Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Setting Up Multiple Wireless SSIDs w/ 1 Access Point

    Scheduled Pinned Locked Moved
    L2/Switching/VLANs
    3
    17
    1.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pfsushi
      last edited by pfsushi

      @derelict said in Setting Up Multiple Wireless SSIDs w/ 1 Access Point:

      AP is not tagging the traffic with the VLAN tag.

      1. AP is connected to an Ethernet Port
      2. Port has a VLAN and is tagged
      3. Added a VLAN in pfSense using the same VID #
      4. pfSense sees the Interface and I add it
      5. Assigned a static IP (same as inside the Tomato) to the interface
      6. Enabled DHCP on that Interface

      I guess it could be that the Tomato isn't tagging the traffic with the VLAN tag which then forwards to pfSense and does DHCP. Because as far as I can tell, Windows is giving me the 169.x.x.x address which means I'm not getting past the Tomato AP.

      So question becomes.. why isn't the router tagging that?

      Because if I connect to the default SSIDs.. either of them it works. Just not this VLAN.

      Could be a Tomato bug... I found a lot of people saying the WebGUI doesn't properly tag VLANS and you have to do it thru the command line.

      http://doodlebobbers.com/setting-vlan-ports-on-tomato-via-command-line/

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        @pfsushi said in Setting Up Multiple Wireless SSIDs w/ 1 Access Point:

        AP is connected to an Ethernet Port

        What is an "Ethernet Port"? A port on the firewall?

        Assigned a static IP (same as inside the Tomato) to the interface

        I don't understand that.

        Sorry. Never used Tomato.

        Might be a good time to post your Interfaces > Assignments page.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • P
          pfsushi
          last edited by

          I should have been more clear.. I've connected ETH1 to my laptop in order to "Share" it out via VirtualBox

          So it's within the VM environment. Amazingly it works with the default SSIDs. That traffic and interface shows up.. works great.

          It's this VLAN thing. Which got me thinking that Tomato isn't tagging that traffic or something and it doesn't even pass anything to pfSense.

          I'm in the midst of trying to figure out why. The VID is set and the Tag option is checked. Looks great but any other device that sees this Guest network, can connect (so the AP is fine with it) but no Internet. And no IP of what it should be as configured within the pfSense interface.

          If I connect to say.. Tomato24 (default SSID no VLAN).. it's awesome. No problem. pfSense sees that interface and away it goes.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            I am going to be pretty much unable to help you with getting the VLAN tags passing through the AP and virtual environment. I don't use Tomato or Virtualbox. Sorry.

            If the pfSense interface is assigned to something like VLAN 10 on igb0, the interface is enabled and numbered, and the DHCP server is active, then all it is waiting for is traffic to arrive there tagged for VLAN 10.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • P
              pfsushi
              last edited by

              I've seen VLAN 10 mentioned somewhere in another tutorial.

              Makes me think you are correct from the get-go. The AP isn't tagging the traffic appropriately because it's not connecting to pfSense and DHCP, etc etc

              I think you've helped a lot actually. It's not pfSense.

              It's how traffic is being tagged and how it's not going where it should to get an address from pfSense which sees the Interface and has the service enabled.

              Gotta be this AP VLAN configuration for an additional SSID.

              1 Reply Last reply Reply Quote 0
              • P
                pfsushi
                last edited by

                VLAN Settings

                For whatever reason.. I unchecked the Port 1 on my VLAN 1 ... and because of that, the wireless traffic passing now gets assigned correctly in pfSense.

                Simply unchecked Port 1 for VLAN 1 and assigned that VLAN 3 to Port 1.

                I would have thought you could send all traffic thru a single port and simply tag the frames? Maybe not in this case but I do not proclaim to understand the deep technical nuances of networking. Just the basics. Which is why I survived and now I've got 3 separate SSIDs all getting their own IP ranges and going thru pfSense!

                Thanks for the help. Your comment really got me thinking.

                1 Reply Last reply Reply Quote 0
                • P
                  pfsushi
                  last edited by

                  Ah son of a ....

                  All I solved was by putting VLAN 3 on Port 1, the traffic works perfect but now the other SSIDs do not because there is no physical ETH connection coming out of Ports 2-4 to the pfSense box.

                  I thought by "tagging" the traffic, all traffic could come out of Port 1 but somehow be segmented because it was tagged and would match up on a VLAN created in pfSense.

                  If this does work in theory, it might not work with Advanced Tomato on my Asus RT-AC68U box. There might be some bug that isn't allowing traffic to be appropriately tagged.

                  Meaning, while I can create several VLANS and associate them with various Virtual Wireless networks, I can't get anything connecting to the AP to do anything with it except connect to whatever is listed on Port 1

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Yes you can put multiple tagged VLANs on one physical interface. That's sort of the whole point.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • P
                      pfsushi
                      last edited by pfsushi

                      That's what I thought!

                      So it's gotta be going back to your original point.. your AP isn't tagging your traffic appropriately so when it says VLAN3 has a VID of 3 which matches the pfSense of VLAN 3 ...

                      My AP isn't doing it right. I can see all the APs SSIDs. I can connect but not all of them will give me DHCP because that traffic beyond whatever says is connected on Port 1 to my pfSense box isn't getting tagged beyond the default.

                      I think you were right on the first time and my issue is Tomato and VLAN tagging with this specific model router.

                      Could be that VirtualBox's NIC doesn't support VLAN tagging either. Given this isn't an actual physical box.. with a support NIC... it may be VBox doesn't support VLAN tagging thus it's configured correctly but won't work because of a non-supported configuration. I'll have to go search to see if VBox has any issues with VLAN tagging.

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfsushi
                        last edited by

                        Hmmm...

                        https://askubuntu.com/questions/628781/vlan-is-not-working-in-virtual-box

                        "don't use the Intel PRO/1000 family of adaptors, because they will strip the VLAN tags. Instead, either use the Paravirtualized Network adaptor old default of AMD PCNet FAST III, neither of which seem to have this restriction."

                        I am indeed using the default Intel PRO/1000 default in my VBox setup.

                        I'll switch in my VBox settings for my pfSense host and see what gives.

                        1 Reply Last reply Reply Quote 0
                        • P
                          pfsushi
                          last edited by

                          I've come to the conclusion that VirtualBox/VMWare Player do not truly support VLAN tagging.

                          I can get a pretty good lab going using VBox but if I create additional SSIDs, and tag them.. the show up in pfSense but the traffic doesn't route properly.

                          It's not a pfSense issue. It's not an Advanced Tomato or my router.

                          Virtualization using these 2 products and the associated selection of virtual adapters just does not support proper tagging.

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            You understand both of those are free products for "simple" use or end users to play with right. If you want to play with vlan tags than use say esxi - also FREE..

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.03 | Lab VMs 2.7.2, 24.03

                            1 Reply Last reply Reply Quote 0
                            • P
                              pfsushi
                              last edited by

                              Yes I understand that.. I didn't know if it would work or not.

                              I think esxi is beyond the specs of my simple laptop setup. But I'll look into it.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post