Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to get pfSense WAN to accept VLAN 0

    Scheduled Pinned Locked Moved General pfSense Questions
    415 Posts 26 Posters 238.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • c45p32C
      c45p32 @stephenw10
      last edited by

      @stephenw10 Well holy crap batman, that worked. With all default settings:
      Hardware Checksum Offloading: enable
      Disable hardware TCP segmentation offload: disabled
      Disable hardware large receive offload: disabled
      and just setting ifconfig em0 -vlanhwfilter I was able to pull an IP address and surf the internet.

      J 1 Reply Last reply Reply Quote 1
      • J
        Jarhead @c45p32
        last edited by

        @c45p32
        Are you saying this works on 2.6?

        1 Reply Last reply Reply Quote 0
        • c45p32C
          c45p32 @c45p32
          last edited by

          @jarhead No, I couldn't get it to work on 2.6.0 (22.05) with only the driver and no script on igb0. My testing above was done on my back-up router with em0 and the lastest dev 2.7

          You can get 2.6.0 (22.05) to work with the following instructions:
          I've also attached my actual script that I keep in /root and I create a earlyshellcmd that points to /root/./vlanzero.sh
          vlanzero.zip

          1. Use this post (https://github.com/MonkWho/pfatt/issues/67#issuecomment-1043358822) to install the driver for igb0.
          2. Reboot
          3. Download vlan script from here: [vlanzero.sh.tar.gz] (https://forum.netgate.com/assets/uploads/files/1614644825333-vlanzero.sh.tar.gz) and unzip it.
          4. Edit vlanzero.sh and change ONT_IF='xx0' to your WAN assignment, usually igb0. You can find this under Interfaces > Assignments
          5. In the same file change ONT_ETHER_ADDR='xx:xx:xx:xx:xx:xx' to your mac address for your WAN. You can usually see this under Status > Interfaces Under the WAN interface heading. Save and close the file.
          6. Goto Diagnostics > Command Prompt and Upload the vlanzero.sh file you just edited.
          7. ssh into pfSense
          8. type the following commands:
            mv /tmp/vlanzero.sh /root/vlanzero.sh
            chmod +x vlanzero.sh
            ./vlanzero.sh
          9. Go to Interface > Assignments and change your WAN to ngeth0 click save and apply
          10. Make sure you have the package shellcmd installed. Go to Services > Shellcmd
          11. Click "Add" for Command put "/root/./vlanzero.sh" without quotes, shellcmd type set it to "earlyshellcmd", and then name it what ever you want. Save
          12. Reboot and you should be working.

          Note you need to either release your IP using the Frontier box, or just unplug your ONT for a few min. I usually just unplug easier.

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Yeah, it won't work in 2.6/22.05 because it doesn't have the vlan0 bpf patch for dhclient. 2.7/22.11 does.

            J 1 Reply Last reply Reply Quote 0
            • J
              Jarhead @stephenw10
              last edited by

              @stephenw10
              So Shouldn't 2.7 "just work" without needing to do anything?

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                It would for any NIC except an e1000. At least any that I've tested.
                For em/igb you need to disable vlan_hwfilter. Currently.

                Steve

                1 Reply Last reply Reply Quote 1
                • M
                  michaellacroix @stephenw10
                  last edited by

                  @stephenw10

                  Great find!

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    What would confirm that as the source of confusion would be if the cases where two seemingly identical boxes had different behaviour actually had different NIC chips and only one supported vlan_hwfilter.

                    Steve

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      michaellacroix @stephenw10
                      last edited by

                      @stephenw10

                      Hi Stephen, does netgate make any type of release notes for the daily snapshots? As they move along I'm curious as to what issues were addressed. Thanks

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Not beyond the commit logs in github. At least not publicly:
                        https://github.com/pfsense/pfsense/commits/master

                        Steve

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          Schwiing @stephenw10
                          last edited by

                          Just got Frontier Fiber installed today (2Gig Service). Hooked the FRX523 to my PFsense router and it got an IP immediately. No need to strip the tag. I did have a few weird speed tests (940/920, 200/600) but after that it's been almost consistent with 2.5/2.5G.

                          Not that this is extremely useful here, but it's a data point nonetheless.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            In 2.6 or 2.7-dev?

                            S 1 Reply Last reply Reply Quote 0
                            • S
                              Schwiing @stephenw10
                              last edited by Schwiing

                              @stephenw10 in 22.05. My thought is just that Frontier isn't using Vlan0 here. But I'm also not entirely sure one way or the other aside from the result. Is there a way for me to check?

                              M 1 Reply Last reply Reply Quote 0
                              • M
                                michaellacroix @Schwiing
                                last edited by

                                @schwiing

                                I took a pcap a couple of weeks ago and the vlan 0 tag was there. I also have frontier in CT. Are you familiar with wireshark?

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Yes, it would fail in 22.05 if they were tagging. You can run a packet capture on WAN for port 68 and then renew the dhcp lease. If you then view it at full detail you will see any tagging in the replies.

                                  Steve

                                  S 1 Reply Last reply Reply Quote 0
                                  • S
                                    Schwiing @stephenw10
                                    last edited by

                                    @stephenw10 @michaellacroix

                                    I'm familiar with Wireshark but have only run it once and that was a long time ago. I may need some help to figure that one out.

                                    I'm sure there's some good guides on the web though. Can report back once I figure it out

                                    M 1 Reply Last reply Reply Quote 0
                                    • M
                                      michaellacroix @Schwiing
                                      last edited by

                                      @schwiing

                                      Stephens idea is better to use pfsense built-in packet capture.

                                      S 1 Reply Last reply Reply Quote 0
                                      • S
                                        Schwiing @michaellacroix
                                        last edited by

                                        @michaellacroix @stephenw10

                                        https://imgur.com/a/XVWf81D

                                        Any other settings to change here?

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          I always enable promiscuous mode to be sure but that shouldn't be required here. I won't hurt either.

                                          S 1 Reply Last reply Reply Quote 0
                                          • S
                                            Schwiing @stephenw10
                                            last edited by

                                            @stephenw10 Ok. I ran a packet capture and renewed WAN + relinquished my lease. Didn't get an IP back so I had to reboot the ONT, after which I got an IP back. Stopped the capture and got a .cap file. Here's what it says (masked my IP):

                                            07:44:40.852150 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:44:41.370617 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:44:43.018973 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:44:54.521561 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:44:55.069179 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:44:56.103103 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:44:57.061862 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:44:59.010410 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:45:03.113370 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:45:03.131465 IP xx.xx.xx.1.67 > xx.xx.xx.xx.68: UDP, length 300
                                            07:45:07.694198 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                                            07:45:07.731435 IP xx.xx.xx.1.67 > xx.xx.xx.xx.68: UDP, length 300

                                            Did I do it right? Can't really tell.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.