Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to get pfSense WAN to accept VLAN 0

    General pfSense Questions
    25
    414
    165.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cucu007 @michaellacroix
      last edited by

      @michaellacroix

      Hi Michael, I dont have the VM capabilities at the moment...I am sort of focus in doing this natively. Great to hear that you have frontier, so we are in the same page.

      J 1 Reply Last reply Reply Quote 0
      • J
        Jarhead @cucu007
        last edited by

        @cucu007 The easiest thing to do is used a managed switch between the ONT and pfSense. It'll strip the vlan also.

        1 Reply Last reply Reply Quote 1
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Really we want two things to happen here. The e1000 driver needs to be fixed so it passes VLAN0 tagged packets. FreeBSD should probably be accepting priority tagged packets and not dropping them by default. Those two things would negate the need for a script at all on anything but AT&T.

          Steve

          1 Reply Last reply Reply Quote 1
          • c45p32C
            c45p32 @michaellacroix
            last edited by

            This post is deleted!
            1 Reply Last reply Reply Quote 0
            • c45p32C
              c45p32 @michaellacroix
              last edited by

              @michaellacroix This is the same error I was getting when I tried to upgrade to 22.05 as well on both igb0 and em0.

              1 Reply Last reply Reply Quote 0
              • J
                jalano @Cool_Corona
                last edited by

                @cool_corona said in How to get pfSense WAN to accept VLAN 0:

                Try to put pfsense into a VM and run VLAN tagging on the WAN interface using VLAN 0.

                Then see if it works.

                I'm trying to set this up right now - I have Proxmox running and have pfSense installed, but I do not see how to enable VLAN 0 on the WAN interface.

                In Proxmox, when I edit the VM pfSense is on and edit the WAN interface, there is a spot for VLAN tag that has the option of "no VLAN" which is the default, but if you put any number outside of 1-4094, the box turns red and refuses to accept it.

                Where do you put this configuration? It appears Proxmox thinks VLAN 0 is not a valid tag to put on the interface.

                stephenw10S 1 Reply Last reply Reply Quote 0
                • Bob.DigB
                  Bob.Dig LAYER 8
                  last edited by Bob.Dig

                  Hyper-V uses VLAN 0 for the parent interface as far as I know. I hope nothing will be broken there if pfSense changes its behavior in the future.

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator @jalano
                    last edited by

                    @jalano said in How to get pfSense WAN to accept VLAN 0:

                    I have Proxmox running and have pfSense installed, but I do not see how to enable VLAN 0 on the WAN interface.

                    To tag outbound?

                    Most of the issues here are that FreeBSD (and hence pfSense) does not accept VLAN0 as valid and drops the packets. Thus if your ISP sends dhcp responses to you tagged vlan0 pfSense never sees them and you never get an IP address.
                    To work around that a switch the strips the tags allows pfSense to see the traffic. The outbound traffic does not need to be tagged in most cases (AT&T being the exception).

                    Steve

                    J C 2 Replies Last reply Reply Quote 0
                    • J
                      jalano @stephenw10
                      last edited by

                      @stephenw10 said in How to get pfSense WAN to accept VLAN 0:

                      @jalano said in How to get pfSense WAN to accept VLAN 0:

                      I have Proxmox running and have pfSense installed, but I do not see how to enable VLAN 0 on the WAN interface.

                      To tag outbound?

                      Most of the issues here are that FreeBSD (and hence pfSense) does not accept VLAN0 as valid and drops the packets. Thus if your ISP sends dhcp responses to you tagged vlan0 pfSense never sees them and you never get an IP address.
                      To work around that a switch the strips the tags allows pfSense to see the traffic. The outbound traffic does not need to be tagged in most cases (AT&T being the exception).

                      Steve

                      Exactly what I'm trying to accomplish, but I don't see how in Proxmox I can simulate the switch "stripping the tags". Someone higher up posted that you can do this, presumably with some other software. So I'm unsure how to configure my virtual switch on Proxmox to do this so my pfSense VM can get the DHCP WAN address.

                      1 Reply Last reply Reply Quote 0
                      • J
                        jalano @Cool_Corona
                        last edited by

                        @cool_corona I'm trying to do this on Proxmox.

                        If I'm understanding you correctly, this means on the virtual bridge interface it's just setup as a "trunk" port which accepts tagged VLAN traffic (this is the physical port that's connected to the upstream Frontier device), and within the virtual machine configuration, set virtual ethernet device as an "access" port which is set to VLAN 0?

