Netgear/Vlans/Pfsense

r79c

@dotdash The netgear software in advanced configuration of 802.1q will not let me untag the many unused ports on VLAN ID 1 due to the following error

802.1Q
Cannot remove port 8 from this VLAN. Change its PVID first.

Here's the current outbound nat and one of vlan5 rule

https://ibb.co/8dzx2FK
https://ibb.co/SBwzZQG

johnpoz

well your forcing vlan 5 out some vpn group. I thought vlan 5 was 192.168.5.0/24 - so how would it it ever nat to some vpn connection.

Also your hybrid rules for wan interface are pointless - since those are already in the automatic rules.

Well you can not remove a vlan X from a port if pvid is set to vlan X..

If you just want 1 port on vlan 5 the only thing that needs to happen on the switch is tag vlan 5 on port connected to pfsense. And the port connected to device you want in vlan 5 would have vlan 1 removed and untagged vlan 5, and pvid vlan 5

r79c

vlan5 static ip is 192.168.5.1/24

I assumed I would be able to NAT the VLAN5 to use the VPN_GROUP I set up which is basically three openvpn clients, just like the LAN does?

I have followed your advice for the switch I have taken four more screenshots of the switch configuration.

https://ibb.co/j88PF1j
https://ibb.co/KWQbQQF
https://ibb.co/k0rn4Mg
https://ibb.co/WyKjjLZ

johnpoz

You have port all ports untagged vlan 1 - that is WRONG!!!

That even lets you have 1 an 5 untagged on port 1 is just stupid.. You should not be able to put more than 1 untagged vlan on a port.. Its a borked configuration!!

ssumed I would be able to NAT the VLAN5 to use the VPN_GROUP

How - you don't have anything in outbound nat natting 192.168.5/24 to your vpn interface.. You only have 192.168.1/24

r79c

@johnpoz For me to change the port setup in membership tab on vlan1 I have to change the Port PVID

ah apart from port 1 which I can blank

like so

https://ibb.co/16BV4hz

johnpoz

You have its pvid set to 5.. So remove the vlan 1 untagged on that port!

Which is correct... Your telling the switch hey any untagged traffic you see ingress to this port is vlan 5 traffic!! And putting the switch in vlan 5 untagged tells the switch hey only send vlan 5 traffic out this port, and remove the tag.

Now the device connected to this port is in vlan 5, but it doesn't really know.. It just sees untagged traffic..

r79c

right ok I think I've done that

https://ibb.co/16BV4hz
https://ibb.co/w7ZLhMV

johnpoz

That looks right yes.

Now you just need to fix your hybrid rules if you want vlan5 to go out your vpn connection.

r79c

So I would need to add a rule for 192.168.5.0/24 LAN to WAN?? altho I have an automatic rule with that.

BTW thanks for your help, I'm learning, albeit slowly!

johnpoz

No you need an outbound nat so that pfsense will nat 192.168.5 to one of your vpn interfaces.. You only had 192.168.1 in your hybrid natting to yoru vpn interface ips.

Why would you need a rule for lan to wan?? Wan net is not the internet - its just wan net, that is it... Your rule on sending vlan 5 out your vpn would send it out a vpn... But you had no outbound nat to nat 192.168.5 to vpn interface.

r79c

I added a rule to one of the vpn interfaces that I have outbound

https://ibb.co/4TspV7G

Is this correct?

johnpoz

Again those wan outbound hybrids are POINTLESS!!!

And how you sure that outbound nat is gong to use that vpn interface, if your policy routing it out a group... What if it goes out a different vpn interface?

r79c

So i have the following configuration and I still have no internet connectivity on the pc plugged into port 1 on the netgear switch. The VLAN5 interface is up, I have outbound NAT rules and firewall rules in the VLAN tab. I just dont understand it at the moment????? It should be relatively simple.

on the pc i get a dhcp lease but am unable to ping 192.168.5.1 or google.com

LAN is on 192.168.1.
VLAN is on 192.168.5.

here are some more screens of the configuration.

