Help setting up the internal switch!
-
@rcoleman-netgate
Here is my current setup, not hard to guess...
-
Ok, so there are some conflicting details here. You currently have LAN as untagged and then two VLANs on that; 20 and 2100. But above you are asking about VLANs 10, 20 and 200?
Also you refer to port 0 and 1 above but the 2100 has 4 LAN ports labelled LAN1-4. Those are the switch ports 1-4, port 5 is the internal port that links to mvneta1.
So you have two switches connected to LAN1 and LAN2 currently. Do you need all the VLANs to be available at both switches?
I was assuming you have configured those switches for the existing VLANs but perhaps you are just configuring VLANs on the clients directly?
Steve
-
@stephenw10 I know I have mixed up the ports number earlier.
And my VLAN numbers... as well. ashamedTo be crystal clear:
I want a base LAN 10.1.1.0/24 (If needed... a rest from my Unifi router setup)
Server VLAN 11 10.11.1.0/24
Client VLAN 22 10.22.1.0/24
Guest VLAN 172 172.16.1.0/24
DMZ LAN? VLAN? Suggestion pls.All should have internet.
11 and 22 should have to restrictions between them.
172 should only have internet, nothing else.LAN1 VLAN 1, 22 and 172
LAN2 VLAN 1, 11PS. I have never been able to create VLAN 100, it just doesn't work with that VLAN. I used to have client VLAN 100 with 10.100.1.0/24. But had to change due to this (bug?). DS.
-
Hmm, there's no reason VLAN 100 shouldn't work. I have seen others use that many times, 100, 200, 300 etc is quite a common numbering scheme.
Ok, so currently the switch is in port VLAN mode which means it just passes all traffic to all ports so VLANs 20 and 2100 are available everywhere. Which mean your two switches could be using them. Are they both configured to use those VLANs? You would have to reconfigure them to use these new VLANs if so. Assuming you need them.
Steve
-
@stephenw10 Yes the switch is today in port VLAN mode and all VLANs are available on all ports.
So what I want to do is to send VLANs 1,22 and 172 via port LAN1.
And VLANs 11 LAN2.
And DMZ on LAN3 (I discovered that I had forgot it in an earlier post). -
J jimp moved this topic from General pfSense Questions on
-
Ok, so to do that you will need:
I choose VLAN 1000 to use for DMZ but you could use anything there. Since that's untagged on port 3 you also need to set:
Port 4 is unused in that setup.
Those VLANs are tagged out of ports 1 and 2 so the switches connected to them will need to be configured for that. It sounds like they already are though.
Steve
-
@stephenw10 Thank you! :)
A question though.... on the VLAN(s) table part.
Thee two panels are the ones that I just cant grasp.
Ports 1-5 is physically LAN1-4 and 5 as uplink. That is the easy part.Now over to the strange part... VLANs.
VLAN Group 0, is that LAN1 (1) and LAN1 and LAN-Uplink (LAN5) as members?
And the group 1, is VLAN11 and LAN2, LAN5, that means that VLAN 11 should be on port 2 and 5, that is also the internet "connection" between them?Am I getting this right?
-
Yes. The VLAN group number is just the number in the list, the order there is of no significance.
So, yes, group 0, which is VLAN ID 1 (packets tagged as VLAN1) has member ports 1 and 5. Both are untagged.
That means that if the switch has has a packet that is tagged 1 it can will send it out of ports 1 and 5 and it will untag it as it leave the port.
VLAN1 is special. Most switches use this as the default internal tag and you should not not use VLAN1 externally if you can possibly avoid it:
https://docs.netgate.com/pfsense/en/latest/vlan/security.html#using-the-default-vlan1On the ports tab you will see that all ports except 3 are set to use 1 as the Port VLAN ID. That means that untagged traffic arriving at that port from outside the switch is tagged as 1 as it enters. Inside the switch all packets are tagged with something in 802.1q mode.
Thus if you ping something on the LAN subnet from pfSense itself a packet leaves the LAN interface untagged since that isn't a VLAN (mvneta1). It enters the switch via port 5 which is internally connected directly with mvneta1. It's untagged so the switch applies the PVID and tags it 1. The switch then sees the only other port that is a member of VLAN1 is port so it sends it out of port 1. Because it's an untagged member it strips the tag as it leaves the port so the packet arrives at whatever is connected to port 1 as untagged.
