Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    New VLAN not receiving DHCP address from its own pool

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    34 Posts 4 Posters 5.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jahnieboi @Derelict
      last edited by

      @derelict - The pfSense interface is connected to port 48.

      1 Reply Last reply Reply Quote 0
      • J
        jahnieboi @Derelict
        last edited by

        @derelict

        I'm getting closer!

        "If you want a workstation to be on VLAN, it needs to be connected to a switch port that is untagged on VLAN 40 and has its PVID set to VLAN 40." - This is what I need to do and this is what I did, but this time - I did set the PVID to 40 and this time, when I configure a static IP address ... I'm able to now ping the gateway.

        However, I can't ping the LAN(1) gateway and can't browse the internet. I've checked the firewall settings and everything looks good there. Anything else that I may need to do?

        Also - Thank you for being patient and Thank you for being responsive and supportive!!!

        0_1536085542548_c0b7e87f-0c9c-403e-b646-2e0740b91cb6-image.png

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Those rules make no sense..

          When would 192.168.1 be source into your opt network of 192.168.3?
          When would lan net be a source into opt net? On your vlan interface?

          your only rule that really makes any sense the last which is opt net any any..

          This would allow opt net to go anywhere, internet or lan.. If internet is not working did you mess with outbound nat. Automatic would of allowed your opt1 network to be natted to your wan.

          Rules are evaluated as traffic enters an interface from the network its connected too. Top down, first rule to trigger wins.. No other rules are evaluated..

          Do you have any rules setup on floating - since none of these rules show any hits, the 0/0 B on the left of your rules..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          J 1 Reply Last reply Reply Quote 0
          • J
            jahnieboi @johnpoz
            last edited by

            @johnpoz - ur right, out of desperation I added those on top, hoping that maybe it would work!

            I removed those - Thanks for the review.

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              Your ipv6 is tcp only... Which you need icmpv6 for ipv6 to function... But pretty sure pfsense adds those in the background when you put ipv6 on the interface.

              Derelict told you exactly how to configure the ports connected to both pfsense em1 and the the port your device is connected.. End devices like a PC almost never have any sort of vlan tag set.. They are almost always untagged. Exception might be if you were running say VMs on the box, etc. Or it was routing, etc. etc.

              pfsense - 1 UP, 40 T -- switch -- 40UP - PC

              That is all there is too it.. .
              U = untagged
              T = Tagged
              P = PVID..

              PVID is the vlan a switch uses for traffic that hits the interface untagged..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              J 1 Reply Last reply Reply Quote 0
              • J
                jahnieboi @johnpoz
                last edited by

                @johnpoz - Thank you so much for the clarification and for taking time to explain things.

                I've now made all of these corrections and I'm at least now able to ping from the PC (192.168.3.10) to the gateway (192.168.3.1) - also getting a response.

                However, I'm unable to ping from the PC (192.168.3.10) to the gateway of the default LAN on em1 (192.168.1.1).

                From my other computer that's on the main LAN (192.168.1.0/24), I'm able to ping the gateway on the VLAN (192.168.3.0/24), but I'm unable to ping the PC (192.168.3.10).

                What am I missing? :(

                Again - Many Thanks for your help!!

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by Derelict

                  @jahnieboi said in New VLAN not receiving DHCP address from its own pool:

                  However, I'm unable to ping from the PC (192.168.3.10) to the gateway of the default LAN on em1 (192.168.1.1).

                  From my other computer that's on the main LAN (192.168.1.0/24), I'm able to ping the gateway on the VLAN (192.168.3.0/24), but I'm unable to ping the PC (192.168.3.10).

                  There is nothing in the rules that will stop that ping from working.

                  Most likely suspect is the default gateway set on the source PC (192.168.3.10) itself.

                  The latter problem could possibly also be a firewall on 192.168.3.10 itself preventing connections from subnets other than its own. It could also be the default gateway setting there.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  J 1 Reply Last reply Reply Quote 0
                  • J
                    jahnieboi @Derelict
                    last edited by

                    @derelict

                    That's what's confusing me. I had put in the correct default gateway on the PC and I've disabled the local firewall on the PC as well.

                    Any other thoughts? ;-P

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by Derelict

                      You'll need to post everything. ipconfig/ifconfig, firewall rules as they exist now, switchport VLAN configurations, etc.