https://ibb.co/0ft99fJ
https://ibb.co/D9W0ZXV
https://ibb.co/wy401MF
https://ibb.co/z7Rv26Z
https://ibb.co/dcXmmCQ
https://ibb.co/8r27zTG
https://ibb.co/vsmjRxW
https://ibb.co/7JGDVS1
https://ibb.co/HTCjhpN

I've just read that you cannot send vlan over vpn!

https://forum.netgate.com/topic/148170/specific-vlan-over-vpn-only/5

dotdash

Not sure how that NordVPN stuff works, but I think you need the 192.168.5.0 natting out the VPN gateway instead of the redundant WAN. Why don't you just verify the vlan works out the WAN first. I'll refrain from giving my opinions of 'privacy' vpn providers.
RE: That last link, i'm not sure what JP is on about- you can't carry the vlan tag over a VPN, but you can absolutely have a vlan interface with a unique subnet and route that. My experience however is with site to site tunnels.

r79c

I thought that as well, getting it to work with the WAN first so I added the following mapping...

https://ibb.co/WF4NFYm

still no internet, It has to be something stupid that I'm not configuring properly...

johnpoz

@r79c said in Netgear/Vlans/Pfsense:

on the pc i get a dhcp lease but am unable to ping 192.168.5.1

Well then look to the client for why... Can you arp pfsense 192.168.5.1 on the client? You have no rules allowing to ping pfsense.. Its possible everything thing is getting shoved out your policy.. So no you wouldn't be able to ping 192.168.5.1... Create a rule above your policy route rule that allows ping to vlan address

I've just read that you cannot send vlan over vpn!

Your reading that WRONG... That has nothing to do with what your doing, which is routing a specific network/vlan over a vpn connection.

As to getting to the internet - well how and the F do you think its going to go out your vpn which your forcing via your policy route.. But your not natting to it... We already went over this!!!

What I would highly suggest you do is get your vlan 5 working as a normal network before you worry about shoving all its traffic down some vpn connection.

r79c

@johnpoz What I would highly suggest you do is get your vlan 5 working as a normal network before you worry about shoving all its traffic down some vpn connection.

that's what I'm trying to do

@johnpoz Create a rule above your policy route rule that allows ping to vlan address

By policy route rule you mean a firewall rule in the vlan tab that allows me to ping vlan address?

if i do arp -a 192.168.5.1 i get

Interface: 192.168.5.0 --- 0x7
Internet Address 192.168.5.1
Physical Address MAC
Type Dynamic

rules picture

https://ibb.co/cyTRT9s

johnpoz

@r79c said in Netgear/Vlans/Pfsense:

I dont get a response with arp 192.168.5.1

Look in your client that is on this vlan 5, look in its arp table.. If you do not see pfsense mac address then NO your never going to be able to ping it.

And would say your not getting dhcp from it either..

I am assuming this is a windows box.

lets see its ipconfig /all
ping 192.168.5.1
look in your arp table
arp -a

This is WRONG

Interface: 192.168.5.0 --- 0x7

Post your ipconfig /all

Your interface sure and the hell should not have a .0 address with a /24 mask.

r79c

arp -a on the client gives me

Interface: 192.168.5.50 --- 0x7

Internet Address
192.168.1.125
192.168.1.201
192.168.1.202
192.168.5.1 - mac address is that of LAN interface on Pfsense
192.168.5.255
224.0.0.2
224.0.0.251
224.0.0.252
239.255.255.250
255.255.255.255

with all the physical address as well

ipconfig /all

Connection : localdomain
description: intel gb network connection
physical: mac
dhcp enabled: yes
auto config: yes
link local ipv6: ...
ipv4 192.168.5.50
subnet mask: 255.255.255.0
default gateway: 192.168.5.1
dhcp server: 192.168.5.1
dhcpv6 iaid: 133459204
dhcpv6 client duid: ...
dns server: 192.168.5.1
netbios over tcip: enabled

yes client is a windows box

johnpoz

Well is the mac address for 5.1 pfsense mac address. Where were you seeing 5.0? for your interface?

You have something really F'd up

192.168.1.125
192.168.1.201
192.168.1.202

You shouldn't be seeing 192.168.1 address if your in vlan 5!!!