Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Netgear/Vlans/Pfsense

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    58 Posts 4 Posters 10.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      r79c
      last edited by r79c

      So I would need to add a rule for 192.168.5.0/24 LAN to WAN?? altho I have an automatic rule with that.

      BTW thanks for your help, I'm learning, albeit slowly!

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        No you need an outbound nat so that pfsense will nat 192.168.5 to one of your vpn interfaces.. You only had 192.168.1 in your hybrid natting to yoru vpn interface ips.

        Why would you need a rule for lan to wan?? Wan net is not the internet - its just wan net, that is it... Your rule on sending vlan 5 out your vpn would send it out a vpn... But you had no outbound nat to nat 192.168.5 to vpn interface.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 1
        • R
          r79c
          last edited by

          I added a rule to one of the vpn interfaces that I have outbound

          https://ibb.co/4TspV7G

          Is this correct?

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            Again those wan outbound hybrids are POINTLESS!!!

            And how you sure that outbound nat is gong to use that vpn interface, if your policy routing it out a group... What if it goes out a different vpn interface?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            R 1 Reply Last reply Reply Quote 1
            • R
              r79c @johnpoz
              last edited by r79c

              So i have the following configuration and I still have no internet connectivity on the pc plugged into port 1 on the netgear switch. The VLAN5 interface is up, I have outbound NAT rules and firewall rules in the VLAN tab. I just dont understand it at the moment????? It should be relatively simple.

              on the pc i get a dhcp lease but am unable to ping 192.168.5.1 or google.com

              LAN is on 192.168.1.
              VLAN is on 192.168.5.

              here are some more screens of the configuration.

              https://ibb.co/0ft99fJ
              https://ibb.co/D9W0ZXV
              https://ibb.co/wy401MF
              https://ibb.co/z7Rv26Z
              https://ibb.co/dcXmmCQ
              https://ibb.co/8r27zTG
              https://ibb.co/vsmjRxW
              https://ibb.co/7JGDVS1
              https://ibb.co/HTCjhpN

              I've just read that you cannot send vlan over vpn!

              https://forum.netgate.com/topic/148170/specific-vlan-over-vpn-only/5

              johnpozJ 1 Reply Last reply Reply Quote 0
              • dotdashD
                dotdash
                last edited by

                Not sure how that NordVPN stuff works, but I think you need the 192.168.5.0 natting out the VPN gateway instead of the redundant WAN. Why don't you just verify the vlan works out the WAN first. I'll refrain from giving my opinions of 'privacy' vpn providers.
                RE: That last link, i'm not sure what JP is on about- you can't carry the vlan tag over a VPN, but you can absolutely have a vlan interface with a unique subnet and route that. My experience however is with site to site tunnels.

                1 Reply Last reply Reply Quote 0
                • R
                  r79c
                  last edited by r79c

                  I thought that as well, getting it to work with the WAN first so I added the following mapping...

                  https://ibb.co/WF4NFYm

                  still no internet, It has to be something stupid that I'm not configuring properly...

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @r79c
                    last edited by johnpoz

                    @r79c said in Netgear/Vlans/Pfsense:

                    on the pc i get a dhcp lease but am unable to ping 192.168.5.1

                    Well then look to the client for why... Can you arp pfsense 192.168.5.1 on the client? You have no rules allowing to ping pfsense.. Its possible everything thing is getting shoved out your policy.. So no you wouldn't be able to ping 192.168.5.1... Create a rule above your policy route rule that allows ping to vlan address

                    I've just read that you cannot send vlan over vpn!

                    Your reading that WRONG... That has nothing to do with what your doing, which is routing a specific network/vlan over a vpn connection.

                    As to getting to the internet - well how and the F do you think its going to go out your vpn which your forcing via your policy route.. But your not natting to it... We already went over this!!!

                    What I would highly suggest you do is get your vlan 5 working as a normal network before you worry about shoving all its traffic down some vpn connection.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    R 1 Reply Last reply Reply Quote 0
                    • R
                      r79c @johnpoz
                      last edited by r79c

                      @johnpoz What I would highly suggest you do is get your vlan 5 working as a normal network before you worry about shoving all its traffic down some vpn connection.

                      that's what I'm trying to do

                      @johnpoz Create a rule above your policy route rule that allows ping to vlan address

                      By policy route rule you mean a firewall rule in the vlan tab that allows me to ping vlan address?

                      if i do arp -a 192.168.5.1 i get

                      Interface: 192.168.5.0 --- 0x7
                      Internet Address 192.168.5.1
                      Physical Address MAC
                      Type Dynamic

                      rules picture

                      https://ibb.co/cyTRT9s

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        @r79c said in Netgear/Vlans/Pfsense:

                        I dont get a response with arp 192.168.5.1

                        Look in your client that is on this vlan 5, look in its arp table.. If you do not see pfsense mac address then NO your never going to be able to ping it.

