Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Another vlan w/o network access issue

    L2/Switching/VLANs
    vlan internet access
    6
    15
    563
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      masonje
      last edited by masonje

      I swear I have watched about every darn video and googled the junk out of this but I just can't figure it out. On my main box/home firewall I have this problem where sometimes it works, sometimes not until I reboot, sometimes after the reboot the vlan works but others stop. Everything works fine on the main LAN, but I can't get the vlans to work consistently... So I reproduced it on a physical box and small managed switch in my home lab with the same results.

      Create vlans
      c52be291-ad43-4745-a47f-c8074f954e95-Screenshot from 2025-01-16 21-41-45.png

      Set up interfaces
      8181b224-63d8-4e58-83a5-98cd9b88f047-Screenshot from 2025-01-16 21-55-29.png

      Set up DHCP on the vlan
      f8afec5b-9665-4027-b2bc-b413356f6c73-Screenshot from 2025-01-31 23-27-02.png

      Set up the firewall wide open (for now)
      23dbd921-6a98-4860-870c-a09eb7f61169-Screenshot from 2025-01-31 23-27-58.png

      Tag my ports
      237ff75b-2890-4cb5-911f-3ba7e6e2f760-Screenshot from 2025-01-31 23-23-15.png

      Assign those ports to vlans to test each one
      6b410017-fee6-4c51-a359-e370b67a67bf-Screenshot from 2025-01-31 23-23-27.png

      Plug my machine into port 4 on the switch for the IoT vlan (other act the same) and I get the appropreate IP
      efc72747-32e9-4aab-a7f3-b28e99679cf6-Screenshot from 2025-01-31 23-28-37.png

      But can't get out
      ca99d53d-5b53-4d7b-88a8-401820f4006a-Screenshot from 2025-01-31 23-58-31.png

      I swear I did all the right things. Thoughts?

      patient0P 1 Reply Last reply Reply Quote 0
      • patient0P
        patient0 @masonje
        last edited by patient0

        @masonje the screenshots seem to be from different installations and stages (and not from the phyisical box)?
        In the first all the VLANs are on vtnet0, then in the second VLAN10 & 20 are on vtnet3 and VLAN30 is on vtnet0 and Wireless is on it's own interface vtnet2. Then in the firewall rules the before named IOT/IoT is now IOTS.

        Would you mind posting the actual screenshots from one installation that showed the issue?

        After that we probably need more screenshots of the switch VLAN configuration (VLAN Configuration & VLAN Membership)

        J 1 Reply Last reply Reply Quote 0
        • J
          Jarhead @patient0
          last edited by

          @patient0 Just to add, vtnet3 is also listed as an available interface. Meaning it's not even being used.

          1 Reply Last reply Reply Quote 0
          • M
            masonje
            last edited by

            I have an edit but this web site's edit policy isn't letting me get it in. Here's what I want to put.

            I swear I have watched about every darn video and googled the junk out of this but I just can't figure it out. On my main box/home firewall I have this problem where sometimes it works, sometimes not until I reboot, sometimes after the reboot the vlan works but others stop. Everything works fine on the main LAN, but I can't get the vlans to work consistently... So I reproduced it on a physical box and small managed switch in my home lab with the same results.

            Create vlans
            8ce12461-dfb0-4ddf-8bf2-af295e210217-Screenshot from 2025-02-01 11-28-28.png

            Set up interfaces
            027691f8-0156-4d12-a68b-208d3039997e-image.png

            Set up DHCP on the vlan
            e544ae19-1615-487c-949e-1bb254be0a4b-image.png

            Set up the firewall wide open (for now)
            bc38c2b0-d8a3-4b19-8726-39ec87e7be41-image.png

            Tag my ports. Pfsense plugged into port 1. Working off of port 2 with my laptop (vlan1) but working with test laptop on port 4 for IoT network.
            237ff75b-2890-4cb5-911f-3ba7e6e2f760-Screenshot from 2025-01-31 23-23-15.png

            Assign those ports to vlans to test each one
            6b410017-fee6-4c51-a359-e370b67a67bf-Screenshot from 2025-01-31 23-23-27.png

            Plug my machine into port 4 on the switch for the IoT vlan (other act the same) and I get the appropreate IP
            efc72747-32e9-4aab-a7f3-b28e99679cf6-Screenshot from 2025-01-31 23-28-37.png

            But can't get out
            ca99d53d-5b53-4d7b-88a8-401820f4006a-Screenshot from 2025-01-31 23-58-31.png

            I swear I did all the right things. Thoughts?

            I've updated the screenshots/notes. The other screen shots were from when I started this thread and was going to report my proxmox/pfsense setup, but decided to try this physical box and getting the same results.

            G patient0P J 3 Replies Last reply Reply Quote 0
            • G
              Gblenn @masonje
              last edited by

              @masonje A few things that I think of looking at your pictures are:

              VLAN Membership (Netgear UI) : Ports 3, 4 and 5 should be showing a U (Untagged) unless you are connecting to some other managed switch. Or possibly Proxmox in order to have different VM's in different VLANs.

              Also, you are not showing the VLAN Configuration tab, so not sure if that is correct. But each VLAN ID needs to have both ports 1 and 3, 4 or 5 respectively, as members. So ID 20 has ports 1 and 4 as Members, ID 10 has 1 and 3 etc.

