pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue
-
Mmm, this is the most interesting issue I've seen in a while!
You need to disable vlan hardware tagging for Suricata to be able to see the traffic? Is that is you run Suricata on the parent NIC only?
-
@stephenw10 said in pfSense 22.05 breaks VLANS, restoring pfSense 22.01 fixes the issue:
Mmm, this is the most interesting issue I've seen in a while!
You need to disable vlan hardware tagging for Suricata to be able to see the traffic? Is that is you run Suricata on the parent NIC only?
Exactly, I'll try to explain better.
For 22.01 I found a workaround in order for the Suricata package to not break VLAN traffic.For that I disabled the vlanhwtag.
If I left vlanhwtag enabled, only traffic from the parrent interface will pass.
Suricata is enabled only on the parent interface, as @bmeeks recommends.
On 22.05 I cannot apply the same workaround anymore, due to, when I disable vlanhwtag, that VLAN0 will appear and VLANs traffic will cease, even with Suricata uninstalled.
-
@stephenw10
I saw you commented on this defect
https://redmine.pfsense.org/issues/13381that you tested on FreeBSD 14
The behavior is the same?
-
It is the same in FreeBSD 14 snapshots yes. We are looking at the best way to handle it.
-
@stephenw10
Was this https://reviews.freebsd.org/D36139
rejected and closed or rejected and closed ?
Just wanted to make sure it wasn't rejected and closed.
Thank you -
@nrgia Our redmine is still open and active.
-
The fix was committed upstream:
https://github.com/freebsd/freebsd-src/commit/e7abb897018be34f039ad957562fdc2f38aa3562I updated the redmine ticket.
Steve
-
Thank you @stephenw10 and @rcoleman-netgate
-
@stephenw10 I have found this thread and it may actually solve my problems. Using an ix interface to my network, I cannot use vlan tagged networks via my Orbi Pro units - they just fall over - I thought it was them but it may actually be pf and the issues laid out in this thread. Are you able to advise where I can add this change so I can test it? Which file to edit?
-
It's not a file you can edit at run time. That's a change to the ix driver that is compiled.
Are you also disabling hardware VLAN tagging on the interface?
Does it work correctly if you don't?Steve
-
@stephenw10 Hi Steve, I just changed my router to another unit that does not have ix interface and was running 22.01 and the issue remains so I don't think that this was the issue in my case :( ... i was hopeful for a second.
-
You should start your own thread with the details then.
Steve
