Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to use ports as 'untagged vlan ports' aka 'vlan access' ports

    Scheduled Pinned Locked Moved DHCP and DNS
    11 Posts 6 Posters 3.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      "This is oh so simple on a normal switch but I can't seem to figure it out on a pfsense device."

      Most likely because pfsense is not a switch ;)  You can for sure use these other interfaces for other untagged vlans.  But no the ports are not switch ports..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • K
        kpa
        last edited by

        Get a managed switch that can do VLANs, pfSense makes a very bad switch because it's not designed for that.

        1 Reply Last reply Reply Quote 0
        • Z
          ziegi
          last edited by

          OK fair enough  :P

          So how would I go about using an interface as an untagged vlan port? When I go to VLANs 'area' it's just for tagging…?

          Thank you

          1 Reply Last reply Reply Quote 0
          • K
            kpa
            last edited by

            @ziegi:

            OK fair enough  :P

            So how would I go about using an interface as an untagged vlan port? When I go to VLANs 'area' it's just for tagging…?

            Thank you

            You can't on pfSense because there's no PVID functionality to strip the tags on outgoing and attach tags on incoming like you would have on a VLAN capable switch. PfSense can only do tagged VLANs on an interface.

            1 Reply Last reply Reply Quote 0
            • JKnottJ
              JKnott
              last edited by

              I've set up a WAN, and a tagged VLAN10 and VLAN 20 LAN port (trunk). Each with a g/w address and unique dhcp etc…

              I'm not sure you understand how VLANs work.  Based on your description, I think you're saying you want all 3 on the same interface.  Is that correct?  Also, a trunk port includes all VLANs, though some switches allow you to configure which VLANs are passed.  Any VLAN has a VLAN tag on it, though an access port assigned to that VLAN will strip off the tag.  You'll need a managed switch to separate the VLANs into individual networks.

              PfSense running on Qotom mini PC
              i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
              UniFi AC-Lite access point

              I haven't lost my mind. It's around here...somewhere...

              1 Reply Last reply Reply Quote 0
              • NogBadTheBadN
                NogBadTheBad
                last edited by

                @kpa:

                @ziegi:

                OK fair enough  :P

                So how would I go about using an interface as an untagged vlan port? When I go to VLANs 'area' it's just for tagging…?

                Thank you

                You can't on pfSense because there's no PVID functionality to strip the tags on outgoing and attach tags on incoming like you would have on a VLAN capable switch. PfSense can only do tagged VLANs on an interface.

                You could pop an IP address on the parent interface ( via  Interfaces -> LAN ) packets will be untagged :-

                igb0: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                options=500bb <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,jumbo_mtu,vlan_hwcsum,vlan_hwfilter,vlan_hwtso>ether 00:08:a2:0a:9d:cb
                inet6 fe80::208:a2ff:fe0a:9dcb%igb0 prefixlen 64 scopeid 0x1
                inet 172.16.1.1 netmask 0xffffff00 broadcast 172.16.1.255
                inet6 2a02:xxxx:xxxx:1::1 prefixlen 64
                nd6 options=21 <performnud,auto_linklocal>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active

                igb0_vlan2: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                options=3 <rxcsum,txcsum>ether 00:08:a2:0a:9d:cb
                inet6 fe80::208:a2ff:fe0a:9dcb%igb0_vlan2 prefixlen 64 scopeid 0xb
                inet 172.16.2.1 netmask 0xffffff00 broadcast 172.16.2.255
                inet6 2a02:xxxx:xxxx:2::1 prefixlen 64
                nd6 options=21 <performnud,auto_linklocal>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active
                vlan: 2 vlanpcp: 0 parent interface: igb0

                igb0_vlan3: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                options=3 <rxcsum,txcsum>ether 00:08:a2:0a:9d:cb
                inet6 fe80::208:a2ff:fe0a:9dcb%igb0_vlan3 prefixlen 64 scopeid 0xc
                inet 172.16.3.1 netmask 0xffffff00 broadcast 172.16.3.255
                inet6 2a02:xxxx:xxxx:3::1 prefixlen 64
                nd6 options=21 <performnud,auto_linklocal>media: Ethernet autoselect (1000baseT <full-duplex>)
                status: active
                vlan: 3 vlanpcp: 0 parent interface: igb0

                Then do something like this on your switch, I've changed the untagged VLAN from VLAN 1 and connect igb0 to GE1 :-

                Untitled.png
                Untitled.png_thumb</full-duplex></performnud,auto_linklocal></rxcsum,txcsum></up,broadcast,running,promisc,simplex,multicast></full-duplex></performnud,auto_linklocal></rxcsum,txcsum></up,broadcast,running,promisc,simplex,multicast></full-duplex></performnud,auto_linklocal></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,jumbo_mtu,vlan_hwcsum,vlan_hwfilter,vlan_hwtso></up,broadcast,running,promisc,simplex,multicast>

                Andy

                1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                1 Reply Last reply Reply Quote 0
                • JKnottJ
                  JKnott
                  last edited by

                  You could pop an IP address on the parent interface ( via  Interfaces -> LAN ) packets will be untagged :-

                  Alias IP addresses are not the same thing as VLANs.  Alias addresses simply mean that an interface can communicate over more than one subnet, but there is no isolation between subnets other than that.  VLANs, on the other hand appear as though they're physically separate networks, with communication between them only possible via a router.  Other than trunk ports, interfaces will only work with the VLAN that's configured on it.  So, you could have an interface configured to handle, for example, VLAN5 and it will ignore traffic for any other VLAN that appears on the wire.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by

                    Well, answer to this thread. You DO NOT do any such thing. pfSense is not a switch. Abandon the futile effort here.

                    1 Reply Last reply Reply Quote 0
                    • NogBadTheBadN
                      NogBadTheBad
                      last edited by

                      @JKnott:

                      You could pop an IP address on the parent interface ( via  Interfaces -> LAN ) packets will be untagged :-

                      Alias IP addresses are not the same thing as VLANs.

                      Did I actually say that ?

                      What I suggested would and does work if you want untagged and tagged packets exiting the same port on the router.

                      Andy

                      1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                      1 Reply Last reply Reply Quote 0
                      • Z
                        ziegi
                        last edited by

                        OK thanks all.

                        It's just too bad because I have a device with several unused IF's and it sure would save space, time and money to not have to use another managed switch. Alas, that's exactly what I'll do.

                        Again, thanks!

                        1 Reply Last reply Reply Quote 1
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.