Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    LTSP on Vlans Pfsense

    Scheduled Pinned Locked Moved General pfSense Questions
    30 Posts 6 Posters 3.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      The clients are still in the LAN subnet though I assume?

      What net-boot options are you passing to them in the LAN DHCP server settings? They will need to be passed the IP address of the boot server there.

      Steve

      doguibnuD 1 Reply Last reply Reply Quote 0
      • doguibnuD
        doguibnu @stephenw10
        last edited by

        @stephenw10 said in LTSP on Vlans Pfsense:

        The clients are still in the LAN subnet though I assume?

        The LTSP server is on the lan (10.1.1.x) it has the IP 10.1.1.11
        So the clients that need access from lan, works nice and well.

        Others ltsp clients need access from our vlan for example: 10.10.201.x

        At this point that I would like to know what or how to configure on vlan to access the LTSP server boot image (10.1.1.11)

        Inside vlan, I did put ltsp server IP but, it is not works. The client ltsp on vlan does not find the (server and file name server boot - this message is show in ltsp client boot from vlan)

        What net-boot options are you passing to them in the LAN DHCP server settings? They will need to be passed the IP address of the boot server there.

        Steve

        Thank you

        Douglas

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator @doguibnu
          last edited by

          @doguibnu said in LTSP on Vlans Pfsense:

          When trying put server LTSP on Vlan: 10.10.202.x can not find the boot image ltsp server.

          So not that? It's actually the clients that are on the VLAN and the server remains on LAN?

          What options are you actually passing the clients via DHCP?

          What error do you see when they try to boot?

          Steve

          doguibnuD 1 Reply Last reply Reply Quote 0
          • doguibnuD
            doguibnu @stephenw10
            last edited by

            @stephenw10 said in LTSP on Vlans Pfsense:

            @doguibnu said in LTSP on Vlans Pfsense:

            When trying put server LTSP on Vlan: 10.10.202.x can not find the boot image ltsp server.

            Hello Steve!

            So not that? It's actually the clients that are on the VLAN and the server remains on LAN?

            Yes, the clients are on vlans (10.10.202.x) and ltsp server on Lan (10.1.1.x)

            What options are you actually passing the clients via DHCP?

            So! follow the ltsp documentation here am using the command:

            ltsp dnsmasq --proxy-dhcp=0

            because pfsense side, is enable dhcp and only on NIC. I try insert at vlan, the IP address LTSP server that is lan side (10.1.1.x)
            But, trying to client do the boot its can not find file name serer boot system.

            I did try n times configurations to pass to works well. But , nothing works!

            Thank you

            What error do you see when they try to boot?

            Steve

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              There's nothing listed for DHCP options there. So what DHCP values are you passing the clients on the VLAN from the pfSense DHCP server?

              What errors do you see on the clients when they try to boot?

              Steve

              doguibnuD 2 Replies Last reply Reply Quote 0
              • doguibnuD
                doguibnu @stephenw10
                last edited by

                @stephenw10 said in LTSP on Vlans Pfsense:

                There's nothing listed for DHCP options there. So what DHCP values are you passing the clients on the VLAN from the pfSense DHCP server?

                At the screen I did try insert the value on TFTP: IP Ltsp server.

                Select Enable Network Booting

                Next server: Ltsp IP server too.

                it does not work

                What errors do you see on the clients when they try to boot?

                The boot client ltsp try to find the system ltsp boot system. Can not find and give me the error: The system can not find filename boot.

                I will try to get mobile cell phone picture and post the screen here.

                Thanks help

                Steve

                1 Reply Last reply Reply Quote 0
                • doguibnuD
                  doguibnu @stephenw10
                  last edited by

                  Sorry, can not still get picture from ltsp client screen!
                  thanks

                  @stephenw10 said in LTSP on Vlans Pfsense:

                  There's nothing listed for DHCP options there. So what DHCP values are you passing the clients on the VLAN from the pfSense DHCP server?

                  What errors do you see on the clients when they try to boot?

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by stephenw10

                    As long as the DHCP server is passing the address of the TFTP server to the client and other valid IP data I expect this to work. You do need firewall rules to allow that traffic of course.
                    TFTP generally doesn't work through NAT. If, for some reason, you're doing that you would need to enable the TFTP proxy:
                    https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#tftp-proxy

                    Try just testing directly using a client on the VLAN to pull a file via TFTP from the server.

