Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    LTSP on Vlans Pfsense

    Scheduled Pinned Locked Moved General pfSense Questions
    30 Posts 6 Posters 3.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      There's nothing listed for DHCP options there. So what DHCP values are you passing the clients on the VLAN from the pfSense DHCP server?

      What errors do you see on the clients when they try to boot?

      Steve

      doguibnuD 2 Replies Last reply Reply Quote 0
      • doguibnuD
        doguibnu @stephenw10
        last edited by

        @stephenw10 said in LTSP on Vlans Pfsense:

        There's nothing listed for DHCP options there. So what DHCP values are you passing the clients on the VLAN from the pfSense DHCP server?

        At the screen I did try insert the value on TFTP: IP Ltsp server.

        Select Enable Network Booting

        Next server: Ltsp IP server too.

        it does not work

        What errors do you see on the clients when they try to boot?

        The boot client ltsp try to find the system ltsp boot system. Can not find and give me the error: The system can not find filename boot.

        I will try to get mobile cell phone picture and post the screen here.

        Thanks help

        Steve

        1 Reply Last reply Reply Quote 0
        • doguibnuD
          doguibnu @stephenw10
          last edited by

          Sorry, can not still get picture from ltsp client screen!
          thanks

          @stephenw10 said in LTSP on Vlans Pfsense:

          There's nothing listed for DHCP options there. So what DHCP values are you passing the clients on the VLAN from the pfSense DHCP server?

          What errors do you see on the clients when they try to boot?

          Steve

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by stephenw10

            As long as the DHCP server is passing the address of the TFTP server to the client and other valid IP data I expect this to work. You do need firewall rules to allow that traffic of course.
            TFTP generally doesn't work through NAT. If, for some reason, you're doing that you would need to enable the TFTP proxy:
            https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#tftp-proxy

            Try just testing directly using a client on the VLAN to pull a file via TFTP from the server.

            Steve

            doguibnuD 1 Reply Last reply Reply Quote 0
            • doguibnuD
              doguibnu @stephenw10
              last edited by

              @stephenw10

              Hello!
              How are you?

              Can you explain or show us an example about what firewall rules we need to use?

              Try just testing directly using a client on the VLAN to pull a file via TFTP from the server.

              I will try this!

              Very long time trying to do this work well but nothing. do not "conversation" betweeen vlans and LTSP and pFsense Tftp server.
              So hard

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                I would expect you to need at least UDP port 69 allowed from the VLAN to the LAN and probably any UDP traffic back the other way because the reply is on a random high port. For example:

                OPT1 	udp 	172.21.16.8:35583 -> 192.168.126.11:69 	SINGLE:NO_TRAFFIC 	1 / 0 	48 B / 0 B 	
                OPT1 	udp 	192.168.126.11:32770 -> 172.21.16.8:35583 	SINGLE:MULTIPLE 	1 / 1 	46 B / 32 B
                

                That is my client at 172.21.16.8 fetching a file from the server at 192.168.126.11.

                If you enable the tftp proxy server though that takes care of the reply rules for you so you only need to allow udp from the client to the server on port 69.

                As I showed above though it will work between subnets without the proxy if there is no NAT.

                To test that I used the tftpd server package for pfSense running on a separate pfSense instance in the OPT1 subnet. Then connected to it from a Linux client on LAN:

                steve@steve-NUC9i9QNX:~$ tftp
                tftp> connect 192.168.126.11
                tftp> get test.txt
                Received 14 bytes in 0.0 seconds
                

                Steve

                1 Reply Last reply Reply Quote 0
                • doguibnuD
                  doguibnu
                  last edited by

                  Hello Steve!

                  I can not understand how to enable proxy tftp? Where is this option in pfense.

                  I would you like show you some screens from my pfsense and to see if stay more clear to do the right configuration.

