Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setting up a VLAN part 2

    Scheduled Pinned Locked Moved General pfSense Questions
    110 Posts 3 Posters 40.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      A Former User
      last edited by

      vlan 1 is just the default vlan of the hp switch.

      i am still getting confused with the tagged/untagged.  everytime i think i have it and try to see if what i get matches up with what is said on here, i am always opposite.

      when i am all done with this, i want my HP vlan switch to be accessible via the IP it has, now, which is 192.168.1.20, i dont need to be able to access it from the vlan network (but that is another question at another time).

      what i am wanting to do/test is to have 1 cable connecting my pfsense and the hp vlan switch and over that 1 cable i want to have 192 and 10 traffic.  then, assuming the hp switch is setup properly, i want to do the following

      port1- pfsense LAN
      port2- test laptop or wifi router (statically assigned 10.10.10.2 for access at a later time) 10.10.10.x network (vlan 100)
      port3- cant use (trunked/bond)
      port4- cant use (trunked/bond)
      port5- connects to a PC i want to keep on the 192.168.1.x network
      port6- connects to my 16 port netgear switch that has additional 192.168.1.x devices
      port7- open (no need for vlan100 access)
      port8- open (no need for vlan100 access)

      1 Reply Last reply Reply Quote 0
      • M
        Metu69salemi
        last edited by

        @tomdlgns:

        @Metu69salemi:

        Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
        if so then your settings on switch should be

        
        VLAN 1: U N and the rest U
        VLAN 100: T U and the rest N
        
        Legend:
        U = Untagged
        T = Tagged
        N = no access or similar
        
        

        yes, exactly.

        i will try to set it up like this and report back.

        EDIT- my switch (netgear, not vlan ready) is in port 6 of the vlan switch.  how should i handle that? U for vlan 1 and N for vlan 100?

        Yes like that, if you have switch which doesn't have vlan capability, then you connect that port like any computer.

        
        Port 1: vlan1 untagged, vlan100 tagged <-- best method would be tagged/tagged, but then you should use stephens method
        port 2: vlan2 no access, vlan100 untagged
        port 3: ? 
        port 4: ?
        port 5: vlan1 untagged, vlan100 no access
        port 6: vlan1 untagged, vlan100 no access
        port 7: ?
        port 8: ?
        
        
        1 Reply Last reply Reply Quote 0
        • ?
          A Former User
          last edited by

          @Metu69salemi:

          @tomdlgns:

          @Metu69salemi:

          Was the case that you have your LAN in vlan1 and WIFI in VLAN100 and in same interface?
          if so then your settings on switch should be

          
          VLAN 1: U N and the rest U
          VLAN 100: T U and the rest N
          
          Legend:
          U = Untagged
          T = Tagged
          N = no access or similar
          
          

          yes, exactly.

          i will try to set it up like this and report back.

          EDIT- my switch (netgear, not vlan ready) is in port 6 of the vlan switch.  how should i handle that? U for vlan 1 and N for vlan 100?

          Yes like that, if you have switch which doesn't have vlan capability, then you connect that port like any computer.

          
          Port 1: vlan1 untagged, vlan100 tagged <-- best method would be tagged/tagged, but then you should use stephens method
          port 2: vlan2 no access, vlan100 untagged
          port 3: ? 
          port 4: ?
          port 5: vlan1 untagged, vlan100 no access
          port 6: vlan1 untagged, vlan100 no access
          port 7: ?
          port 8: ?
          
          

          whoa, where is vlan2 from?

          edit- typo, right? that should say vlan1, i assume.

          1 Reply Last reply Reply Quote 0
          • ?
            A Former User
            last edited by

            N for no access is the same as E for Exclude i would imagine.

            my HP uses T, U, E

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Yes N==E.  ;)

              Just take it one step at a time. Varify that each step is doing what you think it should. Most config problems are caused by trying to implement a hundred functions at once and then, when it doesn't work, having no idea which one caused the trouble.

              Steve

              1 Reply Last reply Reply Quote 0
              • M
                Metu69salemi
                last edited by

                You're right it was a typo. And N just meaned that anyway there is no connection between, so it doesn't matter what is the language of your switch

                1 Reply Last reply Reply Quote 0
                • ?
                  A Former User
                  last edited by

                  ok, i set it up as posted but still not getting a 10.10.10.x ip on the spare/test laptop (plugged into port 2 on hp switch).

                  here is what the switch and pfsense look like

                  1 Reply Last reply Reply Quote 0
                  • ?
                    A Former User
                    last edited by

                    one thing to note, the 192 network is working with this setup.

                    when i did this last night, i couldnt get 192 or 10 to work, so i am getting somewhere with the tagging/untagging/excluding.

                    i should also note that both yesterday and today (prior to messing with this) the pfsense lan cable re2 plugged in directly to my netgear.

                    once i started setting this up, i made sure to unplug re2 from my netgear switch into port 1 of the hp switch (vlan switch) just in case someone thought that wasnt happening.

                    thanks

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Hmm, that's not right. Set the participation as Metu69salemi suggetsed earlier.

                      
                      Port      1 2 3 4 5 6
                      VLAN1     U E * * U U
                      VLAN100   T U * * E E
                      
                      

                      If that doesn't work try:

                      
                      Port      1 2 3 4 5 6
                      VLAN1     T E * * U U
                      VLAN100   T U * * E E
                      
                      

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • ?
                        A Former User
                        last edited by

                        @stephenw10:

                        Hmm, that's not right. Set the participation as Metu69salemi suggetsed earlier.

