VLAN Assistance

easysimpleit

easysimpleit

It seems like it's a rule problem but I'm really not sure. DHCP for the vlan works, the clients get an IP but nothing else besides that work, can't hit the admin page for pfsense and no internet access. Looking at my rules I'm sure I need to clean them up but getting this vlan thing figured out would be so great right now. I'm about to start locking down the network.

johnpoz

Why do you have all those manual mappings in your outbound nat that duplicate your automatic?

What is your vlan 12 interface settings.. Can your wireless clients on this vlan even ping your pfsense IP on this interface? You have a any any rule so they should be able to get to pfsense.

Are you running unifi controller? I was not aware that they allow for their phone app to set ssid with vlan IDs on them? Thought that had to be done in the controller?

Been running unifi and pfsense for years. Run multiple vlans on mine and also even got their MAB working on their psk networks with freerad, etc. This is clickity clickity stuff so missing something stupid for sure.

NogBadTheBad

Do you have any sort of device you can connect to the pfSense port that supports VLANS so you could rule out the AP?

You can with a MAC:-

0_1527614794035_MAC VLAN.jpg

Choose Apple menu > System Preferences, then click Network. Click the Action pop-up menu at the bottom of the list on the left, then choose Manage Virtual Interfaces. Click the Add button , then choose New VLAN. Give the service a name, then enter a value in the Tag field.

Also I'd not open my NAS up to the internet unless I had a very good reason.

easysimpleit

@johnpoz

I removed the additional rules. May have been left overs of some other crazy idea I had.

Here is the configuration for interface vlan 12 aka KdsWiFi

0_1527627950296_1c981691-ca71-4120-8637-6dffd809c009-image.png

Yes, I am using a unifi controller. Since that's wired, thats on another IP range but I've opened the rules to allow bi-directional talks between the two.

Appreciate your feedback.

easysimpleit

@nogbadthebad

Originally this worked perfectly. I had two lan ports bridged and attached a vlan to the mix + a PoE managed switch. All was well with the world, then my PoE switch died. I saw online where someone has there AP setup on a dedicated LAN port and attached some vlans. I'm either an idiot or missing something in my setup.

Crazy thing is the clients get an IP, just no internet and I can't hit the admin page or pin the pfsense.

stephenw10

Getting DHCP and nothing else is the behaviour you see when there are no firewall rules on the interface.
Though you have added rules to pass that the behaviour indicates they may not be loading correctly.
Do you see any alerts shown in the GUI at the top of the page? None of your screenshots quite showed that.

You might be hitting this:
https://forum.netgate.com/topic/129001/solved-2-4-3-rc-filter_configure_sync-cannot-define-table-bogonsv6

Steve

jahonix

@easysimpleit Stupid question but I remember it being of use previously: did you reboot pfSense?

easysimpleit

@stephenw10 I’ve made the adjustment but haven’t tested it. I’ll get back to you

easysimpleit

@jahonix I did not but I can. Let me try that.

easysimpleit

At a total loss.

When I monitor the firewall logs, everything that comes across has a green check. As if the FW isn't stopping anything but yet nothing is happening.

Could it be something with the NIC? This is a dedicated NIC, could it be something with the way pfsense deals with multiple interfaces?

Any other suggested on what to check? I really feel like it's something I'm overlooking but can't put my finger on it.

Thanks again everyone.

stephenw10

To be clear devices on that VLAN/SSID do pull an IP address in the correct subnet for the VLAN interface?

Are clients able to resolve IP addresses? If you ping pfsense.org for example?

But no other traffic is shown?

I would run a packet capture on the parent interface and look for VLAN tagged packets coming in.

Steve

easysimpleit

@stephenw10 Hi Stephen, tried that. I have the packet captures and from what I'm seeing or not seeing this still isn't making sense to me. Can I DM you the pcaps and you give me your thoughts? Maybe I'm missing something.

stephenw10

Sure. Mark them with where they were captured and what filtering was in place, if any.

Steve

easysimpleit

@stephenw10 forgive me I was trying to send you the file, not really sure how to do that?

stephenw10

Hmm, good question. New forum...new problems!
I guess via the 'chat' feature which substitutes for PMs here maybe? Though I don't see an obvious way to attach anything....

easysimpleit

If you can email me support@easysimpleit.com, I’ll reply with Dropbox links. If that’s easier

johnpoz

If I recall even the PM system before was limited, I do not think you could attach in pms either on smf??

ashima

I am not sure... but are you running captive portal or proxy ?

I had a similar issue with vlans where captive portal was enabled on the main interface and not on vlan attached to it. If so either disable captive portal or chose vlan interface too.

Similarly if you are running proxy chose the vlan interface too.

I hope this helps you.
Ashima

stephenw10

Mmm, captive portal is an interesting suggestion. I've not seen that personally but I'm not sure I've ever tried such a setup.

Steve