Not new to pfSense, but setting up my first VLAN, but I just can't grasp the concept...

johnpoz

Huh?? It states

"This is not desirable for internal-facing interfaces such as LAN or a DMZ"

A gateway is an IP that you would send traffic to get off "this network"

So your lan is 192.168.1/24, pfsense IP is 192.168.1.1 - this interface has NO GATEWAY!!! Yes pfsense IP 1.1 is the "gateway" for say 192.168.1.100, because pfsense is the IP it talks to to get OFF of 192.168.1

Pfsense ONLY gateway is your ISP gateway ip address, of if your behind a double nat... the gateway listed on your wan... This is the only gateway you would setup on pfsense... Unless you had another wan connection, or a transit network to get to other networks.

When you setup your vlan, 192.168.0/24 with pfsense address on this interface say 192.168.0.1 there is NO GATEWAY setup on this interface.. Devices on 192.168.0/24 say 192.168.0.99 would use pfsense IP 192.168.0.1 as their "gateway"

GoateedGeek

@johnpoz
Thank you. That greatly clarifys it for me.

My last question, will I be able to use 802.1Q VLAN tagging based on the device (Roku, or MAC Address or IP address) as opposed to port tagging?

Thanks much for your assistance!

johnpoz

Yeah want to use tagging vs ports for sure.. But I question if that tplink will actually allow you to remove a port from vlan 1.. What netgear do you have?

Also if your going to be doing tagging on esxi your prob going to need to set the vswitch vlan IP to 4095 so it doesn't strip tags... Prob a good idea to draw it all up how you want to physically connect everything, and we can discuss.

GoateedGeek

@johnpoz
I have a Netgear GS108TV2.
I'm not an artist so:

Roku 1
Roku 2
ATV 1
ATV 2
FireTV
These I want to go across 192.168.0.1 LAN, pulling from WAN only, NOT my VPN which is also setup on pfSense.

Everything else (for the present for now) across 192.168.1.1 LAN.

johnpoz

break out some crayons dude ;) How do you have this all connect to your esxi host.

GoateedGeek

The ESXi server has 6 NIC's. 2 for management, the others for are for pfSense. One incoming WAN, 192.168.1.1 LAN comes out of one NIC to the 16 port switch. Actually, I have the other 2 connected to the switch as well. Why? I don't really know, because I could I guess, redundency?

Grimson

Lol, that's not the kind of picture you were asked for. Look at these and then make your own: https://en.wikipedia.org/wiki/Computer_network_diagram

johnpoz

So you have enough physical nics on your esxi host that you dont need to vlan.. in pfsense or esxi, only on your switch to isolate the different layer 2 traffic.

About ready to head home - I will draw it up tmrw or later tonight... Prob early tmrw morning when I wake up and have quiet time..

GoateedGeek

@johnpoz
Thanks for your help!

I dumped Visio years ago when I retired...

johnpoz

You don't need visio - lots of alternatives..

Here some ascii ones ;)

https://textik.com
http://asciiflow.com/

Or gliffy etc. etc.

GoateedGeek

@johnpoz
This is as close as i can get.

GoateedGeek

@johnpoz
My drawing above is the existing config. The Netgear switch is completely unused. I would be fine using that if need be for the VLAN or port 5 or 6, although from Example 1 here, which I was going to loosely follow for the VLAN tagging, it appears to me, I should be able to remove a port from VLAN 1.

https://www.tp-link.com/us/faq-788.html

Tim