VLAN Questions
-
What are you rules now? You want clients on vlan 6 to get IP from dhcp server running on vlan 3? Did you setup a relay? I have to assume you have different dhcp server than pfsense since pfsense dhcp doesn't work unless has an interface in that network.
Post up your rules. Keep in mind if you don't want vlans to talk to vlan 7, those rules go on those interfaces not vlan 7 interface. Pfsense evaluates the rules on the interface the traffic first enters pfsense on.. So if you don't want vlans X talking to vlan 7 then you would need rules on those interfaces blocking that access to dest vlan 7 net.
Rules are evaluated top down, first rule to trigger wins. If you have questions post your rules and we can discuss.
-
Dumb question to the guys in knowledge:
Could we create VLANs 11, 12, 13 on IF/trunk A and 21, 22, 23 on IF/trunk B and bridge V12 and V22 to create one broadcast domain with one set of rules/DHCP/etc. on two different trunks/switches?
AFAIK having the same VLAN on two different trunks isn't possible otherwise.
What am I missing?Granted, this is useless if you have a core switch feeding the edge-switches and pfSense hanging off of it as well.
In Jamerson's case there's no core switch and the edge switches are fed directly from the router's interfaces (if I got that right). -
Why would you want to do that? Different VLANs bridged into one broadcast domain makes no sense in almost all cases.
By definition VLANs are separate broadcast domains. Why make two then bridge them back into one?
Get another switch to go at the physical pfSense location and tag the VLAN in question to both switches.
The cheapest managed switch will perform better than a pfSense bridge. I just don't get it.
-
Why make two then bridge them back into one?
The scenario is sketched above already.
I don't want to build it that way I'm just asking if it is possible to bridge VLANs, that's all.
And no, I will not write down "A bridge is not a switch!" 100 times. ;) -
Seems like you can if you must:
bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500 ether 02:29:b8:be:74:00 nd6 options=1 <performnud>id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15 maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200 root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0 member: re2_vlan100 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 9 priority 128 path cost 200000 member: re0_vlan100 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 8 priority 128 path cost 200000</learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></performnud></up,broadcast,running,simplex,multicast> -
Why would you bridge 2 vlans??? For starters why would 2 vlans have the same layer 3 IP ranges.. So if they don't there is ZERO point in making them the same layer 2.
If you want devices to all be on the same layer 2, then that would be 1 vlan.
-
Once again since it seems hard to read above posts:
ASSUMING we don't have a core switch and using two native interfaces to feed two separate (edge-) switches with trunks it is the only possibility to share one VLAN among the two switches.
You can't have VLAN_xy on trunk_A and trunk_B.
This is a hypothetical setup which I DO NOT want to build.Side note: since my workbench is currently covered with digital mixing desks and outboard gear to check CobraNet, Dante and AVB (all digital audio networking protocols) I neither have the time nor the place to evaluate it myself.
Now back to you, Jamerson! ;D
-
What does a core switch have to do with anything.. If both switches can reach pfsense then just put a switch there.. Go to the store and get a $40 smart switch.. If you have no budget, connect your 2 switches to that. This is 1 vlan!
There is NO scenario that would make sense to bridge 2 different vlans. The act of bridging them would make it 1 vlan.. Why would you use something like pfsense to connect them. You just need to plug one switch into the other switch. Make the vlan id the same, there you go 1 vlan.
-
Thank you guys and John for the help.
I managed to get this fixed.
I've configured one up link for all the switches and all the VLANS running on one interface and everything runs fine.I've enabled DHCP on each VLANS however didn't specify the dns on the dhcp . I've noticed that the users are having some difficulties to contact the file server .
The users logs in local on their MAC machines.
There is no internal DNS at all. The DNS is the gateway, DNS forward is configured fine.
What am I doing wrong ?Before we migrate to offense we could build VPN to our Cisco firewall in holland to access the Internet as we may know the chiness are blocking a lot of sites .
Is this gonna work with the openvpn tunnel we build ? I've forced the tunnel over the VPN but when I am connect over the openvpn and I went to whatismyip it's not showing our office IP but the local IPThank you guys for the support
Modify message -
-
-
Sorry don't know what open sense is , my safari auto corrections.
Our productions number now is :
2.3.1-RELEASE-p5 (amd64)
built on Thu Jun 16 12:53:15 CDT 2016
FreeBSD 10.3-RELEASE-p3 -
"I've enabled DHCP on each VLANS however didn't specify the dns on the dhcp"
How exactly would thy find anything then?? They just going to broadcast for names? Might work for something like smb on the local layer 2. But how are they getting to anything on the internet? Are you handing them a proxy via auto discovery (wpad)?
if you handed them external dns, how would they find your local servers it seems your running?
