How to do an inter-vlan routing with L3 switch and pfSense
-
Dear all,
I searched for a similar topic, but I didn't find a clear instructions on how to combine L3 Switch with pfSense box.
I have a 3COM 4500g layer3 switch with routing features which I want to use and a pfSense 2.2 (amd64) which I'm going to use as a firewall directly connected to my ISP. I need to create several Vlans and all of them need internet access.
vlan1 172.16.10.0/24, pfsense addr 172.16.10.1, switch addr 172.16.10.2
valn3 192.168.3.0/24, switch addr 192.168.3.2
vlan9 192.168.9.0/24, switch addr 192.168.9.2So far I created the vlans on the switch and created a corresponding ipv4 interfaces for the switch and configured an access ports for the hosts.
So my questions are:
1. Do I have to configure a trunk between the sw and the pfsense?
2. Do I need to assign the vlans and assign IP addresses for these vlans on the pfSense? If so which interface will be the default gateway - the one of the switch or the pfsense?
3. What kind of Firewall rules do I have to create on the pfsense box, so all vlans have internet access?
4. Will I be able to route to all Vlans when connected via VPN connection (IPsec or PPTP)?
5. Do I have to create a manual NAT outbound rule on the pfSense for each vlan?Thank you in advance.
-
Dear all,
I searched for a similar topic, but I didn't find a clear instructions on how to combine L3 Switch with pfSense box.
I have a 3COM 4500g layer3 switch with routing features which I want to use and a pfSense 2.2 (amd64) which I'm going to use as a firewall directly connected to my ISP. I need to create several Vlans and all of them need internet access.
vlan1 172.16.10.0/24, pfsense addr 172.16.10.1, switch addr 172.16.10.2
valn3 192.168.3.0/24, switch addr 192.168.3.2
vlan9 192.168.9.0/24, switch addr 192.168.9.2So far I created the vlans on the switch and created a corresponding ipv4 interfaces for the switch and configured an access ports for the hosts.
So my questions are:
1. Do I have to configure a trunk between the sw and the pfsense?I would. Create a transit network interface on pfSense, say 172.31.242.1/29. Create a new VLAN on pfSense and the switch. Tag the VLAN on a trunk between the switch and pfSense (It could be untagged but just tag it now so you can simply add another VLAN in the future if you want.) Create a ve on the switch, say 172.31.242.4/29. Set default gateway on switch to 172.31.242.1. Create gateway on pfSense for 172.31.242.4. Create static routes for all your VLANs on pfSense pointing them at the switch gateway.
2. Do I need to assign the vlans and assign IP addresses for these vlans on the pfSense? If so which interface will be the default gateway - the one of the switch or the pfsense?
Not if you are using the switch as a layer 3 router.
3. What kind of Firewall rules do I have to create on the pfsense box, so all vlans have internet access?
The pass rules on the transit interface (172.31.242.1/29) have to pass all traffic from all networks.
4. Will I be able to route to all Vlans when connected via VPN connection (IPsec or PPTP)?
Should be as simple as adding them as local networks.
5. Do I have to create a manual NAT outbound rule on the pfSense for each vlan?
I believe 2.2 is pretty good at picking up the static routes in auto outbound mode, but just switch to manual and add rules for:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16If those are going out WAN you want them to NAT, so just NAT them all. Put anything more specific than those on NAT rules above them.