                    Steve

                    doguibnuD 1 Reply Last reply Reply Quote 0
                    • doguibnuD
                      doguibnu @stephenw10
                      last edited by

                      @stephenw10

                      Hello!
                      How are you?

                      Can you explain or show us an example about what firewall rules we need to use?

                      Try just testing directly using a client on the VLAN to pull a file via TFTP from the server.

                      I will try this!

                      Very long time trying to do this work well but nothing. do not "conversation" betweeen vlans and LTSP and pFsense Tftp server.
                      So hard

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        I would expect you to need at least UDP port 69 allowed from the VLAN to the LAN and probably any UDP traffic back the other way because the reply is on a random high port. For example:

                        OPT1 	udp 	172.21.16.8:35583 -> 192.168.126.11:69 	SINGLE:NO_TRAFFIC 	1 / 0 	48 B / 0 B 	
                        OPT1 	udp 	192.168.126.11:32770 -> 172.21.16.8:35583 	SINGLE:MULTIPLE 	1 / 1 	46 B / 32 B
                        

                        That is my client at 172.21.16.8 fetching a file from the server at 192.168.126.11.

                        If you enable the tftp proxy server though that takes care of the reply rules for you so you only need to allow udp from the client to the server on port 69.

                        As I showed above though it will work between subnets without the proxy if there is no NAT.

                        To test that I used the tftpd server package for pfSense running on a separate pfSense instance in the OPT1 subnet. Then connected to it from a Linux client on LAN:

                        steve@steve-NUC9i9QNX:~$ tftp
                        tftp> connect 192.168.126.11
                        tftp> get test.txt
                        Received 14 bytes in 0.0 seconds
                        

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • doguibnuD
                          doguibnu
                          last edited by

                          Hello Steve!

                          I can not understand how to enable proxy tftp? Where is this option in pfense.

                          I would you like show you some screens from my pfsense and to see if stay more clear to do the right configuration.

                          This is the Vlan:

                          01-vlan-nome.png

                          Vlan configuration:
                          You can see all ports are enable to receive connections:

                          02-vlan-config.png

                          TFTP-server enable:

                          03-tftp-enable.png

                          dhcp-server enable at this vlan:

                          04-dhcp-server-vlan712.png

                          And here, the IP from LTSP server. The configuration LTSP server side is disable dhcp server inside the ltsp network configuration because the vlan has enable dhcp-server:

                          05-tftp-server-vlan.png

                          So, after this, I did try to do the client ltsp find the ltsp server to boot. But can not find the filename image (this is the message from client ltsp boot sequence.

                          Thank you for help and attention

                          Douglas

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            The rules on LAN allow the LTSP server to reply?

                            You don't need the proxy if there is no NAT between the subnets but it is configured from System > Advanced > Firewall&NAT.

                            I only used the TFTP server in pfSense to test with. You don't need that, the LTSP server is the TFTP server.

                            However you absolutely do need the boot file name in the DHCP config. There is no way it can work without that. The client needs that to be passed to it so it knows what to boot.

                            Steve

                            doguibnuD 1 Reply Last reply Reply Quote 0
                            • doguibnuD
                              doguibnu @stephenw10
                              last edited by

                              @stephenw10 said in LTSP on Vlans Pfsense:

                              The rules on LAN allow the LTSP server to reply?

                              Yes, it is

                              You don't need the proxy if there is no NAT between the subnets but it is configured from System > Advanced > Firewall&NAT.

                              So, now I went to this menu and enable TFTP proxy for Lan!

                              I only used the TFTP server in pfSense to test with. You don't need that, the LTSP server is the TFTP server.

                              However you absolutely do need the boot file name in the DHCP config. There is no way it can work without that. The client needs that to be passed to it so it knows what to boot.

                              According Ltsp site project: It is not only one name, it is 3 names, separated. So, how to indicate the right way?

