VLAN accessed wirelessly can not access internet

[hasekd]

@viragomann as access point

[viragomann]

@hasekd
So you might have a bridge device (br-lan), where you have to configure the VLANs on:
Network > Interfaces > Devices
br-lan > configure > Bridge VLAN filtering
Enable VLAN Filtering

Here you have to set connected network port as tagged for your VLANs.

Then create interfaces for your VLANs:
Network > Interfaces > Add new interface > Name [give it a name] > Protocol [Unmanaged] > Device [select your Sofware VLAN: br-lan.xx]

Then use these interfaces in the VLAN configuration.

Did you configure it this way?

[hasekd]

@viragomann I tried it this way. Now I am connected to the wifi with the IoT interface, but I get IP from my main network. This is the configuration:

[viragomann]

@hasekd
Did you also create an interface, with the VLAN device?
And is it selected in the respective WLAN settings?

[hasekd]

@viragomann I thought that this what I created is the interface with the VLAN device. It is selected in the WLAN

[viragomann]

@hasekd
So the Wifi is connected to the VLAN and should be properly separated on the OpenWRT.

However, if a Wifi device, which is connected to this SSID, gets an IP of another network it might lack anywhere else. Maybe on the switch?

[hasekd]

@viragomann
This is my switch conf. On port 1 I have pfsense port 5 - homeassistant that is connected via ethrnet cable, port 4 - OpenWRT

[viragomann]

@hasekd
I don't know this switch, but looks plausible so far.

Anyway, to investigate just plug the OpenWRT directly into the pfSense NIC port and see if you get an IP out of the VLAN then.

[hasekd]

@viragomann
Still have the IP from main lan

[viragomann]

@hasekd
Did you even renew it?

Can you post screenshots from the OpenWRT Interfaces page and the WLAN interface settings?
And as well from pfSesse Interface assignments.

[hasekd]

@viragomann
I did

[viragomann]

@hasekd
Seems, you did all right.
So I don't understand, why the Wifi device gets an IP from the LAN.

Are you sure, it got the IP from pfSense?
Check Status > DHCP Leases
The lease should be shown up there if it's from pfSense.

[hasekd]

@viragomann
I have it there

Or it could be something wrong with my firewall setting?

[viragomann]

@hasekd
I don't think so. DHCP requests from the client go to the broadcast address. If this IP is coming from the IoT network it would only be able to go to the main DHCP server (to the other network) if you have bridged both on pfSense, which wouldn't make any sense if you intend to separate the networks.

[hasekd]

@viragomann
I tried to make renew again and now I get IP address from OpenWRT I think, because it is not listed in the pfsense leases and also I have DHCP from 10.64.27.10 - 10.64.27.60 and I have 10.64.27.130

[viragomann]

@hasekd
You can disable the DHCP on OpenWRT.
For an access point set up, it's recommended to disable DHCP, firewall and DNS in System > Startup.

I've actually also removed the concerned packages.

[hasekd]

@viragomann
What do you mean with the concerned packages like where are they located? But still not getting the VLAN IP address

[viragomann]

@hasekd
The DHCP, firewall and Unbound packages. You can install / remove packages System > Software.
However, this is not really needed, just disabling them in System > Startup is basically sufficient.

Did you enable the DHCP server in pfSense on the IoT interface?

To see, what's going on in this network, you can sniff the traffic on IoT using Packet Capture. Enter "67 68" into the port filter (any of) to get only DHCP traffic.
Start the capture and reconnect a device to the wifi.You should see an DHCP REQUEST then from it and response from the server.

[hasekd]

@viragomann
I have DHCP server enabled on IoT

I tried the Packet Capture and it capture traffic only when I select LAN interface and it even capture traffic when I connect to IoT WLAN and on the IoT interface it does not capture anything