well..

You could do it in TNSR I do believe

https://docs.netgate.com/tnsr/en/latest/routing/route-tables.html#virtual-routing-and-forwarding

Which is more their actual "enterprise" level product... While sure there are many enterprises using pfsense.. if your to the point where your needing to use VRFs.. Are you going to be running pfsense on some DIY box?

You could for sure have multiple networks with the same IP ranges in your network, you just can not currently route them on the same "router" VRF is a virtual router.. So its like running more than 1 router on the same hardware, etc.

You might be able accomplish what your after on the same hardware, by running different pfsenses as VMs on the hardware your wanting to use.

Where we use VRFs is for customer isolation, where we share hardware between customers in the DC, etc. Normally this hardware is pushing a lot of packets.. If was looking to replace one of those boxes it would most likely need to run TNSR just to be able to push the packets.

dotdash

@johnpoz
I don't have any need for multiple fibs in pfSense, and think the OP should just use different networks for the vlans. I was just replying the original statement that you can't have duplicate or overlapping networks on ANY router. I've dealt with VRFs mostly with Cisco gear, but I remember Extreme switches supported it and well as Juniper, etc. I'd make the argument that a router with multiple routing tables is just that and not actually several routers, so I stand by my original statement.

johnpoz

@dotdash said in Same Networks in different VLANs:

multiple routing tables is just that and not actually several routers

We could debate semantics I guess ;)

To "me" VRF is actual another router.. Since it is a whole set of new routing tables, and sure other interfaces.. Even if they are "virtual"

"Virtual routing and forwarding (VRF) is an IP-based computer network technology that enables the simultaneous co-existence of multiple virtual routers (VRs) as instances or virtual router instances (VRIs) within the same router."

think the OP should just use different networks for the vlans

We agree here ;)