Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setting up a VLAN part 2

    Scheduled Pinned Locked Moved General pfSense Questions
    110 Posts 3 Posters 40.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Metu69salemi
      last edited by

      create a new vlan say 10 or something else than 1 or 100
      Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
      so your network would be
      nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
      vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
      vlan100 (on same nic as vlan10): this would be same as currently

      then add current configs to switch
      vlan10:  T U U U U U E E
      vlan100: T E E E E E U U
      remember to connect port 1 to pfsense

      1 Reply Last reply Reply Quote 0
      • ?
        A Former User
        last edited by

        @Metu69salemi:

        create a new vlan say 10 or something else than 1 or 100
        Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
        so your network would be
        nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
        vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
        vlan100 (on same nic as vlan10): this would be same as currently

        then add current configs to switch
        vlan10:   T U U U U U E E
        vlan100: T E E E E E U U
        remember to connect port 1 to pfsense

        ok, what does vlan1 look like in the hp switch?

        i think you just confused me more.

        1 Reply Last reply Reply Quote 0
        • M
          Metu69salemi
          last edited by

          in this topology it doesn't exist
          It is only "console" access to the firewall

          1 Reply Last reply Reply Quote 0
          • ?
            A Former User
            last edited by

            @Metu69salemi:

            in this topology it doesn't exist
            It is only "console" access to the firewall

            let me rephrase.

            that is ok if it is there and i dont use it, but i will have it in my switch.  after reading the post, it seems as if my switch needs to look like this

            vlan1
            vlan10
            vlan100

            maybe we should start with pfsense, do i have that configured properly?

            re0- WAN
            re1- vlan100 (10.10.10.1) dhcp enabled
            re2- LAN (192.168.1.1) dhcp enabled

            –------------------
            pfsense LAN goes into HP port 1 (vlan?) 192.168.1.x


            pfsense vlan100 goes into HP port 7 (vlan100 on hp switch) 10.10.10.x and port 8 needs to be on vlan100 as well.

            EDIT-

            does the pfsense NIC even need to be a VLAN?  if i am using a seperate NIC, shouldnt i be able to assign it to 10.10.10.x and deal with VLANs in the HP switch to segregate 10 traffic vs 192 traffic?

            1 Reply Last reply Reply Quote 0
            • ?
              A Former User
              last edited by

              did you guys give up on me?

              ;D

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Sorry I was out on an all night 120 mile cycle ride Saturday night. Yesterday was pretty much a write off!  :)

                I think we could easily loose sight of the big picture here.
                The aim of this exercise is to learn about VLANs. The configuration we are hoping to end up with is:
                pfSense using two interfaces, WAN on re0 and VLANs on re1.
                The HP switch configured to split the VLANs between some it's ports. Such that some ports are pfSenses LAN interface and some are pfSenses other interface.

                Although you have LAN setup on re2 at the moment that's only temporary while we configure VLANs on re1.

                Setup another VLAN as  Metu69salemi suggested.

                You should only have one cable between pfSense (re1) and the trunk port on the switch (port1).

                Steve

                1 Reply Last reply Reply Quote 0
                • ?
                  A Former User
                  last edited by

                  @stephenw10:

                  Sorry I was out on an all night 120 mile cycle ride Saturday night. Yesterday was pretty much a write off!  :)

                  I think we could easily loose sight of the big picture here.
                  The aim of this exercise is to learn about VLANs. The configuration we are hoping to end up with is:
                  pfSense using two interfaces, WAN on re0 and VLANs on re1.
                  The HP switch configured to split the VLANs between some it's ports. Such that some ports are pfSenses LAN interface and some are pfSenses other interface.

                  Although you have LAN setup on re2 at the moment that's only temporary while we configure VLANs on re1.

                  Setup another VLAN as  Metu69salemi suggested.

                  You should only have one cable between pfSense (re1) and the trunk port on the switch (port1).

                  Steve

                  hmmm, now i am confused, it is official.

                  i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

                  wasnt the recommendation to use 3 NICS?

                  re0- WAN
                  re1- VLANs (originally not in play)
                  re2- LAN (for 192.168.1.x network)

                  that would mean two connections from pfsense to my switch

                  re1- for VLANs (or 10.10.10.x network)
                  re0- for the regular 192.168.1.x network

                  unless i missed something, that is how i thought it was going to end up.

                  thanks.