You kind of need dns.. So you have local servers but no local dns?? Pfsense can be your local dns.. Once you enable dhcp on pfsense it would default to handing out its IP on that interface dhcp is running as dns to all dhcp clients. If you need to resolve some fqdn locally just put in a host override.
-
"I've enabled DHCP on each VLANS however didn't specify the dns on the dhcp"
How exactly would thy find anything then?? They just going to broadcast for names? Might work for something like smb on the local layer 2. But how are they getting to anything on the internet? Are you handing them a proxy via auto discovery (wpad)?
if you handed them external dns, how would they find your local servers it seems your running?
You kind of need dns.. So you have local servers but no local dns?? Pfsense can be your local dns.. Once you enable dhcp on pfsense it would default to handing out its IP on that interface dhcp is running as dns to all dhcp clients. If you need to resolve some fqdn locally just put in a host override.
Thank you John,
Yes I've enable the dhcp and left it as default so of sense is providing them gateway and dns as it self on each VLANS. I believe its fine now .
So specify dns or leave it to pfsense to decide is gonna be the same.
About the mobile users , how can we force the openvpn to send the whole traffic over the WAN ?
When we are in China want our users to user internet using our VPN to the office in Holland. Is this even possible with openvpn or we have to create a L2tp tunnel ? -
GFW will probably block whatever you try to do. Probably want to take that up with the Chinese government.
-
GFW will probably block whatever you try to do. Probably want to take that up with the Chinese government.
Last month my colleagues were in China, and everything works fine with the Cisco ASA firewall,
Cisco force the whole traffic over the VPN.
I don't know if this even possible with the openvpn .
I've seen the options on openvpn to send all traffic over the tunnel but don't know if it does it really.
So when I am connected with the VPN to the office, i get the office public ip and not the local. -
Yes, it does it.
Redirect Gateway
Force all client generated traffic through the tunnel.Then re-export your client config.
Cisco ASAs are IPsec, not OpenVPN. Not sure why you're making that comparison. If IPsec was working for you on the ASA, why not use IPsec on pfSense?
-
Yes, it does it.
Redirect Gateway
Force all client generated traffic through the tunnel.Then re-export your client config.
Cisco ASAs are IPsec, not OpenVPN. Not sure why you're making that comparison. If IPsec was working for you on the ASA, why not use IPsec on pfSense?
Thank you, had reconfigured the OPENVPN to send all traffic over the tunnel and everything is working now.
Much appreciate it .The management believes the openvpn is using ssl which makes it secure to use than the IPsec.
Right now I need to restrict the access between one VLAN and the rest of the VLANS.
Is creating a group of interfaces and apply the firewall rules between those two group would be the easy way of managing the stuff ? -
while ipsec has its own issues, not sure I would consider it less secure than openvpn. I am a bit surprised that ipsec works through the 防火长城 (The Great Firewall of China) let me know if the Chinese comes through ;)
It is much easier to spot and stop ipsec traffic then openvpn that can run on any port. If your doing a deep packet inspection you would know its not normal ssl traffic.. But like I said its much easier to block ipsec so it funny that is not blocked..
Blocking traffic between vlans on pfsense is quite simple. I would assume all your vlans are rfc1918 so just make an alias that contains those networks and use a not rule so only if traffic is NOT rfc1918 is it allowed. Of course putting the stuff you want to allow above that rule.
-
while ipsec has its own issues, not sure I would consider it less secure than openvpn. I am a bit surprised that ipsec works through the 防火长城 (The Great Firewall of China) let me know if the Chinese comes through ;)
It is much easier to spot and stop ipsec traffic then openvpn that can run on any port. If your doing a deep packet inspection you would know its not normal ssl traffic.. But like I said its much easier to block ipsec so it funny that is not blocked..
Blocking traffic between vlans on pfsense is quite simple. I would assume all your vlans are rfc1918 so just make an alias that contains those networks and use a not rule so only if traffic is NOT rfc1918 is it allowed. Of course putting the stuff you want to allow above that rule.
The IPsec has always worked from China to Europe. Last month too
I don't know about IPsec to USA or there are some other policies than the one to Europe.
The VLANS are rfc1918 24 bit-block .I will create the rules and report back.
A big thank you sir for your continu support
