Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLANs setup properly?

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    17 Posts 5 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • terry.cT
      terry.c @Gertjan
      last edited by

      @gertjan i seen that as well, i just tried routing everything through 5 vlans but that didnt work, went back to using 1. maybe if i figure this out i can take advantage of that hardening best practice.

      J 1 Reply Last reply Reply Quote 0
      • J
        Jarhead @terry.c
        last edited by

        @terry-c
        The difference between 1 and 20 is 1 is your pvid, so it's untagged. Any additional vlans need to be tagged.
        In your switch, find the pvid setting and change it to another vlan id. This could result in loss of access to switch, so what I do is change it on every port except the port you' managing it from. Then set an IP for the new vlan. Connect to a port on the new vlan and verify you can access it. If you can, change the pvid on the last port.
        That will get rid of vlan 1.

        Then as stated above, you need to tag the new vlan on the switchport connected to your router. That port should be in "trunk" mode.
        Then untag that new vlan on another port. Set the pvid on that port to the new vlan id.
        Plug a pc into that port and it will be on the new vlan.

        terry.cT 3 Replies Last reply Reply Quote 0
        • terry.cT
          terry.c @Jarhead
          last edited by

          This post is deleted!
          1 Reply Last reply Reply Quote 0
          • terry.cT
            terry.c @Jarhead
            last edited by

            This post is deleted!
            1 Reply Last reply Reply Quote 0
            • terry.cT
              terry.c @Jarhead
              last edited by terry.c

              @jarhead I tried a few configurations with the info you provided. here's what seems to be working, although VLAN30 laptop doesn't seem to be switching over at this time. I restarted the switch and laptop, checked all settings, pfsense, and switch a few times, all is the same. Not sure what's up with that... Any idea why LAN says there's activity even though nothing is routed there?
              20221003_231736.jpg

              20221003_231927.jpg

              J 1 Reply Last reply Reply Quote 0
              • J
                Jarhead @terry.c
                last edited by

                @terry-c I don't understand your drawing.
                Post a screenshot of your switch vlan config.
                Use "snipping tool" if you're using windows.

                terry.cT 1 Reply Last reply Reply Quote 0
                • M
                  milew
                  last edited by milew

                  @terry-c
                  Do you have one or two interfaces in your pfsense?

                  For one interface try this
                  Flowchart

                  1 Reply Last reply Reply Quote 0
                  • terry.cT
                    terry.c @Jarhead
                    last edited by

                    @jarhead here's screenshots of the setup.

                    1.png 2.png 3.png 4.png 5.png 6.png

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @terry.c
                      last edited by

                      @terry-c
                      Any specific reason for having port 1 configured with PVID10?

                      VLAN10 is your WAN as I got you and port 1 has it tagged. As well it should be tagged in pfSense. So there is no need for PVID.

                      terry.cT 1 Reply Last reply Reply Quote 0
                      • terry.cT
                        terry.c @viragomann
                        last edited by terry.c

                        @viragomann not really sure how to connect this. I'v tried a bunch of different ways. At this time if I untag port 1 from 10 I lose pfsense. Anybody have a really good example or explanation of tagged and untagged. I think I have it figured out, then it doesn't work with 2 devices. Only one vlan will work. Really confused and shocked at how difficult this is. lol 🤣

                        V J 2 Replies Last reply Reply Quote 0
                        • V
                          viragomann @terry.c
                          last edited by

                          @terry-c
                          untagged VLAN10 != PVID10

                          The switch gives you 3 way to assign a port to a VLAN.
                          tagged: outgoing packets on the port are tagged
                          untagged: outgoing packets are untagged
                          PVID: incoming packets get tagged

                          I requested you to remove the PVID from port 1. Port 1 is the trunk port to pfSense = all VLANs tagged. I.e. all outgoing packets are tagged with the respective VLAN IDs. Incoming packets must not get tagged, because they are already.

                          1 Reply Last reply Reply Quote 0
                          • J
                            Jarhead @terry.c
                            last edited by Jarhead

                            @terry-c said in VLANs setup properly?:

                            @viragomann not really sure how to connect this. I'v tried a bunch of different ways. At this time if I untag port 1 from 10 I lose pfsense. Anybody have a really good example or explanation of tagged and untagged. I think I have it figured out, then it doesn't work with 2 devices. Only one vlan will work. Really confused and shocked at how difficult this is. lol 🤣

                            Think of it like this, if you have a tagged vlan on an interface, whatever you plug into that interface also needs to be tagged.

                            Why are you using a vlan on the WAN?

                            There should be a third option on the vlans, tagged, untagged and "no". ie excluded, not allowed, something like that. If a vlan isn't being used on a port, set it to excluded on those ports.

                            All vlans are assigned to LAN as parent in pfSense, correct?

                            terry.cT 1 Reply Last reply Reply Quote 0
                            • terry.cT
                              terry.c @Jarhead
                              last edited by

                              @jarhead Hi, thanks for following up. I appreciate it. I contacted the switch manufacturer for a 3rd time and finally figured it out. lol. there was a few things i was doing wrong, plus the support tech kind of led me in the wrong direction.

                              Thanks again!!

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.