Setting up a VLAN part 2
-
Yes looks good. :)
In this setup you will have only one port available for 192.168.1.X clients since the other is linked back to re2. This means you can still access the switch GUI on that subnet though.Steve
-
Yes looks good. :)
In this setup you will have only one port available for 192.168.1.X clients since the other is linked back to re2. This means you can still access the switch GUI on that subnet though.Steve
ok good, i think i am picking up on vlans.
actually, that one port plugs into a 16 port netgear switch, so anything on that switch is also 192 and will also be able to hit pfsense since it is on the 192.168.1.x subnet.
EDIT- so for every additional vlan i create, port 1 will always be tagged, assuming the vlan connects back to the same NIC in pfsense? i only bring it up because the other hp switch i have access to has 24 ports, so i can create more vlans and assign them to re1. and if i did that, port 1 in every vlan would always be tagged, right?…..that is what i gathered after reading this:
T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router. -
@tomdlgns:
ok good, i think i am picking up on vlans.
Yep. ;)
@tomdlgns:
actually, that one port plugs into a 16 port netgear switch, so anything on that switch is also 192 and will also be able to hit pfsense since it is on the 192.168.1.x subnet.
Not a problem then.
@tomdlgns:
EDIT- so for every additional vlan i create, port 1 will always be tagged, assuming the vlan connects back to the same NIC in pfsense? i only bring it up because the other hp switch i have access to has 24 ports, so i can create more vlans and assign them to re1. and if i did that, port 1 in every vlan would always be tagged, right?
Yes you always need to add the pfSense connection as a tagged port in order to allow VLAN tagged packets to make it back pfSense where it can be received by the VLAN interface.
Assuming port1 is connected to re1, and that re1 has VLAN interfaces setup on it (as it is currently) then yes you would add this as tagged to every VLAN. (except VLAN1!)
Once you have a good grip on this you can try something interesting like connecting your second switch to the first one. Then it's possible to send VLANs between the switches using tagged ports on the connecting cable. But one step at a time! ;)
Steve
-
@tomdlgns:
ok good, i think i am picking up on vlans.
Yep. ;)
@tomdlgns:
actually, that one port plugs into a 16 port netgear switch, so anything on that switch is also 192 and will also be able to hit pfsense since it is on the 192.168.1.x subnet.
Not a problem then.
@tomdlgns:
EDIT- so for every additional vlan i create, port 1 will always be tagged, assuming the vlan connects back to the same NIC in pfsense? i only bring it up because the other hp switch i have access to has 24 ports, so i can create more vlans and assign them to re1. and if i did that, port 1 in every vlan would always be tagged, right?
Yes you always need to add the pfSense connection as a tagged port in order to allow VLAN tagged packets to make it back pfSense where it can be received by the VLAN interface.
Assuming port1 is connected to re1, and that re1 has VLAN interfaces setup on it (as it is currently) then yes you would add this as tagged to every VLAN. (except VLAN1!)
Once you have a good grip on this you can try something interesting like connecting your second switch to the first one. Then it's possible to send VLANs between the switches using tagged ports on the connecting cable. But one step at a time! ;)
Steve
Assuming port1 is connected to re1, and that re1 has VLAN interfaces setup on it (as it is currently) then yes you would add this as tagged to every VLAN. (except VLAN1!)
correct, vlan1 is untouched from what i have above.
Once you have a good grip on this you can try something interesting like connecting your second switch to the first one. Then it's possible to send VLANs between the switches using tagged ports on the connecting cable. But one step at a time! ;)
this is exactly the next thing i was going to try once i got vlan200 setup. i wont even ask my question until i can successfully get vlan200 up and online.
thanks for the help.
-
so you finally had it?
-
so you finally had it?
i finally got it, yes.
Edit- or are you asking if i have had enough of vlans? ???
