Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    New to pfSense

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    66 Posts 6 Posters 13.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      @Sir_SSV said in New to pfSense:

      it is running Private Internet Access through OpenVPN and changing the gateway.

      Yeah that could be a problem..

      As to reconnecting to a vpn service on pfsense - yeah if you set it to reconnect it should.. All comes down to why there was a disconnect, etc. etc

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • S
        Sir_SSV
        last edited by

        Ok, thanks. I’ll have to do some research to see how to set up OpenVPN on pfSense.

        To prevent a device on Vlan50 (IoT) seeing a device on either Vlan20 or Vlan40, should I do an Alias to block these or should I set a firewall rule on VLAN50 to block any protocol source: any destination: LAN net?

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          Rules are evaluated on the interface the traffic enters on, from the network its connected too.. So if you don't want devices on vlan X to talk to vlan Y, then on vlan X you would put a rule that blocks access to vlan Y.

          Above rules that would allow, say your dest any rule that allows access to the internet..

          Rules are evaluated top down, first rule to trigger wins - no other rules are evaluated.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • S
            Sir_SSV
            last edited by Sir_SSV

            Ok, so finally I have everything up and running! It took a while however everything is working perfectly right down to OpenVPN and the RPi's (including a "Killswitch" in case the VPN network goes down it does not default to the WAN address) :)

            However, I have one more question: on Vlan30 resides my FreeNAS server. This is only accessible by the computers on Vlan 20. FreeNAS sends email/status updates/critical alerts via Gmail (TLS over port 587). I do not want the FreeNAS server to be connected to the internet but would like it to be able to send these updates via Gmail. I have tried several rules however none seem to be working (it mentions could not resolve Hostname).

            Is this possible to do? I was attempting to open the address/port for Gmail however this did not work.

            Edit: After having a think about what Firewall rules I was using, I worked it out. Due to not having an internet connection on Vlan30, I made rules for connection to DNS servers then rule for Gmail's IP range (74.125.0.0/16)

            1 Reply Last reply Reply Quote 0
            • T
              Thuan @Sir_SSV
              last edited by

              @Sir_SSV

              I’ve followed the SG-3100 manual to the letter and configured the port 4 as VLAN port. Every thing seems okay except there’s no internet from that port. I don’t know what to do know.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                And what rules did you put on that initerface? Did you dick with the automatic outbound nat? Network network did you put on that interface.. Are you clients able to ping pfsense IP on that interface?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                T 2 Replies Last reply Reply Quote 0
                • T
                  Thuan @johnpoz
                  last edited by

                  @johnpoz

                  Hi John,

                  I put IPv4 and IPv6, allow anything to anything. Haven’t touched NAT outbound rules at all (still default to automatic). I connect FMC transmitter/receiver pair to that interface (LAN port 4 or OPT2). At the other far end is a gigabit switch. An access point plugs into the switch. A music server plugs into the switch as well. I have not yet tried pinging from music server to the pfSense IP.

                  WAN connects to a Comcast Xfinity modem/router which offers wired and wireless internet.

                  1 Reply Last reply Reply Quote 0
                  • T
                    Thuan @johnpoz
                    last edited by

                    @johnpoz

                    I’ve just pinged pfSense IP 192.168.1.1 on the interface. No problem. Actually, ping works on all 4 ports including the configured one and 3 other “raw” ports.

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      What exact IP did you put on pfsense interface in this new vlan? Sure the mask is not /32? Is dhcp working on this vlan? You didn't mess with outbound nat say per some idiot vpn guide? And its set to automatic for your wan?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      T 1 Reply Last reply Reply Quote 0
                      • T
                        Thuan @johnpoz
                        last edited by

                        @johnpoz

                        It’s 192.168.100.1

                        Before getting on the road, I fiddled with system/advance/system tunables, 2 bridge/filter related parameters and it seemed to work. Laptop connected to that interface shows internet. Will dig more after work.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          You wouldn't be doing anything with bridging!!! You made no mention of bridging in your OP.. You sure wouldn't be bridging your vlan 192.168.100 to your lan 192.168.1

                          Set your port to untagged in the vlan you want, set the port 5 (the uplink to the soc) to tagged for your vlan... It really is that simple.