                        My only issue is that the Proxmox configuration won't let me pick anything lower than VLAN 1. Does VMWare ESXi let you choose VLAN 0?

                        1 Reply Last reply Reply Quote 0
                        • C
                          cucu007 @stephenw10
                          last edited by cucu007

                          @stephenw10 said in How to get pfSense WAN to accept VLAN 0:

                          @jalano said in How to get pfSense WAN to accept VLAN 0:

                          I have Proxmox running and have pfSense installed, but I do not see how to enable VLAN 0 on the WAN interface.

                          To tag outbound?

                          Most of the issues here are that FreeBSD (and hence pfSense) does not accept VLAN0 as valid and drops the packets. Thus if your ISP sends dhcp responses to you tagged vlan0 pfSense never sees them and you never get an IP address.
                          To work around that a switch the strips the tags allows pfSense to see the traffic. The outbound traffic does not need to be tagged in most cases (AT&T being the exception).

                          Steve

                          Steve,
                          I still find it hard to believe that neither the BSD community nor Netgate have found a work around (or permanent solution) for us (Frontier/ATT fiber) considering that other $20 routers are able to work just fine with the VLAN tag 0 issue. Do we know if the BSD pipeline has this issue reported somewhere and the developers are evaluting a permanent solution? For now I am stuck on 2.5.2 and it seems will be stuck here even after 2.7 release if this issue is not resolve. is it possible to set up a funding page for the developers to spend more time in resolving this problem from the netgate end? PLease advise.

                          1 Reply Last reply Reply Quote 0
                          • J
                            jalano
                            last edited by

                            I've been researching lots of possible solutions to this.

                            Here's what I'm at now, in case anyone stumbles across this thread in July of 2022!

                            • FreeBSD 13.1 now has a dhclient that is aware of the DHCPOFFER datagrams inside 802.1q-encapsulated frames with VLAN 0.
                            • OPNSense 22.7-RC1 is on FreeBSD 13.1.

                            In theory, when pfSense moves to FreeBSD 13.1 this problem should be fixed. According to this, it's been fixed this way on OPNSense:

                            https://github.com/opnsense/src/issues/114

                            C 1 Reply Last reply Reply Quote 1
                            • C
                              cucu007 @jalano
                              last edited by

                              @jalano said in How to get pfSense WAN to accept VLAN 0:

                              I've been researching lots of possible solutions to this.

                              Here's what I'm at now, in case anyone stumbles across this thread in July of 2022!

                              • FreeBSD 13.1 now has a dhclient that is aware of the DHCPOFFER datagrams inside 802.1q-encapsulated frames with VLAN 0.
                              • OPNSense 22.7-RC1 is on FreeBSD 13.1.

                              In theory, when pfSense moves to FreeBSD 13.1 this problem should be fixed. According to this, it's been fixed this way on OPNSense:

                              https://github.com/opnsense/src/issues/114

                              Well this is certainly an update and it seems someone is looking into this issue from the BSD end. Jalono have you been able to validate this working on OPNsense yet? Please advise.

                              J 1 Reply Last reply Reply Quote 0
                              • J
                                jalano @cucu007
                                last edited by

                                @cucu007 said in How to get pfSense WAN to accept VLAN 0:

                                @jalano said in How to get pfSense WAN to accept VLAN 0:

                                I've been researching lots of possible solutions to this.

                                Here's what I'm at now, in case anyone stumbles across this thread in July of 2022!

                                • FreeBSD 13.1 now has a dhclient that is aware of the DHCPOFFER datagrams inside 802.1q-encapsulated frames with VLAN 0.
                                • OPNSense 22.7-RC1 is on FreeBSD 13.1.

                                In theory, when pfSense moves to FreeBSD 13.1 this problem should be fixed. According to this, it's been fixed this way on OPNSense:

                                https://github.com/opnsense/src/issues/114

                                Well this is certainly an update and it seems someone is looking into this issue from the BSD end. Jalono have you been able to validate this working on OPNsense yet? Please advise.

                                I have not been able to test this - I need to get another bit of gear to install OPNsense on. I'm currently running an SG-1100 with 2.4.5p1.

                                Looking at OPNsense 22.7 it appears I will have a lot of work to do to convert the config file or will have to spend some time hand-entering the configuration, which I'm not looking forward to; it's quite different from pfSense now. I was hoping to have found a good solution that would allow me to keep using my pfSense hardware.