                  This is the Vlan:

                  01-vlan-nome.png

                  Vlan configuration:
                  You can see all ports are enable to receive connections:

                  02-vlan-config.png

                  TFTP-server enable:

                  03-tftp-enable.png

                  dhcp-server enable at this vlan:

                  04-dhcp-server-vlan712.png

                  And here, the IP from LTSP server. The configuration LTSP server side is disable dhcp server inside the ltsp network configuration because the vlan has enable dhcp-server:

                  05-tftp-server-vlan.png

                  So, after this, I did try to do the client ltsp find the ltsp server to boot. But can not find the filename image (this is the message from client ltsp boot sequence.

                  Thank you for help and attention

                  Douglas

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    The rules on LAN allow the LTSP server to reply?

                    You don't need the proxy if there is no NAT between the subnets but it is configured from System > Advanced > Firewall&NAT.

                    I only used the TFTP server in pfSense to test with. You don't need that, the LTSP server is the TFTP server.

                    However you absolutely do need the boot file name in the DHCP config. There is no way it can work without that. The client needs that to be passed to it so it knows what to boot.

                    Steve

                    doguibnuD 1 Reply Last reply Reply Quote 0
                    • doguibnuD
                      doguibnu @stephenw10
                      last edited by

                      @stephenw10 said in LTSP on Vlans Pfsense:

                      The rules on LAN allow the LTSP server to reply?

                      Yes, it is

                      You don't need the proxy if there is no NAT between the subnets but it is configured from System > Advanced > Firewall&NAT.

                      So, now I went to this menu and enable TFTP proxy for Lan!

                      I only used the TFTP server in pfSense to test with. You don't need that, the LTSP server is the TFTP server.

                      However you absolutely do need the boot file name in the DHCP config. There is no way it can work without that. The client needs that to be passed to it so it knows what to boot.

                      According Ltsp site project: It is not only one name, it is 3 names, separated. So, how to indicate the right way?

                      # This is the LTSP subnet declaration
                      subnet 192.168.67.0 netmask 255.255.255.0 {
                        range 192.168.67.20 192.168.67.250;
                        option ipxe.no-pxedhcp 1;
                        option routers 192.168.67.1;
                        # On single-NIC setups, usually routers != next-server (=TFTP server)
                        # option next-server 192.168.67.1
                        if exists ipxe.menu {
                          filename "ltsp/ltsp.ipxe";
                        } elsif option arch = 00:00 {
                          filename "ltsp/undionly.kpxe";
                        } elsif option arch = 00:07 {
                          filename "ltsp/snponly.efi";
                        } elsif option arch = 00:09 {
                          filename "ltsp/snponly.efi";
                        } else {
                          filename "ltsp/unmatched-client";
                        }
                      }
                      

                      Thank you

                      Douglas

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Those are just for different machine types. And only if ipxe.menu is not present.
                        What are your clients?
                        That should be in the LTSP docs though.

                        Steve

                        doguibnuD 1 Reply Last reply Reply Quote 0
                        • doguibnuD
                          doguibnu @stephenw10
                          last edited by

                          Hello! @stephenw10
                          How are you?

                          So, I would you like to show you more screenshots.
                          I Believe that we will win this way network hehehe. Still not works, but there are different results.

                          Please, see these screen

                          01-vlan-nome.png

                          02-tela-vlan43.png

                          03-tela-screen-gate-40.png
                          04-tela-tftp06-36.png

                          And here, the client LTSP screenshot. Now appear it seeing the server and try run the image server. But, there is some wrong thing:

                          20221007_095152.jpg

                          This client has old NIC onboard!

                          Thanks Steve!

                          Douglas

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Ok, so that's mostly working. It is getting the values via DHCP, initiating the PXE boot and is correctly fetching the boot file from the tftp server.
                            What appears to be wrong is that it's trying to boot the wrong file. Though there is no actual error shown there, I'm just assuming it doesn't boot further than that.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • ?
                              A Former User
                              last edited by

                              On the lan pfsense the project works great, but with Vlan, not!

                              • First question is why there is another DHCP set up on the server?

