ATT Internet AIr

[ahole4sure]

@Gblenn @stephenw10

Thank you both for chiming in so quickly!! Really helpful thoughts because I have a full switch up in the ceiling area for the cameras and re-designing my network with another or new VLAN capable switch up in the ceiling for the modem might be the way to go - thanks @Gblenn for the thoughts.

My real issue now is that I don't understand why my ATT modem set to passthough mode is not sending the IP address through the VLAN to the pfsense with the interface set to DHCP mode ?? (like I thought I remembered it doing for the first ATT modem I setup a couple weeks ago)

Does a modem device set to pass through "normally" send the info through to the router it's connected to?? I seem to remember that with my cable/fiber modem I had the manually set the IP address for the interface. But I swear that I remember the first ATT modem pushing through the IP.

And apologies for the weirdness of my situation partly induced by my second location being 5 hr drive away - would require drive, hotel stay, etc if I can't get this troubleshooting done remotely and by testing

[stephenw10]

Yes I would expect it to allow pfSense to pull a lease from AT&T directly. But I think you need to confirm that with a direct connection.

If you got any part of the VLAN or switch setup wrong it would just fail entirely. Since you are seeing ping responses to it (with high latency) it is passing traffic so the switch/vlan config is almost certainly correct.

[Gblenn]

@ahole4sure I think you are right in your assumption that the modem should pass through the IP from the ISP if it's in bridge mode. It may however also make use of VLAN for the management interface? Check the manual?

In this picture I see that you have not assigned the parent interface igb3, only VLAN 10?

And this should work, and it should receive an IP from ATT and pass traffic.. But I would have removed that assignment and use the parent interface igb3 as is instead. Simply setting it up like you did with igb0.
One thing that may mess things up is that you also have VLAN 1 on ports 1 and 2. So you could end up having some other device on the switch picking up the IP from ATT?? If you clean it up and remove any other VLAN membership than VLAN 10 on port 1 and 2.

Or, perhaps the intent is to actually use the secondary WAN port also for LAN traffic? Although you have more than enough ports so I can't see that it's necessary...

Perhaps a better understanding of your desired setup would be good?

WAN1 - Fiber connection (igb0)
WAN2 - 5G connection set up as failover (igb2 to be used once you are through testing?)
LAN - this is default VLAN tag 1 on all switches. Is this what you called EeroLAN in the drawing?

VLAN 10 to be used only to pass along the 5G modem connection.
VLAN 20 is for Cameras
VLAN NN for NAS??

[ahole4sure]

@Gblenn The pics above , I believe , explain what is needed. Bottom line I have had a network setup for 2 years running flawlessly. The problem was that we decided we needed failover internet after a recent outage (and resultant business loss). The issue was that all 4 ports on the pfsense device were full
So we decided to at the switch and utilize VLANs to turn one port on the pfsense into 2 ports ...
1 - for the addnl WAN
and the 2nd) - for the orginal Camera LAN that was already connected to the port on the pfsense originally

Since that port will be utilized as a trunk for both the new WAN and the existing Camera LAN I am not clear on how I should "assign" the parent interface ??? Maybe @stephenw10 could offer insight on this as well. I understand that the parent interface can remain assigned - but how do you assign a parent interface??

[stephenw10]

You don't need to assign the parent interface if you are using two VLANs for the two subnets.

You would only assign the parent if you want the trunk link to carry untagged traffic and my preference is to avoid that if possible. And it's certainly possible here.

[Gblenn]

@ahole4sure said in ATT Internet AIr:

Since that port will be utilized as a trunk for both the new WAN and the existing Camera LAN I am not clear on how I should "assign" the parent interface ??? Maybe @stephenw10 could offer insight on this as well. I understand that the parent interface can remain assigned - but how do you assign a parent interface??

Like @stephenw10 is saying, you don't have to. It was just my idea of putting all VLAN's on one interface, which included your default LAN. But that would also mean having untagged traffic on that trunk, which isnt' really best practice I suppose...

If you want to use that port for both Camera and ATT WAN, I guess you are missing VLAN 20 on the pfsense side. So that needs to be added like you did with VLAN 10.

[ahole4sure]

@stephenw10
Again thank you for your help!
This is probably a continued VLAN question but I think there is some pfsense general stuff going on.

I finally got the 2 Failover modems to connect to the pfsense as intended - BUT it took hours of experimentation.
Main question(or topic) is that I just couldn't get DHCP to work for creating (and maintaining) the interface and esp the gateway -- it seemed to have to do with assigning the parent interface (or not) and possibly some weird MAC addresses showing up (maybe it was the MAC address of the switch port (not really sure) ...
the only way I seemed to have a stable configuration was to set the VLAN interface to static , create a "static" gateway, and then HAD to delete the gateway that was auto created by the DHCP initially
Note: the DHCP config of the VLAN interface worked initially but then the created gateway started showing weird addresses (not even on my network) like 192.168.224.1 (see FIRST PIC ) ( the subsequent remaining pics are the working setup that ended up after static config)

Any ideas why the DHCP setup / config is failing? Is it MAC address issues? When a DHCP server doles out an address to VLAN what MAC address does it see? Does it see the parent interface MAC address? And what if the parent MAC address is configured and then used as a VLAN trunk - is the same MAC address used for the parent and the VLAN interface??

I can use the static as long as ATT is willing to keep providing static addrress for my modem. So that's not the end of the world but it would be nice to understand the process for the future ..... I even have a third location with much different network for later

[ahole4sure]

@stephenw10
here are the rest of screenshots

[ahole4sure]

@stephenw10
Here are the rest

[Gblenn]

@ahole4sure That very last part, "Use mobile router as DHCP server"... why is that turned on?

[stephenw10]

Yeah seems like it should be pulling a lease from a remote dhcp server at AT*&T somewhere. But that gateway you're getting is outside the range of both....