Initial Configuration

johnpoz

Each vlan is assigned to a Nic if that makes sense.

Still not clear - are they actual vlans, ie with an ID setup on a nic - ok.. And this nic has no native network? Need to understand if this is a native vlan or a tagged vlan.. Is pfsense look for tag and sending with a tag or not, etc.

As to each device is multihomed? That is going to be problematic for sure - why??

If your going to put all your device in all your vlans - the whole point of a vlan or segmentation at all is just pretty pointless..

stephenw10

@Coop59 said in Initial Configuration:

Each vlan is assigned to a Nic

In pfSense? The unclear part is that you said 'hosts' which made us wonder if that meant the other hosts on the network. That would be unexpected but...
Edit: Oh it actually is that each host has an interface in each vlan?

Assuming it is in pfSense then all traffic between VLAN is routed through pfSense. pfSense will route that by default as long as firewall rules exist to pass it.

Hosts on those VLANs may not respond to connections from other subnets though.

Coop59

@johnpoz

They are actual VLans 1 2 and 3, 1 is the actual 1st network. 1.0/24, VLan 2 is .2.0/24, VLan 3 is .3.0/24. They are just on the Proxmox Hosts sorry if that confused you. Each Proxmox Hosy has 3 nics, The Vlans are assigned to the Nics.

I hope that is more clear. I am not sure but i have the 2 of the 3 Vlans tagged (2 and 3) No pfsense is not configure to do so I just created a Vlan and assigned to the Interfaces.

I don't know anything about mutlihomed so the answer would be a no. No I am not wanting to put all my devices on all the VLans I want one workstatuin and all pf the Proxmox hosts there are only 4 of them.\

Coop59

@stephenw10

Thank you sir. Like I said I am not a network guy so I have no clue I am learning as I go. I have 2 Vlans created in pfSense one is assigned to my 2nd Nic and Vlan3 is assigned to the 3rd nic. I figured that issue may be I have to create rules so I will try to do that.

Thank you for your response.
Michael

johnpoz

@Coop59 said in Initial Configuration:

I hope that is more clear. I am not sure but i have the 2 of the 3 Vlans tagged (2 and 3) No pfsense is not configure to do so I just created a Vlan and assigned to the Interfaces.

Please just show us your pfsense setup.. These a vlans..

If pfsense just has interfaces - these or not "vlans" on pfsense - you might have them as vlans on your switch.. But they are not "vlans" to pfsense.

see lan wlan dmz w_roku, etc.. those are just native networks on those interfaces in pfsense. No tags..

Coop59

@johnpoz
The nics as you can tell are physical nics and the vlans are assigned to them I know it is wrong.

That could be why it didn't work:

I am pretty sure this is wrong, sorry guys, I am trying to be clear and concise on this.

stephenw10

That's not necessarily wrong. It depends what those NICs are connected to and how that is configured (I expect switch ports).

However vtnet is a virtual NIC type. pfSense is running as a VM? How is the hypervisor configured.

Coop59

@stephenw10

How do you mean how is it configured?

I have the 3 physical Nics 2 of the 3 Nics are configured as VLan aware.

each one is assigned an IP range.

the 3rd Nic is for storage and is on a multi GB Switch.

stephenw10

I mean how the switch ports are configured that it's connected to.
But since it looks like you are also running those connections through a hypervisor it also depends how that is configured.

Do you have 3 separate network bridges configured in Proxmox? You may not need VLANs at all here if everything is virtual.

Coop59

@stephenw10

Each host is configured like this (above)

The Main Switch:

VLan 1

Vlan2

Vlan3

I think that should be enough to give you an idea. Thank you in advance for your time.
Michael

stephenw10

OK, so which switch ports are the NIXs in Proxmox from each bridge connected to?

Where are the hosts connected that cannot communicate?

Coop59

@stephenw10
Hey Stephen,

Thank you for responding sorry I was busy at work all week. Just now seeing this.
Port 12 is the trunk port to the unmanaged switch and the PVID is 3, and the Promox hosts are connected to 11,12,13,15 and the PVIDs are 2.

Now with that said the 3rd Nic in the Proxmox hosts are physically plugged in to ports 1,2,3,4 of the unmanaged 2.5 gb switch. They talk to each other fine I can ping host1 from host2, host3 amd so on and vice-versa. However I get a failed response when I ping pfsense at .3.0/24 network (Vlan3). Just an fyi it does ping itself successfully (pfSense I mean). Oh, and I can ping .3.1 (pfSense) from my workstation which is on .2.0/24 network. So I am trying to figure out where the disconnect is. I create a rule in the firewall from the lan to the wan and I also created a rule from the lan to the lan as well and it still is not working.

I hope that explains it better.

Thank you again,
Michael

P.S. @johnpoz @stephenw10 Thank you sincerely for helping I appreciate you guys. Since my last post I have bought a Managed Multi GB router that has 8 access ports and one uplink port. A Cheap one but I am learning when I get good at this I will buy a nice one.

stephenw10

@Coop59 said in Initial Configuration:

Port 12 is the trunk port to the unmanaged switch

You mean port 19? That's the only trunk port shown in the screenshots.

All 3 VLANs are untagged on port 12 which is odd. You would normally only ever have one VLAN untagged on a port and that should match the PVID in order to pass traffic both ways.

You have 4 Proxmox hosts? With VMs on each?

I think a diagram may help here.

johnpoz

@stephenw10 said in Initial Configuration:

All 3 VLANs are untagged on port 12 which is odd.

Odd is the wrong word, borked is the word your looking for ;)

You can't run multiple untagged vlans on same port and expect something to figure out what traffic is what..

stephenw10

I mean... there are some scenarios where that's legitimate but.... probably not this one!

Coop59

Hello Guys,

I will try and make a map of the way I have it now. So I may have misunderstood what a trunk was I thought a Trunk could be tagged or untagged and an untagged trunk goes to an unmanaged switch. Tagged is suppose to be an uplink and a port for all tagged traffic to communicate with the switch upstream from it.

Is this understanding incorrect?

Thank you,
Michael

Coop59

@stephenw10
I believe you are correct in your response. Unfortunately I suck at networking. I have a friend who is a network guru but I can't pin him down because facebook is running him ragged right now.

Thanks again sir,
Michael

johnpoz

@stephenw10 said in Initial Configuration:

. there are some scenarios where that's legitimate but.

Yeah I have seen them setup, many an ISP run multiple layer 3 on the same layer 2... If your in the process of transition from one ip range to another IP range, etc..

But if your goal is to create 3 different vlans, just running multiple layer 3 on the same layer 2 is borked way to go about it.

stephenw10

Trunk is actually a Cisco term but is commonly used to refer to a link that carries more than one VLAN. A trunk can carry tagged and untagged traffic but in order to keep them separated only one VLAN can be untagged.