                  (btw, i dont blame you for taking the day off, the weekends are there to enjoy and relax, sounds like you did both)  :)

                  1 Reply Last reply Reply Quote 0
                  • ?
                    A Former User
                    last edited by

                    i have access to another switch i can use, but it isnt in the mix yet, just want some feedback…

                    it is an HP switch, but a little more advanced/better GUI than the one i am using.

                    in this switch, the vlan has 4 options:

                    no
                    tagged
                    untagged
                    forbid

                    i assume forbid= exclude

                    or is it

                    no=exclude

                    part of the confusion is that:

                    -i have never had to use vlans, but i want to learn
                    -every piece of device i have logged into with vlan capabilities has a different 'look' to it.

                    1 Reply Last reply Reply Quote 0
                    • M
                      Metu69salemi
                      last edited by

                      Please see attached file
                      you could also allow from the switch to use another management ip from another vlan or setup another management vlan

                      vlans.png
                      vlans.png_thumb

                      1 Reply Last reply Reply Quote 0
                      • ?
                        A Former User
                        last edited by

                        @Metu69salemi:

                        Please see attached file
                        you could also allow from the switch to use another management ip from another vlan or setup another management vlan

                        what is console? 1 PC i have connected to pfsense just to login to it to make changes?

                        also, wiring it up isnt a problem.

                        if i wire it i need to be able to build out the vlans for it to function properly.

                        i need guidance on that portion.  i guess i need to go to the HP forums and ask them what the proper way to tag/untag is?  that is my issue here (i think pfsense is setup properly).

                        thanks.

                        1 Reply Last reply Reply Quote 0
                        • M
                          Metu69salemi
                          last edited by

                          Console means, that you sit next to that machine, but in this case it's only needed if you have locked you self out from another vlan

                          1 Reply Last reply Reply Quote 0
                          • ?
                            A Former User
                            last edited by

                            @Metu69salemi:

                            Console means, that you sit next to that machine, but in this case it's only needed if you have locked you self out from another vlan

                            the HP switch has a management port section where i can dedicate 1 of the ports as a managed port.

                            i dont think that will be an issue unless i screw up the tagging/untagging/exclude, which is where i am stuck.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              @tomdlgns:

                              hmmm, now i am confused, it is official.

                              i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

                              wasnt the recommendation to use 3 NICS?

                              re0- WAN
                              re1- VLANs (originally not in play)
                              re2- LAN (for 192.168.1.x network)

                              Originally you wanted to use just two interfaces on the pfSense machine so that is what we are attempting to achieve. We only recommended you setup re2 so that you didn't get locked out of pfSense if you configured VLANs incorrectly. You have assigned LAN to it but we didn't expect you to. It could be any OPT interface.

                              @tomdlgns:

                              that would mean two connections from pfsense to my switch

                              re1- for VLANs (or 10.10.10.x network)
                              re0- for the regular 192.168.1.x network

                              unless i missed something, that is how i thought it was going to end up.

                              Whilst you could have both interfaces connected to the switch it would be far more complex to setup and MUCH more likely to cause problems.

                              Technically you don't need use VLANs at all, you want two subnets and you have two interfaces.

                              Let me layout what I expect the final configuration to be.

                              WAN - re0
                              LAN - VLAN10 - re1      192.168.1.X
                              OPT1 - VLAN100 - re1  10.10.10.X
                              OPT2 - re2                  192.168.2.X

                              I hope that makes some sort of sense!

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • ?
                                A Former User
                                last edited by

                                @stephenw10:

                                @tomdlgns:

                                hmmm, now i am confused, it is official.

                                i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

                                wasnt the recommendation to use 3 NICS?

                                re0- WAN
                                re1- VLANs (originally not in play)
                                re2- LAN (for 192.168.1.x network)

                                Originally you wanted to use just two interfaces on the pfSense machine so that is what we are attempting to achieve. We only recommended you setup re2 so that you didn't get locked out of pfSense if you configured VLANs incorrectly. You have assigned LAN to it but we didn't expect you to. It could be any OPT interface.

                                @tomdlgns:

                                that would mean two connections from pfsense to my switch

                                re1- for VLANs (or 10.10.10.x network)
                                re0- for the regular 192.168.1.x network

                                unless i missed something, that is how i thought it was going to end up.

                                Whilst you could have both interfaces connected to the switch it would be far more complex to setup and MUCH more likely to cause problems.

                                Technically you don't need use VLANs at all, you want two subnets and you have two interfaces.

                                Let me layout what I expect the final configuration to be.

                                WAN - re0
                                LAN - VLAN10 - re1       192.168.1.X
                                OPT1 - VLAN100 - re1   10.10.10.X
                                OPT2 - re2                   192.168.2.X

                                I hope that makes some sort of sense!

                                Steve

                                this gets better and better

                                where is 192.168.2.x coming from? and now another NIC?

                                -i'd like to setup a VLAN so i can work/test with it
                                -i can easily setup a second NIC/subnet using another switch, but that wont incorporate a VLAN, so i dont want to go that route.