                              # This is the LTSP subnet declaration
                              subnet 192.168.67.0 netmask 255.255.255.0 {
                                range 192.168.67.20 192.168.67.250;
                                option ipxe.no-pxedhcp 1;
                                option routers 192.168.67.1;
                                # On single-NIC setups, usually routers != next-server (=TFTP server)
                                # option next-server 192.168.67.1
                                if exists ipxe.menu {
                                  filename "ltsp/ltsp.ipxe";
                                } elsif option arch = 00:00 {
                                  filename "ltsp/undionly.kpxe";
                                } elsif option arch = 00:07 {
                                  filename "ltsp/snponly.efi";
                                } elsif option arch = 00:09 {
                                  filename "ltsp/snponly.efi";
                                } else {
                                  filename "ltsp/unmatched-client";
                                }
                              }
                              

                              Thank you

                              Douglas

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Those are just for different machine types. And only if ipxe.menu is not present.
                                What are your clients?
                                That should be in the LTSP docs though.

                                Steve

                                doguibnuD 1 Reply Last reply Reply Quote 0
                                • doguibnuD
                                  doguibnu @stephenw10
                                  last edited by

                                  Hello! @stephenw10
                                  How are you?

                                  So, I would you like to show you more screenshots.
                                  I Believe that we will win this way network hehehe. Still not works, but there are different results.

                                  Please, see these screen

                                  01-vlan-nome.png

                                  02-tela-vlan43.png

                                  03-tela-screen-gate-40.png
                                  04-tela-tftp06-36.png

                                  And here, the client LTSP screenshot. Now appear it seeing the server and try run the image server. But, there is some wrong thing:

                                  20221007_095152.jpg

                                  This client has old NIC onboard!

                                  Thanks Steve!

                                  Douglas

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Ok, so that's mostly working. It is getting the values via DHCP, initiating the PXE boot and is correctly fetching the boot file from the tftp server.
                                    What appears to be wrong is that it's trying to boot the wrong file. Though there is no actual error shown there, I'm just assuming it doesn't boot further than that.

                                    Steve

                                    1 Reply Last reply Reply Quote 0
                                    • ?
                                      A Former User
                                      last edited by

                                      On the lan pfsense the project works great, but with Vlan, not!

                                      • First question is why there is another DHCP set up on the server?

                                      In normal you will be setting up it in the following order:

                                      • Setting up the VLANs and a IP range inside of the VLANs
                                      • pfSesen is routing then the entire VLAN traffic and this also inside one and between all the other VLANs (firewall rules)
                                      • pfSense is routing the entire WAN traffic and the LAN switch it self is routing between the VLANs (Switch ACLs)

                                      If so, the vlans owns their own DHCP range and ip net
                                      each for it self. So why the Server is also offering via DHCP?

                                      doguibnuD 1 Reply Last reply Reply Quote 0
                                      • doguibnuD
                                        doguibnu @A Former User
                                        last edited by

                                        Hello @Dobby_

                                        @dobby_ said in LTSP on Vlans Pfsense:

                                        On the lan pfsense the project works great, but with Vlan, not!

                                        • First question is why there is another DHCP set up on the server? The configuration is:
                                        ltsp dnsmasq --proxy-dhcp=0
                                        

                                        that means the ltsp server is not set up dhcp server

                                        Site Installation LTSP

                                        So no, there is not another DHCP set up on the LTSP server,

                                        The last try we have this screenshot:

                                        Pfsense :

                                        tela-pfsense37-37.png

                                        And Ltsp Client:
                                        ultima_20221013_110122.jpg

                                        But, after try the boot process, the client boot alone and can not up server image.

                                        Lets go!

                                        Thank you!

                                        In normal you will be setting up it in the following order:

                                        • Setting up the VLANs and a IP range inside of the VLANs
                                        • pfSesen is routing then the entire VLAN traffic and this also inside one and between all the other VLANs (firewall rules)
                                        • pfSense is routing the entire WAN traffic and the LAN switch it self is routing between the VLANs (Switch ACLs)

                                        If so, the vlans owns their own DHCP range and ip net
                                        each for it self. So why the Server is also offering via DHCP?

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Is that the last thing you see?

                                          It's pulling the ipxe file and booting it correcetly. Usually ipex will then try to boot something else.

                                          doguibnuD 1 Reply Last reply Reply Quote 0
                                          • doguibnuD
                                            doguibnu @stephenw10
                                            last edited by

                                            Hello!

                                            @stephenw10 said in LTSP on Vlans Pfsense:

                                            Is that the last thing you see?

                                            Yes, after this, the client reboot alone.

                                            It's pulling the ipxe file and booting it correcetly. Usually ipex will then try to boot something else.

                                            so! I am lost. I am trying to works well a long time. I can not find the right way to fix the issue.
                                            Thanks

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.