                              In normal you will be setting up it in the following order:

                              • Setting up the VLANs and a IP range inside of the VLANs
                              • pfSesen is routing then the entire VLAN traffic and this also inside one and between all the other VLANs (firewall rules)
                              • pfSense is routing the entire WAN traffic and the LAN switch it self is routing between the VLANs (Switch ACLs)

                              If so, the vlans owns their own DHCP range and ip net
                              each for it self. So why the Server is also offering via DHCP?

                              doguibnuD 1 Reply Last reply Reply Quote 0
                              • doguibnuD
                                doguibnu @A Former User
                                last edited by

                                Hello @Dobby_

                                @dobby_ said in LTSP on Vlans Pfsense:

                                On the lan pfsense the project works great, but with Vlan, not!

                                • First question is why there is another DHCP set up on the server? The configuration is:
                                ltsp dnsmasq --proxy-dhcp=0
                                

                                that means the ltsp server is not set up dhcp server

                                Site Installation LTSP

                                So no, there is not another DHCP set up on the LTSP server,

                                The last try we have this screenshot:

                                Pfsense :

                                tela-pfsense37-37.png

                                And Ltsp Client:
                                ultima_20221013_110122.jpg

                                But, after try the boot process, the client boot alone and can not up server image.

                                Lets go!

                                Thank you!

                                In normal you will be setting up it in the following order:

                                • Setting up the VLANs and a IP range inside of the VLANs
                                • pfSesen is routing then the entire VLAN traffic and this also inside one and between all the other VLANs (firewall rules)
                                • pfSense is routing the entire WAN traffic and the LAN switch it self is routing between the VLANs (Switch ACLs)

                                If so, the vlans owns their own DHCP range and ip net
                                each for it self. So why the Server is also offering via DHCP?

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Is that the last thing you see?

                                  It's pulling the ipxe file and booting it correcetly. Usually ipex will then try to boot something else.

                                  doguibnuD 1 Reply Last reply Reply Quote 0
                                  • doguibnuD
                                    doguibnu @stephenw10
                                    last edited by

                                    Hello!

                                    @stephenw10 said in LTSP on Vlans Pfsense:

                                    Is that the last thing you see?

                                    Yes, after this, the client reboot alone.

                                    It's pulling the ipxe file and booting it correcetly. Usually ipex will then try to boot something else.

                                    so! I am lost. I am trying to works well a long time. I can not find the right way to fix the issue.
                                    Thanks

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      I would guess that ipxe is trying to boot something else and failing to find it. You can see it's trying to reach https://ipxe.org/28086011 but what it expects to find there is unclear.
                                      Maybe it needs some additional dhcp parameters to know what to do next.

                                      doguibnuD 1 Reply Last reply Reply Quote 0
                                      • doguibnuD
                                        doguibnu @stephenw10
                                        last edited by

                                        @stephenw10 said in LTSP on Vlans Pfsense:

                                        I would guess that ipxe is trying to boot something else and failing to find it. You can see it's trying to reach https://ipxe.org/28086011 but what it expects to find there is unclear.

                                         https://ipxe.org/28086011 
                                        

                                        this is an issue ipxe after "googling" about, but still not clear for me where go to fix this.

                                        Maybe it needs some additional dhcp parameters to know what to do next.

                                        So, I am trying follow isc dhcp
                                        My ltsp server on proxmox, so add one more NIC to try boot up as the site tell about. But, still not fix it!

                                        A 1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Right so it may need all those ipxe parameters configured so that ipxe knows what to do once it boots.

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            aaronouthier @doguibnu
                                            last edited by

                                            @doguibnu
                                            I suspect the url mentioned is a place to go for help with the error, not a url being accessed during the boot process.

                                            If memory serves (it’s been many years since I’ve done ltsp), after the bios file is loaded via tftp, the initramfs file is loaded via nfs.

                                            First step here, however, would be to go to the client machine, and load a local os (from the hard drive or a flash drive, etc - not via netboot), and attempt to manually load the file in question via tftp. If it loads, then the file exists on the ltsp server and is accessible.

                                            1 Reply Last reply Reply Quote 0
                                            • stephenw10S stephenw10 referenced this topic on
                                            • stephenw10S stephenw10 referenced this topic on
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.