Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Single NIC on pfSense using VLANs - not working. EDIT: FIXED

    Scheduled Pinned Locked Moved
    Hardware
    6
    18
    34.8k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cmb
      last edited by

      Sounds like you're missing firewall rules on those VLAN interfaces so everything's getting blocked.

      1 Reply Last reply Reply Quote 0
      • W
        wallabybob
        last edited by

        You have previously stated that VLAN 10 is assigned as the pfSense LAN interface. The default firewall rules for the pfSense LAN interface allow access anywhere. Therefore on systems connected to the pfSense LAN interface (VLAN 10) it should be possible to access the pfSense GUI and get a ping response from the IP address of the pfSense LAN interface.

        Given that you say a VLAN 10 client got its IP address by DHCP from pfSense it is now hard to see why a VLAN 10 client doesn't get a response to a ping to pfSense LAN IP address.

        Has the switch ever been a DHCP server? Does the pfSense DHCP log (Status -> System Logs, click on the DHCP tab) confirm that the pfSense box answered a DHCP request from the VLAN 10 client?
        What firewall rules does pfSense have on the LAN interface? Have you ever changed the default firewall rules on the pfSense LAN interface? Please start a ping on the VLAN 10 client and then take a packet capture (say 20 packets) on the client and on the pfSense physical interface supporting VLAN 10 and post the captures here.

        1 Reply Last reply Reply Quote 0
        • X
          Xyzzy
          last edited by

          @cmb:

          Sounds like you're missing firewall rules on those VLAN interfaces so everything's getting blocked.

          @wallabybob:

          You have previously stated that VLAN 10 is assigned as the pfSense LAN interface. The default firewall rules for the pfSense LAN interface allow access anywhere. Therefore on systems connected to the pfSense LAN interface (VLAN 10) it should be possible to access the pfSense GUI and get a ping response from the IP address of the pfSense LAN interface.

          A bit more by way of explanation:  I have only one pfSense machine configured.  I am switching between what I will call "normal" configuration (separate NICs for WAN, LAN, and WLAN) and the VLAN configuration described in the OP.  This is done in the console by using option 1 to reassign interfaces.  I am not changing firewall rules at all, and the rules do not appear to be affected by the interface reassignment between VLANs and separate physical NICs.  This makes it difficult for me to understand why the pfSense box responds differently between configurations.

          @wallabybob:

          Given that you say a VLAN 10 client got its IP address by DHCP from pfSense it is now hard to see why a VLAN 10 client doesn't get a response to a ping to pfSense LAN IP address.

          Has the switch ever been a DHCP server? Does the pfSense DHCP log (Status -> System Logs, click on the DHCP tab) confirm that the pfSense box answered a DHCP request from the VLAN 10 client?
          What firewall rules does pfSense have on the LAN interface? Have you ever changed the default firewall rules on the pfSense LAN interface? Please start a ping on the VLAN 10 client and then take a packet capture (say 20 packets) on the client and on the pfSense physical interface supporting VLAN 10 and post the captures here.

          The log shows that the DHCP request from the client was served by pfSense; it's the only DHCP server on the network and the switch does not have a DHCP server capability.

          Firewall rules:  As noted above, I am not changing the rules between VLAN and normal modes; in normal mode everything works (clients can reach the internet/WAN, permitted clients can reach the pfSense GUI, clients can ping pfSense.)

          Packet capture shows that pings are originated by the client, received by pfSense, but not replied to by pfSense.  Packet capture also shows normal DHCP handshaking.  I can try to post a screen cap of the ping captures if needed, but they simply show origination and receipt, but no reply being sent from pfSense.  (BTW, I'm doing the captures in pfSense using the GUI, by NOT configuring the WLAN to use VLAN trunking and leaving it on a separate NIC.  I'm using Wireshark on the client.)

          Thanks for your help…given that firewall rules aren't changing between configurations, and DHCP works but other services don't, I'm really at a loss as to what might be going on.

          1 Reply Last reply Reply Quote 0
          • M
            Metu69salemi
            last edited by

            But do you have any firewall rules on vlan interface?

            1 Reply Last reply Reply Quote 0
            • W
              wallabybob
              last edited by

              @Metu69salemi:

              But do you have any firewall rules on vlan interface?

              I've been discussing a VLAN interface that has been reported as being assigned LAN so firewall rules shouldn't be an issue but given that the configuration is a little unusual in being reset at boot time its worth checking that.

              @Xyzzy:

              given that firewall rules aren't changing between configurations, and DHCP works but other services don't, I'm really at a loss as to what might be going on.