              Finally, you seem to have placed Guest and Kids VLAN on the WAN parent interface, that can't be intentional? They should all be living off the LAN right?

              M 1 Reply Last reply Reply Quote 0
              • patient0P
                patient0 @masonje
                last edited by patient0

                @masonje pfSense-wise IoT seems ok, why you put VLAN 30 (Guest) and 50 (Kids) onto the WAN interface, only you can know.

                You wouldn't tag port 4 on the Netgear switch if you want to have VLAN20 to leave port 4 untagged. If you set PVID to 20 on port 4, all the untagged traffic that flows into that port will be tagged with VLAN20.

                Edit: Gblenn beat me to it

                1 Reply Last reply Reply Quote 0
                • the otherT
                  the other
                  last edited by

                  On your trunk between switch and pfsense...
                  The default vlan (usuaĺly pvid 1) should be untagged, alle others tagged.
                  On switch ports connected to a client, vlan x goes untagged.
                  Seems you have that wrong in your screenshot.

                  Why is your interface WAN for guest and kids vlan???

                  the other

                  pure amateur home user, no business or professional background
                  please excuse poor english skills and typpoz :)

                  1 Reply Last reply Reply Quote 0
                  • J
                    Jarhead @masonje
                    last edited by Jarhead

                    @masonje
                    In addition to above:
                    Don't use KEA DHCP. Just gonna give you problems until it's ready for release.
                    Did you enable the DNS resolver on all interfaces?

                    1 Reply Last reply Reply Quote 0
                    • M
                      masonje @Gblenn
                      last edited by

                      @Gblenn Yea I messed up on the guest and kids vlans, but I wasn't focusing on those. Mainly just 20 but good eye. Fixed.

                      Here is the over all configuration. From what I know/told it doesn't matter totally on untagged part. Important part for this is the PVID and it forces that poart to that vlan.
                      8b49d0c0-1394-4b71-838b-6c5bd9dccb1a-Screenshot from 2025-01-31 23-23-46.png

                      patient0P 1 Reply Last reply Reply Quote 0
                      • patient0P
                        patient0 @masonje
                        last edited by

                        @masonje it does matter if you tag a port or not. If you want port 4 to act as a VLAN20 access port (untagged traffic entering port 4 to be tagged with VLAN20) you have to set port 4 in the 'Port PVID' as untagged and (leave) the PVID as 20.

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          masonje @patient0
                          last edited by

                          @patient0 Well there you go.... That was the fix.

                          3c4af57c-ead2-4a9c-bd16-0d9d2061820a-image.png

                          ce0c4aa6-3c95-4692-8854-7347ca919a48-image.png
                          7a0c4a5f-9957-405b-ae19-d6d49e4cf723-image.png
                          2479d54f-0789-4cd2-b10c-cbed970d05da-image.png

                          f780b566-00f3-402e-8c8f-b9607eeed4a3-image.png

                          I guess where I confused is why. Why did I get an IP address before, but couldn't get out?

                          patient0P 1 Reply Last reply Reply Quote 0
                          • patient0P
                            patient0 @masonje
                            last edited by patient0

                            @masonje said in Another vlan w/o network access issue:

                            I guess where I confused is why. Why did I get an IP address before, but couldn't get out?

                            I agree it's odd that DHCP worked, unfortunately I'm not knowledgable enough to answer that.

                            The DHCP client sends out a DHCPDISCOVER broadcast via UDP. Sending should work since PVID on port 4 was set to 20, the request was tagged for VLAN20. How the answer from pfSense made it back, I don't know.

                            The answer is tagged with VLAN20 by pfSense but on the switch the packet get's to port 4 which was set to (T)ag. I'd assume that the tagged packet would reach your client with the packet still tagged as VLAN20. And your client would drop it since he is not configured to handle VLAN20 tagged traffic. But the Netgear does handle it different it seems.

                            Well, lots of words just to say: "I don't really know". Maybe someone with more inside can answer it.

                            G 1 Reply Last reply Reply Quote 0
                            • G
                              Gblenn @patient0
                              last edited by

                              @patient0 said in Another vlan w/o network access issue:

                              @masonje said in Another vlan w/o network access issue:

                              I guess where I confused is why. Why did I get an IP address before, but couldn't get out?

                              I agree it's odd that DHCP worked, unfortunately I'm not knowledgable enough to answer that.

                              The DHCP client sends out a DHCPDISCOVER broadcast via UDP. Sending should work since PVID on port 4 was set to 20, the request was tagged for VLAN20. How the answer from pfSense made it back, I don't know.

                              I suppose it's not so much that the answer made it back, but rather the fact that the device actually picked it up, even though it was tagged.
                              My understanding is that many (most?) NICs are designed to accept both tagged and untagged DHCP responses. And DHCP broadcast, response and ack goes on in layer 2, which is before VLAN is involved...

                              1 Reply Last reply Reply Quote 1
                              • A
                                algo7
                                last edited by

                                It's always Netgear. Their VLAN configuration is always a PITA. Ran into almost the exact issue today.

                                G 1 Reply Last reply Reply Quote 0
                                • G
                                  Gblenn @algo7
                                  last edited by

                                  @algo7 said in Another vlan w/o network access issue:

                                  It's always Netgear. Their VLAN configuration is always a PITA. Ran into almost the exact issue today.

                                  What issue? There was nothing wrong with Netgear, just the port assignments...

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.