                                what i planned on was this:

                                re0-WAN
                                re1- VLAN100 10.10.10.x
                                re2- my regular lan 192.168.1.x

                                what i wanted to do was then use my hp switch to work with the pfsense box

                                ports 1-4 would run the 192.168.1.x network and ports 5-8 would be tagged ports on vlan 100.  i assumed that doing it this way would allow anything plugged into ports 5-8 would work on the vlan100 network.

                                later on, if i introduced a second vlan, vlan200 i THOUGHT i would be able to untag ports 7.8 and tag those in vlan 200 to work on another subnet.

                                apparently i am wrong in how vlans work, but i thought that was the entire point of VLANS… separate networks on the same physical switch.

                                edit-

                                are you guys saying that i cant have anything on the default lan tagged with vlan 100 traffic?

                                do i need to do something like this

                                default vlan- EEEEEEEE (this would need a 'console PC' so i could login to pfsense on 192.168.1.1 and make changes)
                                vlan10- TTTTUUUU (ports 1-4 tagged for vlan10)
                                vlan100-UUUUTTTT (ports 5-8 tagged for vlan100)

                                or am i still way off?

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  @tomdlgns:

                                  this gets better and better

                                  :D

                                  @tomdlgns:

                                  where is 192.168.2.x coming from? and now another NIC?

                                  192.168.2.X is just a subnet I invented to be the extra interface used for admin access.
                                  There are still only 3 NICs but there are two VLANs on re1.

                                  @tomdlgns:

                                  -i'd like to setup a VLAN so i can work/test with it
                                  what i planned on was this:

                                  re0-WAN
                                  re1- VLAN100 10.10.10.x
                                  re2- my regular lan 192.168.1.x

                                  Ok, we can aim for this. This will use three NICs at the end where as originally you wanted to use just two.

                                  @tomdlgns:

                                  what i wanted to do was then use my hp switch to work with the pfsense box

                                  ports 1-4 would run the 192.168.1.x network and ports 5-8 would be tagged ports on vlan 100.  i assumed that doing it this way would allow anything plugged into ports 5-8 would work on the vlan100 network.

                                  later on, if i introduced a second vlan, vlan200 i THOUGHT i would be able to untag ports 7.8 and tag those in vlan 200 to work on another subnet.

                                  Yes that's what we will do except that you will need 2 of the ports on your switch to connect to the pfSense box so you will only have 6 left for connecting clients (or other switches).

                                  @tomdlgns:

                                  apparently i am wrong in how vlans work, but i thought that was the entire point of VLANS… separate networks on the same physical switch.

                                  You are right, that's exactly what they're for.

                                  Here is the switch config I would expect to work for your current setup:

                                  
                                  port:        1 2 3 4 5 6 7 8 
                                  vlan1:       E E E E U U U U
                                  vlan100:     T U U U E E E E
                                  
                                  

                                  In which port 1 is connected to re1 and port 8 is connected to re2.
                                  This will give you 10.10.10.x on ports 2-4 and 192.168.1.X on ports 5-7.

                                  Are all your NICs identical?

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • ?
                                    A Former User
                                    last edited by

                                    @stephenw10:

                                    @tomdlgns:

                                    this gets better and better

                                    :D

                                    @tomdlgns:

                                    where is 192.168.2.x coming from? and now another NIC?

                                    192.168.2.X is just a subnet I invented to be the extra interface used for admin access.
                                    There are still only 3 NICs but there are two VLANs on re1.

                                    @tomdlgns:

                                    -i'd like to setup a VLAN so i can work/test with it
                                    what i planned on was this:

                                    re0-WAN
                                    re1- VLAN100 10.10.10.x
                                    re2- my regular lan 192.168.1.x

                                    Ok, we can aim for this. This will use three NICs at the end where as originally you wanted to use just two.

                                    @tomdlgns:

                                    what i wanted to do was then use my hp switch to work with the pfsense box

                                    ports 1-4 would run the 192.168.1.x network and ports 5-8 would be tagged ports on vlan 100.  i assumed that doing it this way would allow anything plugged into ports 5-8 would work on the vlan100 network.

                                    later on, if i introduced a second vlan, vlan200 i THOUGHT i would be able to untag ports 7.8 and tag those in vlan 200 to work on another subnet.

                                    Yes that's what we will do except that you will need 2 of the ports on your switch to connect to the pfSense box so you will only have 6 left for connecting clients (or other switches).

                                    @tomdlgns:

                                    apparently i am wrong in how vlans work, but i thought that was the entire point of VLANS… separate networks on the same physical switch.

                                    You are right, that's exactly what they're for.