                        
                        Port      1 2 3 4 5 6
                        VLAN1     U E * * U U
                        VLAN100   T U * * E E
                        
                        

                        If that doesn't work try:

                        
                        Port      1 2 3 4 5 6
                        VLAN1     T E * * U U
                        VLAN100   T U * * E E
                        
                        

                        Steve

                        ok, the first config doesnt give my laptop an IP, but 192 network can go online

                        with the second config…i get no ip to my laptop and 192 network cant go online.

                        EDIT- if my pfsense settings look ok, then i can stop looking there.  do you guys want pics of the DHCP server settings?  i set it up the same as 192 DHCP settings, so anything plugged into port 2 of my vlan switch should get an IP address from 10.10.10.x from pfsense.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Ok stick with the first config then.
                          You may as well post your DHCP config, it might help.

                          What exactly are you using ports 3 and 4 for?

                          Have you added firewall rules for the vlan interface? I assumed you had. DHCP should work anyway.

                          The confusing thing here, for me, is that a packet tagged with vlan ID 1 is not the same as an untagged packet.
                          It shouldn't be this difficult so something is obviously wrong somewhere!

                          Steve

                          1 Reply Last reply Reply Quote 0
                          • ?
                            A Former User
                            last edited by

                            @stephenw10:

                            Ok stick with the first config then.
                            You may as well post your DHCP config, it might help.

                            What exactly are you using ports 3 and 4 for?

                            Have you added firewall rules for the vlan interface? I assumed you had. DHCP should work anyway.

                            The confusing thing here, for me, is that a packet tagged with vlan ID 1 is not the same as an untagged packet.
                            It shouldn't be this difficult so something is obviously wrong somewhere!

                            Steve

                            ports 3/4 are trunked/bonded to my NAS.  just trying to get the most i can with two cat5 cables.  the nas also has a 'bond' with the two nic ports.

                            here is the DHCP screen shot for 10.10.10.x and i have not written any firewall rules, i agree with you in that it should still assign it an IP address.

                            1 Reply Last reply Reply Quote 0
                            • M
                              Metu69salemi
                              last edited by

                              can you show your rules of wifi interface?

                              and still i'd like to use that

                              
                              port:        1 2 3 4 5 6 7 8 
                              vlan1:       U E U U U U U U
                              vlan100:     T U E E E E E E
                              
                              

                              or then go the later solution(port 1 tagged in both vlans), but you'll have to setup management on other nic and networks in other nic

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                This could be the reason the tagged and untagged traffic should not be on the same interface.  ::)
                                I have not experienced how problems would show up.

                                Steve

                                Edit: Reading 'the definitive guide' for inspiration I see that this could be a problem related to the NIC not supporting the increased frame size required by the VLAN tag.
                                In particular it mentions that Realtek interfaces may not support it even if they report doing so. Though that is for rl(4) rather than re(4).

                                1 Reply Last reply Reply Quote 0
                                • ?
                                  A Former User
                                  last edited by

                                  @Metu69salemi:

                                  can you show your rules of wifi interface?

                                  and still i'd like to use that

                                  
                                  port:        1 2 3 4 5 6 7 8 
                                  vlan1:       U E U U U U U U
                                  vlan100:     T U E E E E E E
                                  
                                  

                                  or then go the later solution(port 1 tagged in both vlans), but you'll have to setup management on other nic and networks in other nic

                                  ok, i will take a look at that setup and report back.

                                  also, unless some default rules were put in place, i didnt create any rules, but i will post a screen of that and add in some common/default rules to see if that does it.

                                  1 Reply Last reply Reply Quote 0
                                  • ?
                                    A Former User
                                    last edited by

                                    @stephenw10:

                                    This could be the reason the tagged and untagged traffic should not be on the same interface.  ::)
                                    I have not experienced how problems would show up.

                                    Steve

                                    Edit: Reading 'the definitive guide' for inspiration I see that this could be a problem related to the NIC not supporting the increased frame size required by the VLAN tag.
                                    In particular it mentions that Realtek interfaces may not support it even if they report doing so. Though that is for rl(4) rather than re(4).

                                    if the above config doesnt work, i am going to stop trying to do it with 1 NIC and will bring in the second nic.

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Here is what I would do:
                                      Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)

                                      Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.

                                      Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.

                                      Add more VLANs once that's working.

                                      Steve

                                      1 Reply Last reply Reply Quote 0
                                      • ?
                                        A Former User
                                        last edited by

                                        @stephenw10:

                                        Here is what I would do:
                                        Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)

                                        Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.

                                        Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.

                                        Add more VLANs once that's working.

                                        Steve

                                        everything you mentioned is my problem (tagging/untagging).

                                        since i get confused, i wont know if i am doing it right.

                                        not sure how to setup management to be accessible from both vlans?

                                        also, you can see how the trunk was configured in the pics above.  i dont think there are issues with that, worst case scenario (if i set it up wrong) i wont be able to access my NAS, not critical.

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          I meant the second interface on the pfSense box so you don't get locked out of pfSense.

                                          It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
                                          It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.

                                          Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.

                                          Steve

                                          1 Reply Last reply Reply Quote 0
                                          • ?
                                            A Former User
                                            last edited by

                                            @stephenw10:

                                            I meant the second interface on the pfSense box so you don't get locked out of pfSense.

                                            It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
                                            It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.

                                            Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.

                                            Steve

                                            gotcha…yeah, i might just give up on trying to do it with 1 nic/1 cable mainly because i forgot about the compatibility issue, even if it is setup right, i might be using a nic card that isnt compatible.

                                            thanks for the help to all up to this point.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.