VLAN Help!!…..

[wyzard]

So…

• Port one on switch goes to the LAN switch on my pfSense (misstated in previous post, sorry).  So VLAN1 would remain untagged and VLAN50 would be tagged on that port, correct?

• Port 14 on switch goes to my AP.  So that port should be set the same as port 1, (VLAN1 untagged, VLAN50 tagged).

• The AP switch would have the new the SSID which would also be indicated on the AP as VLAN50.

Is that correct or am I missing something?

Do I need to identify my main SSID as VLAN1 on my AP?

[Derelict]

That sounds fine.

You also need to:

assign an interface to VLAN 50, enable it, and number it
put firewall rules on that interface to pass the desired traffic
enable a DHCP server on the interface
and be sure outbound NAT is in place.

[wyzard]

Everything been set that way, but it still won't get me an internet connection on my second SSID and my main SSID drops internet connection.

Thanks…..

[Derelict]

If everything was set that way it would be working.

You're going to have to post all those settings because you obviously haven't done what you think you've done.

[wyzard]

Thanks.  I will play with this a bit more and see what happens.

One more question…  for now...

I have four ethernet ports on my pfSense box, one currently used for WAN and the other for LAN leaving two "unused".  If I run an ethernet cable from one of those ports to an open port on my switch, then set the VLAN to that interface, will the traffic from the AP on my 2nd SSID  come into port 14 and got out to the pfSense through that port?  So in other words, if I run a LAN connection from opt2 (currently unused on pfSense) to say port 20 on my switch, will my second SSID (which is identified as VLAN50) go into port 14 on my switch than out through port 20 (as log as I tag port 20 as VLAN50) to the pfsense then out to the internet?  In essences I'm separating the physical LAN ports for my main SSID and the 2nd SSID.

Hope that makes sense.

[Derelict]

Not exactly sure what you're asking…


[wyzard]

I obviously don't have something right…

How do I post screen shots here?

[Derelict]

Click Attachments and other options.

Attach files


[wyzard]

Hopefully this will help figure this out..

settings.txt

[Gertjan]

An nearly empty text file  ?

[wyzard]

Try again…

[pfsense settings.zip](/public/imported_attachments/1/pfsense settings.zip)

[Derelict]

What is so hard about screen shots?

Asking us to do a lot of work here.

ETA: A word document? Really?

EATA: What are those 5 errors in the upper right? Click that and post it.


[wyzard]

There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-06 23:43:18
There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-06 23:48:18
There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-06 23:48:54
There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-07 00:17:09
There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-07 00:18:44

[wyzard]

Here's a zip with PNG images…  Sorry about the word doc.. it was late....

settings.zip

[johnpoz]

Your going to want to fix that bogon problem or you going to have issues with your rules..

System > Advanced > Firewall Maximum Table Entries

Set that to say 400000

Your rules are wrong on your iot interface that is for sure.

Rules are evaluated top down, first rule to trigger wins.  You have a any any rule that lets iot do anything on ipv4.  Your block to lan net would never be evaluated..  If you don't want iot going to lan net, then put that block ABOVE your any any.

[wyzard]

Got it!!!

Thanks for all the help and patience.