                                    Here is the switch config I would expect to work for your current setup:

                                    
                                    port:        1 2 3 4 5 6 7 8 
                                    vlan1:       E E E E U U U U
                                    vlan100:     T U U U E E E E
                                    
                                    

                                    In which port 1 is connected to re1 and port 8 is connected to re2.
                                    This will give you 10.10.10.x on ports 2-4 and 192.168.1.X on ports 5-7.

                                    Are all your NICs identical?

                                    Steve

                                    thanks steve.  i didnt realize, until after i posted, that you were using the same nic for the other vlan, my bad on that.

                                    i have 3 nics now and i wanted to only use 2 until it was brought up that carrying multiple vlan traffic over 1 wire/nic might not work if the nic isnt vlan compatible, that is when the second LAN NIC (3rd NIC if you count WAN) was introduced.

                                    i realize i will only have 6 ports to use for devices, but what i was getting at was that 1-4 was for 1 subnet and 5-8 was for another subnet (or did i mess up again)? 1 and 5 would be used for the respective NICs on pfsense.

                                    my main goal is to

                                    -incorporate a vlan
                                    -not lock myself out of anything

                                    i want to keep my existing 192.168.1.x network as is (for the other devices on it) and i want to be able to manage pfsense from any 192.168.1.x computer

                                    knowing all of that, do you still suggest i connect/configure my network with what your last posted stated?

                                    i dont mind a little redesign, but i want to make sure we are talking about the same stuff when i begin to implement this

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Yes try my last suggestion. It should work, then again I thought that before!  ::)

                                      Steve

                                      1 Reply Last reply Reply Quote 0
                                      • ?
                                        A Former User
                                        last edited by

                                        @stephenw10:

                                        Yes try my last suggestion. It should work, then again I thought that before!  ::)

                                        Steve

                                        ok thanks, will try that

                                        can you explain why only 1 port is Tagges on vlan100?

                                        port:        1 2 3 4 5 6 7 8
                                        vlan1:      E E E E U U U U
                                        vlan100:    T U U U E E E E

                                        why isnt vlan100: T T T T E E E E

                                        i understand why vlan1 is E E E E (those ports are for vlan100) and U U U U on vlan100 are untagged packets for the 192.168.1.x network, correct?

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          The three different port modes are like this as I understand it, though I don't actually have an HP switch:

                                          E - Exclude this port from VLANX. I.e. any packets arriving on the port from outside tagged VLANX will be disgarded and any packets inside the switch tagged VLANX will not switched to this port.

                                          U - Untagged port. I.e. packets in the switch tagged VLANX can be switched to this port and will have tags removed when leaving. Untagged packets arriving on this port will be tagged VLANX upon entering the switch.

                                          T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
                                          Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.

                                          In the switch configuration packets arriving at ports 2, 3 or 4 will be tagged VLAN100 as they enter the switch. They can then be switched to any other port participating in VLAN100 (1-4). If the packet is addressed to the internet somewhere it will be switched to port 1 where it leaves the switch still tagged and arrives at re1 where the pfSense VLAN100 interface is setup to receive it and route it appropriately.

                                          Returning packets are sent to the switch from pfSense tagged VLAN100. Port 1 allows them to enter the switch and they are switched to the correct port. On leaving the port (2-4) the VLAN tagging removed so that the pakets arrive back at the client untagged and able to received.

                                          Steve

                                          1 Reply Last reply Reply Quote 0
                                          • ?
                                            A Former User
                                            last edited by

                                            @stephenw10:

                                            The three different port modes are like this as I understand it, though I don't actually have an HP switch:

                                            E - Exclude this port from VLANX. I.e. any packets arriving on the port from outside tagged VLANX will be disgarded and any packets inside the switch tagged VLANX will not switched to this port.

                                            U - Untagged port. I.e. packets in the switch tagged VLANX can be switched to this port and will have tags removed when leaving. Untagged packets arriving on this port will be tagged VLANX upon entering the switch.

                                            T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
                                            Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.

                                            In the switch configuration packets arriving at ports 2, 3 or 4 will be tagged VLAN100 as they enter the switch. They can then be switched to any other port participating in VLAN100 (1-4). If the packet is addressed to the internet somewhere it will be switched to port 1 where it leaves the switch still tagged and arrives at re1 where the pfSense VLAN100 interface is setup to receive it and route it appropriately.

                                            Returning packets are sent to the switch from pfSense tagged VLAN100. Port 1 allows them to enter the switch and they are switched to the correct port. On leaving the port (2-4) the VLAN tagging removed so that the pakets arrive back at the client untagged and able to received.

                                            Steve

                                            i am going to read that over a few times.  at first glance i am pretty confident that your explanation was very good, it makes sense.  i wish you posted that on page 1.

                                            ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.