Not new to pfSense, but setting up my first VLAN, but I just can't grasp the concept...
-
The goal: To put my 5 streaming boxes onto VLAN 10, using the WAN for access, and keeping Plex working.
The important bits:
6 year pfSense user so I'm quite comfortable in there.
Virtualized pfSense 2.4.4 on a beefy ESXi 6.7 box.
TP Link TL-SG1016DE managed 16 port is my primary switch.
Netgear 8 port managed switch is available if needed.
Plex is used on all streamers.
Each streamer is connected in the respective rooms to unmanaged 8 port switches.
Virtualized Xpenology running Plex server.
LAN is 192.168.1.1/24
I would like VLAN 10 to be 192.168.0.0/24I followed the VLAN guide in the pfSense book, but stopped after adding just the VLAN 10 portion. Setting up the Gateway and beyond is where I got stumped.
Anyone care to throw in their knowledge?
-
Setting up the gateway? There is no gateway for setting up a vlan on pfsense.
What is confusing you? A vlan is no different than another lan network, other than being its own physical interface its traffic is TAGGED so the switch knows what traffic is lan and what is vlan, etc.
You didn't setup a gateway on lan, so why would you think you need to setup a gateway on a vlan?
-
I followed the link from here about setting up Gateways:
https://docs.netgate.com/pfsense/en/latest/book/vlan/pfsense-vlan-configuration.html
"The VLAN-based OPT interfaces behave as any other OPT interfaces do, which means they must be enabled, configured, have firewall rules added, and services like the DHCP Server will need to be configured if needed. See Interface Configuration Basics for more information on configuring optional interfaces."
That is why I assumed I needed a separate gateway for the VLAN. I was thinking I needed to make new rules etc. for the VLAN.
-
And where in that does it tell you to setup a gateway??
The word gateway isn't even on that page!
you mean this?
", and IPv4 Upstream Gateway may be set."Yeah if your creating a WAN connection... Did you set a gateway on your LAN? So again why would you think you need to setup one on your vlan?
The note!!!
Selecting a Gateway from the drop-down list, or adding a new gateway and selecting it, will cause pfSense to treat that interface as a WAN type interface for NAT and related functions. This is not desirable for internal-facing interfaces such as LAN or a DMZ. Gateways may still be utilized on those interfaces for static routes and other purposes without selecting a Gateway here on the interfaces page. -
From the bottom of the linked page...
"Note
Selecting a Gateway from the drop-down list, or adding a new gateway and selecting it, will cause pfSense to treat that interface as a WAN type interface for NAT and related functions. This is not desirable for internal-facing interfaces such as LAN or a DMZ. Gateways may still be utilized on those interfaces for static routes and other purposes without selecting a Gateway here on the interfaces page."This is from the first Netgate link I posted. Towards the bottom of that page.
https://docs.netgate.com/pfsense/en/latest/book/config/interface-configuration.html#config-interface-configuration-basicsI interpreted that to read as I must setup another gateway, as I can not select my 192.168.1.1 gateway. In my mind Gateway means address back to the router.
-
Huh?? It states
"This is not desirable for internal-facing interfaces such as LAN or a DMZ"
A gateway is an IP that you would send traffic to get off "this network"
So your lan is 192.168.1/24, pfsense IP is 192.168.1.1 - this interface has NO GATEWAY!!! Yes pfsense IP 1.1 is the "gateway" for say 192.168.1.100, because pfsense is the IP it talks to to get OFF of 192.168.1
Pfsense ONLY gateway is your ISP gateway ip address, of if your behind a double nat... the gateway listed on your wan... This is the only gateway you would setup on pfsense... Unless you had another wan connection, or a transit network to get to other networks.
When you setup your vlan, 192.168.0/24 with pfsense address on this interface say 192.168.0.1 there is NO GATEWAY setup on this interface.. Devices on 192.168.0/24 say 192.168.0.99 would use pfsense IP 192.168.0.1 as their "gateway"
-
@johnpoz
Thank you. That greatly clarifys it for me.My last question, will I be able to use 802.1Q VLAN tagging based on the device (Roku, or MAC Address or IP address) as opposed to port tagging?
Thanks much for your assistance!
-
Yeah want to use tagging vs ports for sure.. But I question if that tplink will actually allow you to remove a port from vlan 1.. What netgear do you have?
Also if your going to be doing tagging on esxi your prob going to need to set the vswitch vlan IP to 4095 so it doesn't strip tags... Prob a good idea to draw it all up how you want to physically connect everything, and we can discuss.
-
@johnpoz
I have a Netgear GS108TV2.
I'm not an artist so:Roku 1
Roku 2
ATV 1
ATV 2
FireTV
These I want to go across 192.168.0.1 LAN, pulling from WAN only, NOT my VPN which is also setup on pfSense.Everything else (for the present for now) across 192.168.1.1 LAN.
-
break out some crayons dude ;) How do you have this all connect to your esxi host.
-
The ESXi server has 6 NIC's. 2 for management, the others for are for pfSense. One incoming WAN, 192.168.1.1 LAN comes out of one NIC to the 16 port switch. Actually, I have the other 2 connected to the switch as well. Why? I don't really know, because I could I guess, redundency?
-
Lol, that's not the kind of picture you were asked for. Look at these and then make your own: https://en.wikipedia.org/wiki/Computer_network_diagram
-
So you have enough physical nics on your esxi host that you dont need to vlan.. in pfsense or esxi, only on your switch to isolate the different layer 2 traffic.
About ready to head home - I will draw it up tmrw or later tonight... Prob early tmrw morning when I wake up and have quiet time..
-
@johnpoz
Thanks for your help!I dumped Visio years ago when I retired...
-
You don't need visio - lots of alternatives..
Here some ascii ones ;)
https://textik.com
http://asciiflow.com/Or gliffy etc. etc.
-
@johnpoz
This is as close as i can get.
-
@johnpoz
My drawing above is the existing config. The Netgear switch is completely unused. I would be fine using that if need be for the VLAN or port 5 or 6, although from Example 1 here, which I was going to loosely follow for the VLAN tagging, it appears to me, I should be able to remove a port from VLAN 1.https://www.tp-link.com/us/faq-788.html
Tim