For group 1, VLAN11, both member ports are tagged. That means the switch will send packet out of those ports without stripping the tags. It also means it will accept packets arriving on those ports that at tagged VLAN11.
Since there are no untagged members of VLAN11 we do not have to set a PVID. We are only dealing tagged traffic.For group 4, VLAN1000 DMZ, we have tagged and untagged members. Traffic arrives on the port 5 tagged, from a pfSense VLAN interface, and is send out of port 3 with the tags stripped. That means you can connect a client directly to port 3 and it doesn't have to know anything about the VLAN. But in order for replies to work we have to set the PVID on port 3 as 1000. That way the untagged replies from a client will be tagged only VLAN 1000 and correctly send back to the VLAN1000 interface in pfSense.
Steve
-
@stephenw10 Thank you once again, one more drop to finally break the wall...
It this tagged non-tagged traffic that messes this up for me.
I will need to read you post a few times before I can say if it helped me or not.One question though VLAN1, I am not gonna use it in any way, but also I do not need to care about it? Setting up a DHCP and what not for it?
-
VLAN1 is only tagged as that inside the switch. It's untagged on the internal uplink port which means in pfSense that's the mvneta1 NIC directly. Currently you have that assigned as LAN so it will have DHCP enabled and firewall rules etc by default.
Stebe
-
@stephenw10 Ah good to know.
I am reading up on the thing that messes up my understanding, tagging.
So for me it got easier if I write like this: t2 t5 instead of 2t 5t.
No idea why it just makes it easier for me.Also... one more thing.
When I do this switch (haha) will the interface assignment panel look different?
Do I just follow the Ports panel? Thus LAN1 to Server switch, LAN2 to Client Switch and so on and so forth? -
On the Interfaces > Switch config will look different.
The rest of pfSense still sees the same assigned interfaces.
One thing to note here is that, if you can, you should try to be connected to the firewall from the WAN side when making these changes. It's really easy to lock yourself out if you're connected via the switch that you are reconfiguring.
Steve
-
@stephenw10 said in Help setting up the internal switch!:
It's really easy to lock yourself out if you're connected via the switch that you are reconfiguring.
Oh that I have done so many times. :)
That is why I have asked a Netgate reseller to help me with this, he has accepted. The family will not accept any down time what so ever. -
This post is deleted! -
So time has passed, life have seen to it that I have had no time, what so ever, to even think about doing this. So this have been nuddling in my brain and last night I sat down a wrote down my coming setup, all I want here is an reality/sanity check. It feels and looks right, the only part I am even remotely hesitant about is the Guest network atm.
VLANs: 10 Server VLAN 20 Client VLAN 555 Guest VLAN 666 DMZ VLAN Ports: 1 | 1 2 | 1 3 | 555 4 | 666 5 | 1 LAN Uplink VLANs VLAN-Tag Members 1 1,5 10 2t,5t 20 1t,5t 555 4,5t 666 3,5t -
That will work. Assuming you have switches connected to ports 1 and 2 that are configured for VLANs 20 and 10.
You might want to add VLAN1 as an untagged member or port 2 if the switch connected there needs access to it. But you don't have to.Steve
-
@stephenw10 I have switches set to accept all VLANs atm, so that should not be an issue, the servers will change ip-numbers all of them, but most of them do have a static IP set inside pfSense, a bit of work but not to much. And I will need to to rebuild the guest network but that is next to nothing. And I will have read up on how to handle VLANs inside a Unifi network a bit more.
Thank you for all the help @stephenw10 !
-
Yeah, by 'switches configured for vlans' I mean, for exmaple:
The switch connected to port 1 needs to be configured for VLAN 20 as tagged (trunked) on the port connected to the 2100 and untagged on some other ports, wherever you are connecting hosts that should be on VLAN 20.Steve
-
@stephenw10 I missed that in my post earlier they are all set to trunk. I will need to rethink my Unifi setup after the firewall/switch is reconfigured. :) I do also need to redo the placing of my APs to make me wifi better and to reach everywhere in full speed. But that not for you to help me with. :)
