Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLANs setup properly?

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    17 Posts 5 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      viragomann @terry.c
      last edited by

      @terry-c
      Without tagging the packets for VLAN20 on the switch port, which is connected to pfSense, you won't get any joy.

      terry.cT 1 Reply Last reply Reply Quote 0
      • terry.cT
        terry.c @viragomann
        last edited by terry.c

        @viragomann vlan1 seems to be the same on the switch as 20, what am i missing?

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @terry.c
          last edited by

          @terry-c said in VLANs setup properly?:

          vlan1 seems to b

          Never actually used VLAN, but I'm pretty sure : whatever number you chose, don't chose "1" as a VLAN id.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          terry.cT 1 Reply Last reply Reply Quote 0
          • terry.cT
            terry.c @Gertjan
            last edited by

            @gertjan i seen that as well, i just tried routing everything through 5 vlans but that didnt work, went back to using 1. maybe if i figure this out i can take advantage of that hardening best practice.

            J 1 Reply Last reply Reply Quote 0
            • J
              Jarhead @terry.c
              last edited by

              @terry-c
              The difference between 1 and 20 is 1 is your pvid, so it's untagged. Any additional vlans need to be tagged.
              In your switch, find the pvid setting and change it to another vlan id. This could result in loss of access to switch, so what I do is change it on every port except the port you' managing it from. Then set an IP for the new vlan. Connect to a port on the new vlan and verify you can access it. If you can, change the pvid on the last port.
              That will get rid of vlan 1.

              Then as stated above, you need to tag the new vlan on the switchport connected to your router. That port should be in "trunk" mode.
              Then untag that new vlan on another port. Set the pvid on that port to the new vlan id.
              Plug a pc into that port and it will be on the new vlan.

              terry.cT 3 Replies Last reply Reply Quote 0
              • terry.cT
                terry.c @Jarhead
                last edited by

                This post is deleted!
                1 Reply Last reply Reply Quote 0
                • terry.cT
                  terry.c @Jarhead
                  last edited by

                  This post is deleted!
                  1 Reply Last reply Reply Quote 0
                  • terry.cT
                    terry.c @Jarhead
                    last edited by terry.c

                    @jarhead I tried a few configurations with the info you provided. here's what seems to be working, although VLAN30 laptop doesn't seem to be switching over at this time. I restarted the switch and laptop, checked all settings, pfsense, and switch a few times, all is the same. Not sure what's up with that... Any idea why LAN says there's activity even though nothing is routed there?
                    20221003_231736.jpg

                    20221003_231927.jpg

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      Jarhead @terry.c
                      last edited by

                      @terry-c I don't understand your drawing.
                      Post a screenshot of your switch vlan config.
                      Use "snipping tool" if you're using windows.

                      terry.cT 1 Reply Last reply Reply Quote 0
                      • M
                        milew
                        last edited by milew

                        @terry-c
                        Do you have one or two interfaces in your pfsense?

                        For one interface try this
                        Flowchart

                        1 Reply Last reply Reply Quote 0
                        • terry.cT
                          terry.c @Jarhead
                          last edited by

                          @jarhead here's screenshots of the setup.

                          1.png 2.png 3.png 4.png 5.png 6.png

                          V 1 Reply Last reply Reply Quote 0
                          • V
                            viragomann @terry.c
                            last edited by

                            @terry-c
                            Any specific reason for having port 1 configured with PVID10?

                            VLAN10 is your WAN as I got you and port 1 has it tagged. As well it should be tagged in pfSense. So there is no need for PVID.

                            terry.cT 1 Reply Last reply Reply Quote 0
                            • terry.cT
                              terry.c @viragomann
                              last edited by terry.c

                              @viragomann not really sure how to connect this. I'v tried a bunch of different ways. At this time if I untag port 1 from 10 I lose pfsense. Anybody have a really good example or explanation of tagged and untagged. I think I have it figured out, then it doesn't work with 2 devices. Only one vlan will work. Really confused and shocked at how difficult this is. lol 🤣

                              V J 2 Replies Last reply Reply Quote 0
                              • V
                                viragomann @terry.c
                                last edited by

                                @terry-c
                                untagged VLAN10 != PVID10

                                The switch gives you 3 way to assign a port to a VLAN.
                                tagged: outgoing packets on the port are tagged
                                untagged: outgoing packets are untagged
                                PVID: incoming packets get tagged

                                I requested you to remove the PVID from port 1. Port 1 is the trunk port to pfSense = all VLANs tagged. I.e. all outgoing packets are tagged with the respective VLAN IDs. Incoming packets must not get tagged, because they are already.

                                1 Reply Last reply Reply Quote 0
                                • J
                                  Jarhead @terry.c
                                  last edited by Jarhead

                                  @terry-c said in VLANs setup properly?:

                                  @viragomann not really sure how to connect this. I'v tried a bunch of different ways. At this time if I untag port 1 from 10 I lose pfsense. Anybody have a really good example or explanation of tagged and untagged. I think I have it figured out, then it doesn't work with 2 devices. Only one vlan will work. Really confused and shocked at how difficult this is. lol 🤣

                                  Think of it like this, if you have a tagged vlan on an interface, whatever you plug into that interface also needs to be tagged.

                                  Why are you using a vlan on the WAN?

                                  There should be a third option on the vlans, tagged, untagged and "no". ie excluded, not allowed, something like that. If a vlan isn't being used on a port, set it to excluded on those ports.

                                  All vlans are assigned to LAN as parent in pfSense, correct?

                                  terry.cT 1 Reply Last reply Reply Quote 0
                                  • terry.cT
                                    terry.c @Jarhead
                                    last edited by

                                    @jarhead Hi, thanks for following up. I appreciate it. I contacted the switch manufacturer for a 3rd time and finally figured it out. lol. there was a few things i was doing wrong, plus the support tech kind of led me in the wrong direction.

                                    Thanks again!!

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.