                      There are only so many things it can be and we've already given you about everything so something must be not set like you think it's set.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        jahnieboi @Derelict
                        last edited by

                        @derelict

                        PC ipconfig output:
                        0_1536097935884_image.png

                        Firewall Rules:
                        0_1536097988637_Screen Shot 2018-09-04 at 2.52.40 PM.png

                        Switch Port config (Netgear):
                        0_1536098068600_Screen Shot 2018-09-04 at 2.54.13 PM.png

                        0_1536098101157_Screen Shot 2018-09-04 at 2.54.45 PM.png

                        0_1536098159842_Screen Shot 2018-09-04 at 2.55.42 PM.png

                        Please let me know if I missed anything or if you need anything else.

                        Again - Thank you so much!!!! :)

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          OK

                          What switch port is connected to the workstation?

                          What switch port is connected to pfSense?

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          J 1 Reply Last reply Reply Quote 0
                          • J
                            jahnieboi @Derelict
                            last edited by

                            @derelict

                            Switch port 1 is connected to the PC

                            < and >

                            Switch port 48 is connected to pfSense (em1).

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              OK. I see no VLAN configuration on port 48. Why not?

                              [pfSense] needs to be connected to a switch port that is untagged VLAN 1, Tagged VLAN 40, and has its PVID set to 1.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              J 1 Reply Last reply Reply Quote 0
                              • J
                                jahnieboi @Derelict
                                last edited by

                                @derelict

                                I didn't know it was needed. I didn't want to interrupt the main network. Since port 48 is em1, which is the main LAN.

                                0_1536099827238_Screen Shot 2018-09-04 at 3.23.29 PM.png

                                I went ahead and made this change:

                                0_1536100099946_Screen Shot 2018-09-04 at 3.27.06 PM.png

                                Also, I read somewhere that routing needed to be enabled (is this correct)?:

                                0_1536100145848_Screen Shot 2018-09-04 at 3.28.38 PM.png

                                I'm still unable to obtain a DHCP address with these settings - nothing has changed.

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by Derelict

                                  Now you're using the switch as Layer 3? Why did you enable routing there? You probably just want to slow down that clicky finger.

                                  That looks like it should be working, but I am unclear why you are tagging VLAN 1 to port 1.

                                  Here is what I would do if I were you:

                                  Be sure you have a DHCP server configured and enabled on both LAN and OPT1 on pfSense. Be sure the pool ranges, etc are appropriate for the interfaces.

                                  Reset the switch to factory defaults.

                                  Make port 1 untagged VLAN 40, PVID VLAN 40

                                  Make port 2 untagged VLAN 1, PVID VLAN 1 (This should be the default)

                                  Make port 48 untagged VLAN 1, Tagged VLAN 40, PVID VLAN 1

                                  Connect pfSense em1 to port 48

                                  Connect a workstation configured for DHCP to port 1. It should get an address on OPT1

                                  Disconnect workstation and connect to port 2. It should get an address on LAN.

                                  Have a beer. You deserve it.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  J 1 Reply Last reply Reply Quote 0
                                  • J
                                    jahnieboi @Derelict
                                    last edited by

                                    @derelict

                                    THANK YOU, THANK YOU, THANK YOU, AND ----> THANK YOU!!!

                                    YOU SAVED MY LIFE AND MY TIME
                                    YOU ARE A GRANDMASTER JEDI

                                    LORD DERELICT - THE LEGEND!!!

                                    People will search and find my post, they will come and see this final posting and will see how thankful and grateful I am to you!!!

                                    Thanks so much!!! :)

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      So that worked?

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      J 1 Reply Last reply Reply Quote 0
                                      • J
                                        jahnieboi @Derelict
                                        last edited by

                                        @derelict - YES, but not completely.

                                        DHCP doesn't work on the VLAN, but static IP addressing does work!!

                                        I have not reset the switch back to factory defaults, I will need to coordinate down time to do this, but I'm sure the issue is at the switch level.

                                        Thanks again - you're a living legend @Derelict !!! :)

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          If static addressing works and DHCP doesn't it's not your switching it's your DHCP server. Check that.

                                          If it's working you don't need to reset anything to the defaults and start again.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          J 1 Reply Last reply Reply Quote 0
                                          • J
                                            jahnieboi @Derelict
                                            last edited by

                                            @derelict - It started working after I restarted the DHCP server.

                                            Sorry for the delay. I definitely appreciate your help!! I'm the only IT guy here right now.

                                            One other question. After this change was made, everything is working perfectly - there's just one client that can no longer connect. I'm looking everywhere and don't see his MAC address in the DHCP logs. He's able to connect to the AP and the connection is strong. He's just not getting a DHCP address on his wireless NIC. He's able to connect to other networks with it, so it's not his card.

                                            Is there anything that could prevent him from connecting on the pfSense side?

                                            btw - if you DM and give me your address - I'll send you a pizza for all your help!!!

                                            Thanks again!!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.