pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue

stephenw10

Wow. Boom!

20:30:18.349238 00:51:82:11:22:02 > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 68: vlan 0, p 0, ethertype 802.1Q, vlan 1001, p 0, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.101.0.1 tell 10.101.0.12, length 46

That's crazy! Time to dig deeper...

johnpoz

@stephenw10 so you were able to duplicate it then?

stephenw10

Yup. Bizarre. I would have sworn it wasn't real but...

johnpoz

@stephenw10 well guess you got a new "toy" to play with then - figuring out.. Can't wait to hear what you discover on what/how/why this happens..

So does this happen on other then ix nics? Could I remove the vlanhw setting on say an interface on my sg4860 and see this happening with vlan0? I assume you have already tried that?

stephenw10

Not yet, feel free
The same patch or something close to it went into all the Intel drivers so...possibly. Though it seems unlikely no-one would have hit it in igb.

Edit: igb in current 2.7 snapshots appears unaffected.

https://redmine.pfsense.org/issues/13381

NRgia

@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:

Not yet, feel free
The same patch or something close to it went into all the Intel drivers so...possibly. Though it seems unlikely no-one would have hit it in igb.

Edit: igb in current 2.7 snapshots appears unaffected.

https://redmine.pfsense.org/issues/13381

Wow, I'm glad that this ended up with a defect. It took a while :) Do you think this is something that can be fixed by Netgate or we should wait for an upstream fix?

stephenw10

Almost certainly upstream. Need to confirm it still exists in FreeBSD head first though.

NRgia

@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:

Almost certainly upstream. Need to confirm it still exists in FreeBSD head first though.

Thanks again for the support, let's hope it will not take 5 years :) . Yes I know, it's out of your hands.

stephenw10

Mmm, this is the most interesting issue I've seen in a while!

You need to disable vlan hardware tagging for Suricata to be able to see the traffic? Is that is you run Suricata on the parent NIC only?

NRgia

@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:

Mmm, this is the most interesting issue I've seen in a while!

You need to disable vlan hardware tagging for Suricata to be able to see the traffic? Is that is you run Suricata on the parent NIC only?

Exactly, I'll try to explain better.
For 22.01 I found a workaround in order for the Suricata package to not break VLAN traffic.

For that I disabled the vlanhwtag.

If I left vlanhwtag enabled, only traffic from the parrent interface will pass.

Suricata is enabled only on the parent interface, as @bmeeks recommends.

On 22.05 I cannot apply the same workaround anymore, due to, when I disable vlanhwtag, that VLAN0 will appear and VLANs traffic will cease, even with Suricata uninstalled.

NRgia

@stephenw10
I saw you commented on this defect
https://redmine.pfsense.org/issues/13381

that you tested on FreeBSD 14

The behavior is the same?

stephenw10

It is the same in FreeBSD 14 snapshots yes. We are looking at the best way to handle it.

NRgia

@stephenw10
Was this https://reviews.freebsd.org/D36139
rejected and closed or rejected and closed ?
Just wanted to make sure it wasn't rejected and closed.
Thank you

rcoleman-netgate

@nrgia Our redmine is still open and active.

stephenw10

The fix was committed upstream:
https://github.com/freebsd/freebsd-src/commit/e7abb897018be34f039ad957562fdc2f38aa3562

I updated the redmine ticket.

Steve

NRgia

Thank you @stephenw10 and @rcoleman-netgate

timecode

@stephenw10 I have found this thread and it may actually solve my problems. Using an ix interface to my network, I cannot use vlan tagged networks via my Orbi Pro units - they just fall over - I thought it was them but it may actually be pf and the issues laid out in this thread. Are you able to advise where I can add this change so I can test it? Which file to edit?

stephenw10

It's not a file you can edit at run time. That's a change to the ix driver that is compiled.

Are you also disabling hardware VLAN tagging on the interface?
Does it work correctly if you don't?

Steve

timecode

@stephenw10 Hi Steve, I just changed my router to another unit that does not have ix interface and was running 22.01 and the issue remains so I don't think that this was the issue in my case :( ... i was hopeful for a second.

stephenw10

You should start your own thread with the details then.

Steve