VLAN support with TP-Link AX1800 Wi-Fi 6 Router

erichium · Oct 11, 2024, 2:29 AM

I was hoping to use separate my home network traffic using VLANs. I have the following hardware:

pfSense 2100
TP-Link AX1800 Wi-Fi 6 Router
modem from ISP

I have spent a few hours at this point trying to get this configured, but I could use some help either configuring it or determining if what I want to do is even possible.

Can I set up VLAN support in pfSense such that the wifi traffic from the TP-Link router goes through one VLAN and the hard-wired traffic from the TP-Link router goes through another VLAN? I've seen that the router has support for IPTV/VLAN, but I think I'm coming to the conclusion that, that's not really supporting VLAN for pfSense.

One follow-up question, is it possible to direct traffic from the TP-Link router to a VLAN if the router is configured in AP mode? I could not figure out how to do it if it is possible.

johnpoz · Oct 11, 2024, 2:50 AM

@erichium unless that router supports 3rd party firmware it is highly unlikely that it supports vlan tags so no its not going to work how you want. I don't believe any of the AX models from tplink do though??

You can for sure just use it as an AP and put it on whatever network want connected to pfsense.

Any wifi router can be used as just an AP.. just turn off its dhcp server and connect one of its lan ports to the network you want it on.

If you want to run vlans on your wifi - get an actual real AP..

erichium · Oct 11, 2024, 12:37 PM

@johnpoz Thanks. I guess I just needed confirmation.

It should still be possible to direct all traffic on a specific pfSense port to a VLAN though, right?

johnpoz · Oct 11, 2024, 12:57 PM

@erichium sure.. do you have a vlan capable switch your going to plug it into?

If your going to plug it into a port on the 2100, it wouldn't really be a "vlan" ie a tagged network.. you would just put that port on the 2100 on a different network.. And there wouldn't be any tagging, it would just be a native network outside of pfsense.

Yes in the 2100 switch it would be a vlan, but outside pfsense there wouldn't be any tagging.

https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html#configuring-the-switch-ports

If your going to plug it into a vlan capable switch, the the port connected to the AP would be not tagged on vlan X in your switch.. Then on the uplink to the pfsense if on the same wire as other networks, then this vlan for your wifi would be tagged.

stephenw10 · Oct 11, 2024, 12:57 PM

Yes you can certainly separate the ports by VLANs on the 2100. So you can have all traffic from the TP-Link on one interface and all other traffic on a different interface. You just can't separate wired and wireless traffic from the TP-Link or wireless traffic on different SSIDs unless it specifically supports that.