VLANs without a 'Smart' Switch?

[vaximily]

@johnpoz Houston, we have liftoff!

Now I just have to start writing the firewall rules and get the rest of the vlan's configured... I'm sure I'll be back!

Thank you so much!

login-to-view

[johnpoz]

Great - while you "can" pass vlans over a dumb switch... It is not good setup and not secure.. You need to put actual smart switch(es) on your to buy list... They can be had for like $40 for 8 port gig... So they are not all that expensive..

Just highly suggest you stay away from the cheap tplink ones - they have issues with vlans... I would suggest say the dlink dgs-1100-08 as better choice.

currently see it on amazon for $40
https://www.amazon.com/D-Link-EasySmart-Gigabit-Ethernet-DGS-1100-08/dp/B008ABLU2I

[vaximily]

Wow, those are some huge screenshots lol.

So, even though we're getting an IP from the correct DHCP now, I'm still not getting internet traffic through on that SSID... see firewall config below...

I assume I'm missing something obvious at this point

login-to-view

[johnpoz]

Did you mess with outbound nat? Auto would of auto added your vlans, but if you set it to manual for some reason that could cause you problems.

Can you ping pfsense vlan44 IP? Can you ping pfsense wan IP? From your vlan 44 client?

So while it looks like your allowing dns to that 10.10.10.5 address - does it actually return query for dns?

Can you ping 8.8.8.8 from the client.

[vaximily]

I think I forgot to hit "apply" on that first screenshot, and those settings did work after I applied them...

However, this is how I intended to set it up (probably my own exhaustion and ignorance here), to only allow that SSID/VLAN (IOT devices) to access the internet through the firewall, but disallow them from accessing any other local networks / VLANs...

login-to-view

Also tried it like this...
login-to-view

Most everything I can ping from my phone, including the .5 DNS, just can't make it to the internet...

Here are my other configs, in case it matters...
login-to-view
login-to-view

[vaximily]

@johnpoz

I don't think I did a very good job answering, so I'll be thorough...

• Did you mess with outbound nat? No.
• Can you ping pfsense vlan44 IP? From my PC (LAN), no - also no from phone (VLAN44). I assumed that the interface just wasn't responding to pings in general.
• Can you ping pfsense wan IP? Yes, from PC (LAN) and Phone (VLAN44)
• From your vlan 44 client? Yes.
• So while it looks like your allowing dns to that 10.10.10.5 address - does it actually return query for dns? Haven't checked query, but I can ping it from my phone
• Can you ping 8.8.8.8 from the client. Phone (VLAN44), no.

[vaximily]

Just testing my own understanding at this point... adding the top line does allow me to ping 10.10.10.1 from VLAN44, but the second line does not.

login-to-view

As I understand it, the bottom rule should be passing traffic between VLAN44 and WAN, but that doesn't appear to be the case...

Just noticed this in the firewall logs, probably related but I'll poke more...
login-to-view

[johnpoz]

If you want internet - internet is ANY, not wan or wan net, etc.

Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated..

If you don't want vlan44 to get to other vlans, then put in a rule that blocks above the any allow rule.. Setup an alias with say all rfc1918 space..

Here is example I use to show users how it "can" be setup..

login-to-view

They are labeled what they do.

[vaximily]

Okay, we're rolling... I need to get some rest, but truly appreciate all the help. I'm sure things will run along smoothly once I have a fresh set of eyes!

[johnpoz]

Great - any questions just ask, here to help.

Remember get those smart switch(es) on order! ;)