Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to get pfSense WAN to accept VLAN 0

    Scheduled Pinned Locked Moved General pfSense Questions
    414 Posts 25 Posters 212.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cucu007 @stephenw10
      last edited by

      @stephenw10 Have we made any additional progress on getting this issue fix permanently for those of us using Fiber (AT&T and Frontier)?

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        No. One of our staff uses pfatt and he tested it in a 2.7 snapshot but hit other issues trying to run the script there. The way netgraph handles opening connections changed.
        The script here though doesn't require any of auth stuff that pfatt does, it only creates VLAN0 tagged traffic so may work, I haven't heard either way.

        A better solution there would be to just add priority tagging to FreeBSD. That's not immediately straight forward though because of the security implications.

        In order to upstream something like that we would need clear evidence of a real world use case so the more people who can add their names to the open bug report for this the better.

        https://redmine.pfsense.org/issues/12070

        Steve

        1 Reply Last reply Reply Quote 0
        • Cool_CoronaC
          Cool_Corona
          last edited by

          Try to put pfsense into a VM and run VLAN tagging on the WAN interface using VLAN 0.

          Then see if it works.

          J 1 Reply Last reply Reply Quote 0
          • c45p32C
            c45p32 @stephenw10
            last edited by c45p32

            @stephenw10 I can confirm it doesn't work in 2.7 on both igb0 and em0.

            I did a clean install to 2.5.2 confirmed everything was working and then upgrade to 2.7.0. (Note: After the upgrade, it asked me for my default WAN and LAN again which were already set to igb0 and em0.)

            Received the following error on both when running the vlanzero script:
            ===group

            Fatal error: Uncaught Error: Call to undefined function pfSense_ngctl_attach() in Command line code:1
            Stack trace:
            #0 {main}
              thrown in Command line code on line 1
            ===
            C 1 Reply Last reply Reply Quote 1
            • C
              cucu007 @c45p32
              last edited by

              @c45p32 said in How to get pfSense WAN to accept VLAN 0:

              @stephenw10 I can confirm it doesn't work in 2.7 on both igb0 and em0.

              I did a clean install to 2.5.2 confirmed everything was working and then upgrade to 2.7.0. (Note: After the upgrade, it asked me for my default WAN and LAN again which were already set to igb0 and em0.)

              Received the following error on both when running the vlanzero script:
              ===group

              Fatal error: Uncaught Error: Call to undefined function pfSense_ngctl_attach() in Command line code:1
              Stack trace:
              #0 {main}
                thrown in Command line code on line 1
              ===
              

              I am stuck on 2.5.2 for now until this is sorted out by the pfsense crew.

              I hope we get some pfsense developer to work on this prior to 2.7 release. I miss working under 2.6 and would hate to go back to work under openwrt, pfsense is my favorite FW.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                There is no longer any need to attach the interfaces like that. You should be able to just remove or comment out these lines from the script:

                    echo -n "$(getTimestamp) attaching interfaces to ng_ether... "
                    /usr/local/bin/php -r "pfSense_ngctl_attach('.', '$ONT_IF');"
                    echo "OK!"
                

                See: https://github.com/MonkWho/pfatt/pull/73/commits/015a8cf91340699fc18f1f54eeef3160e8c2ee9e

                Steve

                c45p32C M 2 Replies Last reply Reply Quote 0
                • c45p32C
                  c45p32 @stephenw10
                  last edited by

                  @stephenw10 I removed those lines, and I'm not getting the errors anymore. But I don't have any internet.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    But the script appears to run though and the netgraph interfaces are created?

                    Are you able to see any and tagged (or untagged) traffic in a pcap on the parent NIC?

                    Steve

                    C 1 Reply Last reply Reply Quote 0
                    • C
                      cucu007 @stephenw10
                      last edited by

                      @stephenw10

                      Hi Steve,
                      Did we make any progress last week on resolving this issue for 2.6 and perhaps 2.7?

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Not beyond what's shown here. The script need to be altered to remove the nfctl_attach lines since they are no longer needed. We have one report that it doesn't work still but no packet captures that might show why.

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          cucu007 @stephenw10
                          last edited by cucu007

                          @stephenw10

                          Its hard to think that many of us are still dealing with this nighmare of accepting traffic tagged on VLAN 0 at the WAN interface.

                          Can we please get some traction this item? My $20 bucks router from walmart is able to work just fine, how is it possible that this expensive piece of equipment is not able to get this working under release 2.6.x or 2.7.x, many of us were able to get this working using some hacky way under 2.5.2. Please lets figure this out.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            There are workarounds. It depends what your ISP actually requires.

                            If they are sending priority tagged replies to dhcp requests you can just use a switch to strip those tags.

                            If you need to send and receive priority tagged traffic then you still need the netgraph script to do that and something in the iflib based Intel drivers has broken that. So you ca try using the non-iflib driver or use a different NIC.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • M
                              michaellacroix @stephenw10
                              last edited by

                              Thanks @stephenw10

                              This post saved my bacon. I have frontier fiber and need the script to obtain an IP on the wan interface due to the vlan 0 issue. When I upgraded I got the same error messages as above and this fixed it for me.

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Just commenting out the lines from the script?
                                Can I assume you are using a NIC other an Intel e1000 device? Other NICs should work with that.

                                Steve

                                M 1 Reply Last reply Reply Quote 0
                                • M
                                  michaellacroix @stephenw10
                                  last edited by

                                  @stephenw10

                                  yep, just commenting out the lines worked for me. Yes, my nic is not e1000 device. The script broke upgrading from 22.01 to 22.05

                                  Upgrading form 2.6.0 was no problem
                                  Upgrading to pfsense 22.01 no problem
                                  Upgrading from 22.01 to 22.05 the script broke with the error message:

                                  Fatal error: Uncaught Error: Call to undefined function pfSense_ngctl_attach() in Command line code:1
                                  Stack trace:
                                  #0 {main}
                                  thrown in Command line code on line 1

                                  C c45p32C 3 Replies Last reply Reply Quote 1
                                  • C
                                    cucu007 @michaellacroix
                                    last edited by

                                    @michaellacroix

                                    I am using e1000 NICs, are there any solution for those of us or we are to remain in the dark?

                                    M 1 Reply Last reply Reply Quote 0
                                    • M
                                      michaellacroix @cucu007
                                      last edited by

                                      @cucu007

                                      I wouldn't hold your breathe. Technically its a freebsd shortcoming and pfsense should address it. Negate is basically saying they can do without all the att, verizon, frontier, and all other ISP's that use the vlan zero tag. What a shame. Theirs only a small group of users in this predicament who are technically efficient enough to implement these scripts and changes.

                                      C 1 Reply Last reply Reply Quote 0
                                      • C
                                        cucu007 @michaellacroix
                                        last edited by

                                        @michaellacroix

                                        This is very sad to hear considering that a $30 walmart router can work just fine with the VLAN 0 from frontier. I also tested using openwrt and those are working fine, but pfsense has been my favorite FW and I would dearly miss it to replace it with something else. I am optimistic Stephen and the team can get something going for those of us using e1000 NICs.

                                        M 1 Reply Last reply Reply Quote 0
                                        • M
                                          michaellacroix @cucu007
                                          last edited by

                                          @cucu007

                                          yep, i moved on to different hardware..

                                          C 1 Reply Last reply Reply Quote 0
                                          • C
                                            cucu007 @michaellacroix
                                            last edited by

                                            @michaellacroix What hardware you using now?

                                            M 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.