Keep subnets running on LAN1 and LAN4 separated using VLAN
-
Hello, I have on a 3100 one network with its subnet attached to port 1 (LAN1), and another network on a different subnet attached to port 4 (LAN4).
Both networks receive internet from the 3100's wan.
LAN1 and LAN4 are attached to physical different switches.I'd like to make sure the two networks cannot talk each other, is it correct to use the default system VLAN and arranging groups (Interfaces/Switch/VLANs) in this way?
Port 5 is the wan port, and I suppose port 1 is on its own and cannot talk to port 4. But I'm new to VLAN and if I'm too much naive even pointing me to a good documentation first is very appreciated. Thank you!VLAN group Port Members Description Action
1 1 5 Default System VLAN
2 2 3,4,5 Default System VLAN
3 3 2,4,5 Default System VLAN
4 4 2,3,5 Default System VLAN
5 5 1,2,3,4 Default System VLAN -
@Bly Netgate has a guide for isolating the ports on the switch:
https://docs.netgate.com/pfsense/en/latest/solutions/sg-3100/configuring-the-switch-ports.html
The uplink is port 5. WAN is not on the switch.
-
@SteveITS Hi sorry for late reply, and thank you for the link!
I also found out (because the subnets are on different physical ports), that I can achieve the isolation with two firewall rules dropping packets from one subnet to the other.
-
@Bly On a 3100 the LAN ports are a switch so all the same port from what pfSense sees. You will need to isolate the ports in order to use separate firewall rules. But once you do that, then yes, they are just like separate ports.
