VLAN Assistance

[easysimpleit]

@stephenw10 Hi Stephen, tried that. I have the packet captures and from what I'm seeing or not seeing this still isn't making sense to me. Can I DM you the pcaps and you give me your thoughts? Maybe I'm missing something.

[stephenw10]

Sure. Mark them with where they were captured and what filtering was in place, if any.

Steve

[easysimpleit]

@stephenw10 forgive me I was trying to send you the file, not really sure how to do that?

[stephenw10]

Hmm, good question. New forum...new problems!
I guess via the 'chat' feature which substitutes for PMs here maybe? Though I don't see an obvious way to attach anything....

[easysimpleit]

If you can email me support@easysimpleit.com, I’ll reply with Dropbox links. If that’s easier

[johnpoz]

If I recall even the PM system before was limited, I do not think you could attach in pms either on smf??

[ashima]

I am not sure... but are you running captive portal or proxy ?

I had a similar issue with vlans where captive portal was enabled on the main interface and not on vlan attached to it. If so either disable captive portal or chose vlan interface too.

Similarly if you are running proxy chose the vlan interface too.

I hope this helps you.
Ashima

[stephenw10]

Mmm, captive portal is an interesting suggestion. I've not seen that personally but I'm not sure I've ever tried such a setup.

Steve

[easysimpleit]

@stephenw10 no captive portal or proxy. Only thing I'm running is the DNS resolver w/ SquidGuard Proxy filter.

The issue seems much deeper while also very shallow. when I join the the Wifi network I get the proper vlan IP and it's provided by the DHCP of the pfsense. After that I get nothing, no internet or access to the firewall management page. Just nothing.

[Derelict]

Please post the firewall rules for the KdsWiFi interface.

If you are getting DHCP, your Layer 2 / VLANs are good (unless it's really getting DHCP from elsewhere).

[Derelict]

@easysimpleit said in VLAN Assistance:

no captive portal or proxy. Only thing I’m running is the DNS resolver w/ SquidGuard Proxy filter.

That means you're running a squid proxy.

ping 8.8.8.8 does it work?
ping smtp.gmail.com does it work?

[easysimpleit]

@derelict

Here you go.

[stephenw10]

Do you have a port forward to localhost for DNS on that interface?

The Allow all rule should pass anything anyway.

Do you actually see leases in Status > DHCP leases for that subnet when devices are connected to it?

Steve

[easysimpleit]

@stephenw10

DHCP

Port Forwarding

[easysimpleit]

@derelict Yes I am & no, sadly it does not.

[easysimpleit]

Side thinking:

Before I had two NICS that I had bridged for LAN. Both NICS feed two separate switches, one was my regular gig switch managed & the other was my PoE gig management switch. When my PoE switch died, I removed the bridge setup and reconfigured the second NIC to be dedicated to the Unifi AP. After that I have it setup with the vlan.

Should I bridge both the LAN & WIFI NIC so they are on the same network and then attached the kids VLAN that way? I take it that should work since it technically worked before. I'm just not sure why it's not working now, in the current configuration.

Running out of ideas so I'm just thinking out loud.

[johnpoz]

@easysimpleit said in VLAN Assistance:

Should I bridge both the LAN & WIFI NIC

You should never bridge anything unless its the LAST freaking way to get something to work.. If you need switch ports - use a switch..

[ashima]

I just noticed in your attached screenshot of port forwarding... The 1st rule of DNS for kids network :

The dest Address should be !KIDSWIFI_VLAN12 address .
"!" is missing.
Can you try with that.

[easysimpleit]

@johnpoz I agree, which is why I changed the setup.

[easysimpleit]

@ashima that rule was missing the invert match option. I ticket it and still nothing is working on my end.

I'm wondering at this point if I should remove the vlan and try re-adding it.