How to get pfSense WAN to accept VLAN 0

[stephenw10]

Yeah, the situation is unclear because we have reports here and in other threads that conflict with test results. What I can say is that testing is much easier in main because you can just set a priority tag on any interface using ifconfig directly:

[2.7.0-DEVELOPMENT][admin@m470-2.stevew.lan]/root: ifconfig igb12 pcp 4
[2.7.0-DEVELOPMENT][admin@m470-2.stevew.lan]/root: ifconfig igb12
igb12: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	description: PCP0
	options=4e100bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,VLAN_HWFILTER,RXCSUM_IPV6,TXCSUM_IPV6,NOMAP>
	ether 00:90:7f:db:ca:b2
	pcp 4
	inet6 fe80::290:7fff:fedb:cab2%igb12 prefixlen 64 scopeid 0xd
	inet 10.13.0.1 netmask 0xffffff00 broadcast 10.13.0.255
	media: Ethernet autoselect
	status: no carrier
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

And then you will see:

23:16:10.138805 00:90:7f:db:ca:b2 > 00:90:7f:87:dc:7a, ethertype 802.1Q (0x8100), length 102: vlan 0, p 4, ethertype IPv4, (tos 0x0, ttl 64, id 53358, offset 0, flags [none], proto ICMP (1), length 84)
    10.13.0.1 > 10.13.0.2: ICMP echo request, id 59732, seq 0, length 64

However the em NIC I'm sending that to, also under 2.7-dev (main) does not see that packet at all.
Testing against a different NIC type though, fxp here, the traffic is seen and we see responses:

23:20:18.274026 00:90:7f:db:ca:b2 > 00:90:7f:87:dc:74, ethertype 802.1Q (0x8100), length 102: vlan 0, p 4, ethertype IPv4, (tos 0x0, ttl 64, id 26894, offset 0, flags [none], proto ICMP (1), length 84)
    10.13.0.1 > 10.13.0.2: ICMP echo request, id 60464, seq 0, length 64
23:20:18.274140 00:90:7f:87:dc:74 > 00:90:7f:db:ca:b2, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 36849, offset 0, flags [none], proto ICMP (1), length 84)
    10.13.0.2 > 10.13.0.1: ICMP echo reply, id 60464, seq 0, length 64

The confusing thing though is that that also works when testing against an igc NIC in 22.05 and my understanding was that it should not....

[michaellacroix]

@stephenw10

Thanks Stephen, thats good to know.

[Jarhead]

@stephenw10
Is there any chance vlan0 can be fixed in 2.6 with tunable??
Reason I'm asking is my brother uses pfSense also, and he does not have a problem getting an address from Frontier. My router at his house does not get an address because of vlan0.
I had him give me his config and I'm gonna try to put it on the same hardware he uses to see if it works at my house but I can't imagine it's that easy.
Just a fluke maybe?

[stephenw10]

I'm not aware of any tunable that would do it. What driver is that? Did you try 22.05 there? Or are you able to?

[Jarhead]

@stephenw10
I didn't.
He's using 2.6 as am I and I can't understand why he's not effected by vlan0.

[michaellacroix]

@jarhead Is her using pfsense as a VM? The software switch strip out the vlan tag

[Jarhead]

@michaellacroix
Nope. Protectli vault.
I have the same hardware for my test router.
His works, mine doesn't.

Might try his config on my protectli this weekend just to see if it'll work at my house.

[michaellacroix]

@jarhead Let us know your findings.

[michaellacroix]

@jarhead I wonder if frontier is making changes so their fiber offerings are compatible to all third party products.

[stephenw10]

Hmm, that's weird. Were you able to confirm they are actually using VLAN0 there?

[Jarhead]

@stephenw10
Yes. Plus, if they weren't, my router would have worked also.

[stephenw10]

Yeah, it would just be easy to think you are hitting that because you expect to.
I know of no reason why two nearly identical devices would behave differently.
Different NIC firmware maybe?

[michaellacroix]

@stephenw10

Hi Stephen, can you verify 22.11 that is scheduled for November of this year will be using freebsd 14 or main (as it is)?
Thanks

[stephenw10]

That is certainly the intention. You can never be 100% sure but I'd be very surprised if it wasn't at this point.

Steve

[c45p32]

I loaded dev snapshot this morning onto my back-up router em0 and wasn't able to connect on VLAN0. I don't have a way to test igb0 without taking my main router down.

[michaellacroix]

@c45p32 I will be using my test pc this afternoon and it has the em0 driver also. I'll let you know my results also.

[stephenw10]

In my testing here neither igb or em appear to pass vlan0 tagged traffic. It doesn't appear in a pcap.
But other drivers do and pfSense will accept and respond to that without netgraph.

So as I understand it the script does work in Opnsense / FreeBSD 13.1?
Can someone confirm that?

If so it's either a regression in 14 or they have patched it themselves. Or they are using the kmod non-iflib driver.

Steve

[Jarhead]

@stephenw10 Opnsense works with em and vlan0.

[Schwiing]

@jarhead Hasn't Opnsense not had this problem at all (natively working with VLAN0)?

[Jarhead]

@schwiing Just since moving to FreeBSD 13. Had the same issue before 13 though, ie not accepting vlan0.