                                C 1 Reply Last reply Reply Quote 0
                                • C
                                  cucu007 @jalano
                                  last edited by

                                  @jalano said in How to get pfSense WAN to accept VLAN 0:

                                  @cucu007 said in How to get pfSense WAN to accept VLAN 0:

                                  @jalano said in How to get pfSense WAN to accept VLAN 0:

                                  I've been researching lots of possible solutions to this.

                                  Here's what I'm at now, in case anyone stumbles across this thread in July of 2022!

                                  • FreeBSD 13.1 now has a dhclient that is aware of the DHCPOFFER datagrams inside 802.1q-encapsulated frames with VLAN 0.
                                  • OPNSense 22.7-RC1 is on FreeBSD 13.1.

                                  In theory, when pfSense moves to FreeBSD 13.1 this problem should be fixed. According to this, it's been fixed this way on OPNSense:

                                  https://github.com/opnsense/src/issues/114

                                  Well this is certainly an update and it seems someone is looking into this issue from the BSD end. Jalono have you been able to validate this working on OPNsense yet? Please advise.

                                  I have not been able to test this - I need to get another bit of gear to install OPNsense on. I'm currently running an SG-1100 with 2.4.5p1.

                                  Looking at OPNsense 22.7 it appears I will have a lot of work to do to convert the config file or will have to spend some time hand-entering the configuration, which I'm not looking forward to; it's quite different from pfSense now. I was hoping to have found a good solution that would allow me to keep using my pfSense hardware.

                                  According tot he pfsense release notes, it seems the 2.7 upcoming version will be base on 12.3 and not 13.x, this might mean we will be stuck even with this issue after code 2.7 gets to GA. Unless someone backports some kind of workaround for the 2.7 code to work with the VLA 0 issue at hand. Looking forward to get this issue resolve once and for all.

                                  Reference: https://docs.netgate.com/pfsense/en/latest/releases/versions.html

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    It's based on 12.3 now but that doesn't mean it will be.

                                    The dhclient accepting vlan0 tagged packets doesn't address the fact that igb/em doesn't pass the packets to it. Otherwise the netgraph workaround would still work in 2.6.

                                    AT&T is whole different problem. That's very unlikely to ever be supported natively.

                                    Steve

                                    C 1 Reply Last reply Reply Quote 0
                                    • C
                                      cucu007 @stephenw10
                                      last edited by

                                      @stephenw10

                                      Steve,
                                      I would be happy if we can at least get this working for frontier.

                                      M 1 Reply Last reply Reply Quote 0
                                      • M
                                        michaellacroix @cucu007
                                        last edited by

                                        @cucu007

                                        I just loaded some old hardware with current version of opnsense and it works like a charm. No netgraph script necessary. The interface drivers were re0 and em0. DO YOU HEAR THAT NETGATE!
                                        I have frontier fiber.

                                        C bmeeksB stephenw10S 3 Replies Last reply Reply Quote 0
                                        • C
                                          cucu007 @michaellacroix
                                          last edited by

                                          @michaellacroix said in How to get pfSense WAN to accept VLAN 0:

                                          @cucu007

                                          I just loaded some old hardware with current version of opnsense and it works like a charm. No netgraph script necessary. The interface drivers were re0 and em0. DO YOU HEAR THAT NETGATE!
                                          I have frontier fiber.

                                          Michael,
                                          I think the big challenge for PFS is actually the intel NICs (igb/em) as previously mentioned by steve

                                          Steve,
                                          Please correct me if I am wrong...

                                          M 1 Reply Last reply Reply Quote 0
                                          • bmeeksB
                                            bmeeks @michaellacroix
                                            last edited by bmeeks

                                            @michaellacroix said in How to get pfSense WAN to accept VLAN 0:

                                            @cucu007

                                            I just loaded some old hardware with current version of opnsense and it works like a charm. No netgraph script necessary. The interface drivers were re0 and em0. DO YOU HEAR THAT NETGATE!
                                            I have frontier fiber.

                                            Just for clarification if others read this thread:

                                            OPNsense is currently based on FreeBSD 13 while pfSense is using 12.3-STABLE. The OPNsense team had a number of growing pains with that move to FreeBSD 13. They continue to still have a few. There seems to be quite a few changes around VLANs in particular with FreeBSD 13.

                                            So a willy-nilly jump to FreeBSD 13 may result in more bugs than fixes. The pfSense team will get there for sure, but they tend to be a bit more deliberate when making FreeBSD major version moves. If I recall the timeline correctly, the OPNsense team abandoned Hardened FreeBSD (11, I think) and jumped over to FreeBSD 13.

                                            There are differences in the NIC drivers as you change among the FreeBSD versions.

                                            C 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post