                          Here I have the switch ports with different vlan on port, with 1 being the default lan
                          switchportsvlans.png

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          T 1 Reply Last reply Reply Quote 0
                          • T
                            Thuan @johnpoz
                            last edited by

                            @johnpoz

                            No John, I didn’t mention bridging because I had not touched it before posting the last message.

                            Thanks for the attached screenshot. I’ll get to learn from it after work.

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              @Thuan said in New to pfSense:

                              I had not touched it before posting the last message.

                              And why would you think you should? Make no sense!! clicking random shit is not how you correct a problem!

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              T 2 Replies Last reply Reply Quote 0
                              • T
                                Thuan @johnpoz
                                last edited by

                                @johnpoz

                                You’re right John, it isn’t working. I’m resetting the SG-3100 and starting over again.

                                1 Reply Last reply Reply Quote 0
                                • T
                                  Thuan @johnpoz
                                  last edited by

                                  @johnpoz

                                  John, let’s assume that I know nothing about setting pfSense router, and my goal is simple: configure an internet port out of 4 available ports on the 3100. My existing source is Comcast Xfinity modem.

                                  Starting from a factory default 3100 unit, what steps should I take to fulfill my simple requirement: having an internet capable port in which I can plug in a switch and go from there?

                                  A 1 Reply Last reply Reply Quote 0
                                  • A
                                    akuma1x @Thuan
                                    last edited by akuma1x

                                    @Thuan said in New to pfSense:

                                    @johnpoz

                                    John, let’s assume that I know nothing about setting pfSense router, and my goal is simple: configure an internet port out of 4 available ports on the 3100. My existing source is Comcast Xfinity modem.

                                    Starting from a factory default 3100 unit, what steps should I take to fulfill my simple requirement: having an internet capable port in which I can plug in a switch and go from there?

                                    It's pretty easy, if you have in fact reset the 3100 to factory defaults.

                                    The SG-3100 has a WAN and 4 LAN switch ports (see image link).
                                    https://www.netgate.com/assets/img/products/sg-3100-back.png

                                    Use the wizard to do all of this. If you setup your WAN port properly (Static IP address or DHCP address from your Comcast modem), that should be good for that one. Then set your LAN switch ports up, using the default 192.168.1.0/24 address range. You can then plug in anything to the LAN ports, even a switch, like you're asking about. Leave the OPT1 port alone for now.

                                    SG-3100 getting-started and setup instructions are here:
                                    https://docs.netgate.com/pfsense/en/latest/solutions/sg-3100/getting-started.html

                                    Is there anything more complicated with your Comcast connection - VLAN stuff, PPPoE login stuff, TV/Phone/Security thingies, anything...? I don't think Comcast operates their modems with those kinds of settings, but I could be wrong.

                                    Jeff

                                    T 1 Reply Last reply Reply Quote 0
                                    • T
                                      Thuan @akuma1x
                                      last edited by

                                      @akuma1x

                                      Thanks Jeff for your help, but I have no luck. Not yet. No matter what or how I tried, I can’t see the internet from any port on the SG-3100. I just have no luck with pfSense.

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by johnpoz

                                        And without you posting anything - its impossible to tell you what you are doing wrong...

                                        So your lan has internet? And now you want to do what exactly with the switch ports

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        T 1 Reply Last reply Reply Quote 0
                                        • T
                                          Thuan @johnpoz
                                          last edited by

                                          @johnpoz

                                          Hi John,

                                          After configured as instructed in the SG-3100 manual, I have no internet from the only VLAN. The grey areas are firewall and DHCP server setup.

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            And again without you actually posting what you did there is no way for us to tell what your doing wrong.. Users say they did X all the time and come to find out they actually did Y..

                                            You saying it doesn't work is not going to get anyone anywhere.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            T 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.