-
no no, i just ask that you got it working. Congrats, hopefully i could help you even a bit
-
ok, just added a 24 port vlan switch and added a 3rd vlan…vlan 200 172.10.10.x
now that i figured out the tagging/untagging, it was pretty easy to configure the switch.
i must say, documentation is key with vlans. i logged into the switch and used the port name and wrote in the vlan it belongs to, but i also have it written down on paper.
this is what my switch config looks like (this switch doesnt use E for exclude, it uses N, which has been posted already).
vlan1- U U U U U U U U N N N N N N- 192.168.1.x
vlan100- N N N N N N N N T U U U N N- 10.10.10.x
vlan200- N N N N N N N N T N N N U U- 172.10.10.xi was able to hit the internet with a PC using a dhcp address from the 172 range and i stopped at 14 ports.
now that i got the hang of this, linking another VLAN switch should be easy. i just need to make sure that i tag the ports on the other switch to work with the respective vlans...1, 100, 200
-
That's true until you hit unmanaged switch, then you can use only one vlan on that port of managed switch and that should be untagged
-
That's true until you hit unmanaged switch, then you can use only one vlan on that port of managed switch and that should be untagged
right, if i want to do multiple vlans on other switches they need to be vlan switches. i follow what you are saying.
right now one of the untagged ports for vlan1 is plugged into a 16 port netgear switch, that switch can only operate on 1 subnet since it isnt vlan capable, in this case 192.168.1.x.
-
finished adding some block rules to stop traffic between vlans. disabled it one way to test, enabled it again, did some more testing, the rules did exactly what they were suppose to do.
dns question- i can ping other IPs, but i cant browse by going to \pc-name
any idea what i need to do to get that working?
i can access \ip-address w/o any issues, which is why i assume DNS.
the dhcp server settings for LAN is what i used as a template for vlan100 and 200 and my LAN DNS lookups work fine.
-
where you do have dns setup?
@tomdlgns:
right now one of the untagged ports for vlan1 is plugged into a 16 port netgear switch, that switch can only operate on 1 subnet since it isnt vlan capable, in this case 192.168.1.x.
You can also use another vlan if you require
-
I assume you are using DNS forwarding on pfSense for your DNS service. That's the default.
You can have pfSense add any client that sends it's host name to the local DNS table.
Go to Services: DNS Forwarder: and check 'Register DHCP leases in DNS forwarder'.This will only kick in when clients renew their DHCP lease so you may have to force that to test.
Steve
-
where you do have dns setup?
it is the default setup. the only thing i did was point to OpenDNS servers for lookups (and removed the first entry of 127.0.0.1).
-
I assume you are using DNS forwarding on pfSense for your DNS service. That's the default.
You can have pfSense add any client that sends it's host name to the local DNS table.
Go to Services: DNS Forwarder: and check 'Register DHCP leases in DNS forwarder'.This will only kick in when clients renew their DHCP lease so you may have to force that to test.
Steve
ok, just did this, i will delete DHCP leases and remote reboot machines and see if that fixes it.
EDIT- now that i think of it…the device i was trying to access by hostname was statically assigned, this option looks like it is only DHCP related. that device will never ask for a new address since it is static.
-
You can add static dhcp IPs with an option on that same page. Or if you have statically assigned the IP on the client itself you can add it manually in the host overrides table at the bottom.
If I need to have anything static I always use static DHCP rather then IPs coded at the client. It makes this sort of thing far easier. Also if I do have to change the IP ever it's all centrally stored.
Steve
-
You can add static dhcp IPs with an option on that same page. Or if you have statically assigned the IP on the client itself you can add it manually in the host overrides table at the bottom.
If I need to have anything static I always use static DHCP rather then IPs coded at the client. It makes this sort of thing far easier. Also if I do have to change the IP ever it's all centrally stored.
Steve
makes sense and i am going to look into that, thank you.
ok, i did that, i added the entry for the static device.
when i ping it, it resolves to a public internet address not the internal IP…..hmmmm
-
You may have to clear the local dns cache. Make sure your client is using the DNS forwarder.
You can try using the Diagnostics: DNS Lookup: tool to check pfSense can resolve it correctly.Steve
-
You may have to clear the local dns cache. Make sure your client is using the DNS forwarder.
You can try using the Diagnostics: DNS Lookup: tool to check pfSense can resolve it correctly.Steve
DNS lookup in pfsense can see the correct name if i type in the ip and it shows the correct ip if i type in the name.
but it uses 127.0.0.1, then 208.67.222.222, 208.67.220.220, finally 192.168.1.1
i do want my machines to use openDNS server for external lookups, but obviously not for internal lookups, which is what i think it happening, but i could be wrong.
local cache cleared and my ipconfig looks like this
ip- 172.10.10.210
sub- /24
gate- 172.10.10.1dns- 172.10.10.1
-
127.0.0.1 is the local machine, which it is checking first. That seems correct. I don't know why it's looking at 192.168.1.1 though, that sounds wrong.
See my screenshots.Steve