              I'm puzzled too. Perhaps things will become clear when we get more specific details.

              Have you ever rebooted after changing the configuration to use VLANs and then the system to the VLAN configuration you set on the previous startup? (This would mean the system started with the VLAN configuration.) Though I can't recall the specifics I have seen some problems when changing significant network parameters through the console. If such a reboot doesn't clear things up on VLAN 10 (LAN interface) I suggest you restart the client on VLAN 10 and start a ping to the pfSense LAN interface IP address THEN collect the following details (I assume you have access to the console):

              • the interface name on which DHCP requests from the client on VLAN 10 were received: the bold part in the output from the following pfSense shell command:
                # date; clog /var/log/dhcpd.log | grep DHCPDISCOVER
                Nov 20 15:24:15 dhcpd: DHCPDISCOVER from 00:30:18:b0:19:85 (pfsense2) via bridge0

              • The output from the pfSense shell command:
                # date; clog /var/log/filter.log | tail -10

              1 Reply Last reply Reply Quote 0
              • X
                Xyzzy
                last edited by

                @wallabybob:

                Have you ever rebooted after changing the configuration to use VLANs and then the system to the VLAN configuration you set on the previous startup? (This would mean the system started with the VLAN configuration.) Though I can't recall the specifics I have seen some problems when changing significant network parameters through the console.

                In short, rebooting pfSense fixed everything;  Thank you so much.

                I had rebooted once before, due to a caution in the pfSense book that some NICs required it the first time a VLAN was set up.  Not sure why that didn't do the trick.  I had also noticed that (in the console) after assigning interfaces to the VLAN, I also needed to reset the interface IP addresses, even though they appeared correct in the console; that may have been a clue that things were not going exactly as they should have.

                So this time, I assigned LAN to em3_vlan10 and WAN to em3_vlan900, changed the cabling to reflect that, and rebooted pfSense.  When pfSense came up, the LAN and WAN were working properly through the VLAN trunk to pfSense.  After verifying that LAN and WAN were connected properly, I used the pfSense GUI to add VLAN 20 to em3 and assign em3_vlan20 to the WLAN; changed cable for the WLAN and it came up without needing to reboot.

                Thanks much again for your help.  It seems that Occam's Razor is still valid.  Perhaps this saga will be of help to others attempting similar configurations.  Your point about significant changes through the console perhaps not taking effect properly and therefore possibly requiring a reboot is one that should be kept in mind when working with pfSense.

                1 Reply Last reply Reply Quote 0
                • W
                  wallabybob
                  last edited by

                  Great you have it working. Thanks for reporting back.

                  1 Reply Last reply Reply Quote 0
                  • P
                    proverbian
                    last edited by

                    Hi, i have a setup here..

                    i tried setting UP 3 VLANS… VLAN10, VLAN20 and VLAN30

                    my lan IP is, 10.0.0.10/24

                    VLAN10 = 10.0.10.1/24
                    VLAN20 = 10.0.20.1/24
                    VLAN30 = 10.0.30.1/24

                    All DHCP Enabled on all VLANS..

                    Manageable Switch (Netgear GS108T)

                    Port:
                    1 VLAN 1 - MacMini with PFsense VM.
                    2 VLAN10
                    3 VLAN10
                    4 VLAN20
                    5 VLAN20
                    6 VLAN30
                    7 VLAN30
                    8 VLAN30

                    i tried transfering my mac mini to any of the ports with vlan10 and vlan20, cant get any IP from dhcp.

                    appreciate any help. thanks

                    1 Reply Last reply Reply Quote 0
                    • W
                      wallabybob
                      last edited by

                      @proverbian:

                      i tried transfering my mac mini to any of the ports with vlan10 and vlan20, cant get any IP from dhcp.

                      It is probably not good form to add a problem to the end of a topic marked "FIXED".

                      There isn't anywhere enough information here to diagnose the problem. For starters, where is the DHCP server?  What interfaces are on the pfSense VM? What vmware interfaces are the pfSense interfaces bound to?

                      1 Reply Last reply Reply Quote 0
                      • M
                        Metu69salemi
                        last edited by

                        That port where is pfsense connected should have vlan 10,20 & 30 tagged and vlan 1 untagged.

                        1 Reply Last reply Reply Quote 0
                        • P
                          proverbian
                          last edited by

                          Opps. sorry @wallabybob.

                          @wallabybob : DHCP server is at VLAN10, 20,30  in PFSENSE which located at my Macmini VMware.. maybe i should make a new post for this. thanks..

                          @Metu69salemi: Thanks .. ill try that

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.