VLAN Assistance

[easysimpleit]

@nogbadthebad

Originally this worked perfectly. I had two lan ports bridged and attached a vlan to the mix + a PoE managed switch. All was well with the world, then my PoE switch died. I saw online where someone has there AP setup on a dedicated LAN port and attached some vlans. I'm either an idiot or missing something in my setup.

Crazy thing is the clients get an IP, just no internet and I can't hit the admin page or pin the pfsense.

[stephenw10]

Getting DHCP and nothing else is the behaviour you see when there are no firewall rules on the interface.
Though you have added rules to pass that the behaviour indicates they may not be loading correctly.
Do you see any alerts shown in the GUI at the top of the page? None of your screenshots quite showed that.

You might be hitting this:
https://forum.netgate.com/topic/129001/solved-2-4-3-rc-filter_configure_sync-cannot-define-table-bogonsv6

Steve

[jahonix]

@easysimpleit Stupid question but I remember it being of use previously: did you reboot pfSense?

[easysimpleit]

@stephenw10 I’ve made the adjustment but haven’t tested it. I’ll get back to you

[easysimpleit]

@jahonix I did not but I can. Let me try that.

[easysimpleit]

At a total loss.

When I monitor the firewall logs, everything that comes across has a green check. As if the FW isn't stopping anything but yet nothing is happening.

Could it be something with the NIC? This is a dedicated NIC, could it be something with the way pfsense deals with multiple interfaces?

Any other suggested on what to check? I really feel like it's something I'm overlooking but can't put my finger on it.

Thanks again everyone.

[stephenw10]

To be clear devices on that VLAN/SSID do pull an IP address in the correct subnet for the VLAN interface?

Are clients able to resolve IP addresses? If you ping pfsense.org for example?

But no other traffic is shown?

I would run a packet capture on the parent interface and look for VLAN tagged packets coming in.

Steve

[easysimpleit]

@stephenw10 Hi Stephen, tried that. I have the packet captures and from what I'm seeing or not seeing this still isn't making sense to me. Can I DM you the pcaps and you give me your thoughts? Maybe I'm missing something.

[stephenw10]

Sure. Mark them with where they were captured and what filtering was in place, if any.

Steve

[easysimpleit]

@stephenw10 forgive me I was trying to send you the file, not really sure how to do that?

[stephenw10]

Hmm, good question. New forum...new problems!
I guess via the 'chat' feature which substitutes for PMs here maybe? Though I don't see an obvious way to attach anything....

[easysimpleit]

If you can email me support@easysimpleit.com, I’ll reply with Dropbox links. If that’s easier

[johnpoz]

If I recall even the PM system before was limited, I do not think you could attach in pms either on smf??

[ashima]

I am not sure... but are you running captive portal or proxy ?

I had a similar issue with vlans where captive portal was enabled on the main interface and not on vlan attached to it. If so either disable captive portal or chose vlan interface too.

Similarly if you are running proxy chose the vlan interface too.

I hope this helps you.
Ashima

[stephenw10]

Mmm, captive portal is an interesting suggestion. I've not seen that personally but I'm not sure I've ever tried such a setup.

Steve

[easysimpleit]

@stephenw10 no captive portal or proxy. Only thing I'm running is the DNS resolver w/ SquidGuard Proxy filter.

The issue seems much deeper while also very shallow. when I join the the Wifi network I get the proper vlan IP and it's provided by the DHCP of the pfsense. After that I get nothing, no internet or access to the firewall management page. Just nothing.

[Derelict]

Please post the firewall rules for the KdsWiFi interface.

If you are getting DHCP, your Layer 2 / VLANs are good (unless it's really getting DHCP from elsewhere).

[Derelict]

@easysimpleit said in VLAN Assistance:

no captive portal or proxy. Only thing I’m running is the DNS resolver w/ SquidGuard Proxy filter.

That means you're running a squid proxy.

ping 8.8.8.8 does it work?
ping smtp.gmail.com does it work?

[easysimpleit]

@derelict

Here you go.

[stephenw10]

Do you have a port forward to localhost for DNS on that interface?

The Allow all rule should pass anything anyway.

Do you actually see leases in Status > DHCP leases for that subnet when devices are connected to it?

Steve