Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Bad idea? mixing tagged and untagged VLANs, but DHCPD works…

    Problems Installing or Upgrading pfSense Software
    3
    13
    4.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Doubtful. You probably borked something in the switchport config. Interfaces on eth0 and eth0_vlanXXX should work fine.

      There are two issues at play here. untagged traffic and VLAN ID 1. If you do have to mix tagged and untagged traffic on interfaces you should make sure the PVID on the switch is not VLAN 1.

      Then you can tag it across trunk (tagged) links and to VLAN-aware devices that don't get squirrilley without management on the untagged VLAN. Looking at you Ubiquiti.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • Y
        yarick123
        last edited by

        Derelict, thank you for the clarification.

        @Derelict:

        There are two issues at play here. untagged traffic and VLAN ID 1. If you do have to mix tagged and untagged traffic on interfaces you should make sure the PVID on the switch is not VLAN 1.

        May be I understand it the wrong way.

        I had eth0, eth0_vlan3, eth0_vlan4, eth0_vlan13. So, four pfSense interfaces: LAN and three OPT.
        In fact, the PVID on the switch was 1. The switch port was configured as 'tagged' for VLANs 3,4,13 and as 'untagged' for the default VLAN 1. What would be the correct PVID in this case?

        Perhaps I should have used eth0_vlan1 instead of eth0… But, as far as I know, the switch does not tag the default VLAN 1 and I thought, that eth0_vlan1 would not get any packet.

        Derelict, could you please say, what you thinks about that?

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Having the PVID as 1 will work, it's just a good idea to use something else.

          That should have worked with DHCP for switchports untagged on VLAN 1 or VLANs 3, 4, or 13 if DHCP was configured and enabled on those OPT interfaces.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • Y
            yarick123
            last edited by

            Thank you for the answer Derelict.

            I will recheck, maybe I did something wrong…

            @Derelict:

            Having the PVID as 1 will work, it's just a good idea to use something else.

            Now I am using VLAN 100 for that :)

            By the way, I am using pfSense 2.2.6, the NIC is Intel(R) PRO/1000 Gigabit, the switch is Allied Telesis AT-8000GS/48.

            Best regards
            yarick123

            1 Reply Last reply Reply Quote 0
            • Y
              yarick123
              last edited by

              I have reconfigured the slave firewall to use untagged default VLAN 1 for LAN. It worked! Thank you, Derelict!

              I will reconfigure the master firewall and report about the results. It seems, that previously I have brocken something in the configuration.

              1 Reply Last reply Reply Quote 0
              • N
                NOYB
                last edited by

                Been running mixed tagged untagged for years.  Never had an issue with it.

                pfSense NIC:
                LAN bfe0
                WAN bfe0_VLAN99

                Switch Port:
                PVID 1
                Member VLAN 1 untagged
                Member VLAN 99 tagged

                Note: within the switch everything is tagged

                ingress packets:
                untagged is tagged vlan 1 (PVID)
                tagged keeps its tag

                egress packets:
                vlan 1 untagged
                vlan 99 tagged

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Yeah. there's no problem with it. Hard part is tagging VLAN 1 across a real "trunk" port.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • N
                    NOYB
                    last edited by

                    @Derelict:

                    Yeah. there's no problem with it. Hard part is tagging VLAN 1 across a real "trunk" port.

                    Yeah that's why I don't have a problem with it.  ;)

                    1 Reply Last reply Reply Quote 0
                    • Y
                      yarick123
                      last edited by

                      I have reconfigured the master firewall also. Everything works!

                      So, there is no problem with DHCPD on an untagged VLAN and tagged VLANs on the same NIC. Shame on me  :-\

                      1 Reply Last reply Reply Quote 0
                      • N
                        NOYB
                        last edited by

                        @yarick123:

                        … untagged VLAN ...

                        What? Isn't that an oxymoron.

                        1 Reply Last reply Reply Quote 0
                        • Y
                          yarick123
                          last edited by

                          @NOYB:

                          @yarick123:

                          … untagged VLAN ...

                          … Isn't that an oxymoron.

                          I would not say so. Contradiction essential for oxymoron seems to absent.

                          There are N virtual LANs. To identify them it is sufficiently to tag N-1 virtual LANs and to leave one virtual LAN untagged.

                          1 Reply Last reply Reply Quote 0
                          • N
                            NOYB
                            last edited by

                            To me the one untagged isn't really a virtual though.  It's "native" (for lack of better term) or real, or physical, etc. and requires no vlan technology, capability or processing.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.