Bridge of LAN1-4 untagged (unifi), with tagged VLANs (no switch)
-
Hi,
First of all. I am aware that this is far from recomended and even more far from best practice. So I beg of you that we move past those points.
Hardware, 6100
Software: 23.01 devScenario
With the many ports available on the 6100, I really want to (and am doing so) utilize the available physical ports. I do not physically need a switch at this moment. Since the number of interfaces are just enough right now for my needs.What I have is also working quite well. However, I know full well that this is hacky not-working-as-intended behaviour. And therefore wish to find a more elegant sollution.
I have a Unifi6-Lite AP, connected. Management on untagged, and a separate WLAN on VLAN101.
What I've done. And again this technically works. (Let me reiterate, that I do not wish to buy a separate switch. Since I wish to first utilize the interfaces I've bought. Theoretical performance penalty is non-important)
LAN1-4 are all bridged with Bridge0, and the bridge0 is where the DHCP-server lives.
VLAN101 is assigned on each of LAN1-4 interfaces. These Vinterfaces are then all bridged with Bridge1 (works even if it's not enabled. But needs to be present). The DHCP-server however can't be on the (enabled) bridge. This causes other problems in the ARP-tables.
What I would like to see. A more elegant solution to utilize the physical interfaces. And at the same time being flexible to have for instance something VLAN capable on separate interfaces, and having them being able to communicate properly between them.
One idea I'm having for future home-lab setups. Would be connecting the 10G to storage server and VM-host, either directly or with a small 10G switch inbetween. And the LAN1-4 could go to more regular devices such as AP's and clients. But one would obviously want the Storage and/or VM-host to be reachable from the regular clients on LAN1-4?
I've read about "just" create to VLANS and bridge those. But how would I manage Unifi's devices since they want untagged traffic.
Thanks!
-
TL;DR
Basically, what I'm asking is in the line of:
How do I e.g. have one Unifi XG switch connected to the 10G ports, and an AP connected to LAN2. Both are serviced by untagged trafic, and also deliver another VLAN. I would then like the pfsense to have these served by a DHCP server for each the default untagged and the VLAN.
So that I can have the pfSense at the centre of the network, similar to a star design. And not a branching tree variant. -
@cloudroot Honestly, buy a switch. You're talking $40.
It's worth it. -
@jarhead I know I know, that would be the feasible and sane solution. I do not dispute that.
It just irks me then that I'll have many ports on the 6100 that are there and not being used at all. So they are then quite redundant.
-
@cloudroot Yeah but those are router ports, not switchports.
You can use them for other networks. So no need for vlans anymore. -
@cloudroot said in Bridge of LAN1-4 untagged (unifi), with tagged VLANs (no switch):
It just irks me then that I'll have many ports on the 6100
Why a router can never have too many interfaces ;) But as mentioned they are not "switch" ports - they are discrete interfaces. You could use them as uplinks for your different networks/vlans to your switching environment - which is their purpose.. Not switch ports ;)
I have a 4860, and it doesn't have too many ports - I use them all.. I have 1 that carries some vlans, these are vlans that don't really talk to each other much. The networks/vlans that do a lot of intervlan talking are on their own physical interfaces
If you don't have enough networks to justify all the interfaces, and you just don't like them sitting there idle - put them in a lagg and run all your vlans over the lagg.
-
@johnpoz LAGGs... That is something that I hadn't even considered. This would probably "solve" the eye-sore of having many unused ports.
I will do some reading on LAGG now :)
-
@cloudroot said in Bridge of LAN1-4 untagged (unifi), with tagged VLANs (no switch):
It just irks me then that I'll have many ports on the 6100 that are there and not being used at all. So they are then quite redundant.
Sure but it's a router, not a switch. Bridges are good for specific needs but your performance will suffer from pulling CPU cycles away to be a packet switcher instead of a packet filter.
psSense just doesn't have the same ring to it.
-
@rcoleman-netgate I'm (at the moment) willing to sacrifice CPU cycles, since I have them to spare. But the suggestion of using LAGG, was a good one. And I'm in the process of reading up on it.
Comming from 10+ years of Mikrotik, and pfSense is doing things differently. Some way more than others. But it's fun to learn something new.
-
@cloudroot said in Bridge of LAN1-4 untagged (unifi), with tagged VLANs (no switch):
Comming from 10+ years of Mikrotik
do they have switch ports? Would never in a million years choose to bridge anything other than say wifi to wire.. Or if my router had say had a optical interface and my switch didn't.. And I needed to have a optical connection into my copper network.. But it would only be long enough to either get a sfp/sfp+ for my switch, or a media converter.. I sure wouldn't bridge interfaces on my router because I just didn't have another use for them ;) And didn't like them sitting there empty...
-
@johnpoz said in Bridge of LAN1-4 untagged (unifi), with tagged VLANs (no switch):
@cloudroot said in Bridge of LAN1-4 untagged (unifi), with tagged VLANs (no switch):
Comming from 10+ years of Mikrotik
And didn't like them sitting there empty...
Exactly what I was thinking... Can't understand how unused ports are an eye-sore.
-
@johnpoz said in Bridge of LAN1-4 untagged (unifi), with tagged VLANs (no switch):
Would never in a million years choose to bridge anything other than say wifi to wire
And even then... I might not... I've been there and it wasn't pretty. Biggest PITB I ever did. Eventually I had them buy their own 5-port VLAN-capable switch and bundled them all together.
-
@jarhead said in Bridge of LAN1-4 untagged (unifi), with tagged VLANs (no switch):
Can't understand how unused ports are an eye-sore.
If they bother you buy some rj45 plugs ;)
They sell all kinds of them you can get a bag of 50 for a few bucks, etc. They help keep the dust out as well ;)
If anything I would get a bit antsy if I didn't have a few free ports available - what if I need to add something, and I don't have a few free ports ;)
-
@cloudroot
Are you able to use LAGGS for you Scenario? We are also coming from Mikrotik and we often used to bridge all Ports and then add VLAN's on that Bridge... -
@opit-gmbh Well, I've now fallen down the rabbit hole of designen a way to overkill homelab. So it's gonna take a while for me to decide on the server hardware. After that is done, I'll look through the options for switches and such.. Things being what they are, this is probably gonna take months. But I'm in no hurry right now.
But if I were to do it right now. I'd probably group the two 10Gbe ports, and combine them and have an affordable Mikrotik as downlink.