                        And would say your not getting dhcp from it either..

                        I am assuming this is a windows box.

                        lets see its ipconfig /all
                        ping 192.168.5.1
                        look in your arp table
                        arp -a

                        This is WRONG

                        Interface: 192.168.5.0 --- 0x7
                        

                        Post your ipconfig /all

                        Your interface sure and the hell should not have a .0 address with a /24 mask.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • R
                          r79c
                          last edited by r79c

                          arp -a on the client gives me

                          Interface: 192.168.5.50 --- 0x7

                          Internet Address
                          192.168.1.125
                          192.168.1.201
                          192.168.1.202
                          192.168.5.1 - mac address is that of LAN interface on Pfsense
                          192.168.5.255
                          224.0.0.2
                          224.0.0.251
                          224.0.0.252
                          239.255.255.250
                          255.255.255.255

                          with all the physical address as well

                          ipconfig /all

                          Connection : localdomain
                          description: intel gb network connection
                          physical: mac
                          dhcp enabled: yes
                          auto config: yes
                          link local ipv6: ...
                          ipv4 192.168.5.50
                          subnet mask: 255.255.255.0
                          default gateway: 192.168.5.1
                          dhcp server: 192.168.5.1
                          dhcpv6 iaid: 133459204
                          dhcpv6 client duid: ...
                          dns server: 192.168.5.1
                          netbios over tcip: enabled

                          yes client is a windows box

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz

                            Well is the mac address for 5.1 pfsense mac address. Where were you seeing 5.0? for your interface?

                            You have something really F'd up

                            192.168.1.125
                            192.168.1.201
                            192.168.1.202
                            

                            You shouldn't be seeing 192.168.1 address if your in vlan 5!!!

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            R 1 Reply Last reply Reply Quote 0
                            • R
                              r79c @johnpoz
                              last edited by

                              @johnpoz yes the mac address for 5.1 is the mac address of the lan interface

                              5.0 must have been a typo

                              two of those 192.168.1 address are static IP mappings for devices
                              192.168.1.125 is the IP address of an access point

                              all these IP addresses go through port 3 on the netgear switch which is connected to a wireless access point mesh

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                @r79c said in Netgear/Vlans/Pfsense:

                                two of those 192.168.1 address are static IP mappings for devices

                                Doesn't matter! So you created those on the device directly with arp? For why? It is pointless, and does nothing - sure and the F not going to work..

                                I take it basic understanding of how vlans actually work, and what they do is where we need to start..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                R 1 Reply Last reply Reply Quote 0
                                • R
                                  r79c @johnpoz
                                  last edited by

                                  @johnpoz So you created those on the device directly with arp? For why?

                                  I statically mapped those IP addresses using Pfsense with arp yes, why, because those two devices are TV's which I did not want to put the traffic over VPN connection.

                                  @johnpoz I take it basic understanding of how vlans actually work, and what they do is where we need to start..

                                  sure, your the only one responding to this, and I'm grateful because I can't seem to get this working at all!!! I'm starting to wonder why I'm bothering really, as I only wanted to setup up one VLAN with one PC on my home network LoL

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    @r79c said in Netgear/Vlans/Pfsense:

                                    I statically mapped those IP addresses using Pfsense with arp yes,

                                    Dude ON THE CLIENT!!! we need to see the arp table on the CLIENT that is in vlan 5 and connected to port 1 of your switch... Not the arp table of pfsense!!!!

                                    Here

                                    $ arp -a                                                      
                                                                                                  
                                    Interface: 192.168.9.100 --- 0xc                              
                                      Internet Address      Physical Address      Type            
                                      192.168.9.10          00-11-32-7b-29-7d     dynamic         
                                      192.168.9.11          00-11-32-7b-29-7e     dynamic         
                                      192.168.9.99          70-6e-6d-f3-11-93     dynamic         
                                      192.168.9.208         02-11-32-2d-aa-61     dynamic         
                                      192.168.9.253         00-08-a2-0c-e6-24     dynamic         
                                      192.168.9.255         ff-ff-ff-ff-ff-ff     static          
                                      224.0.0.22            01-00-5e-00-00-16     static          
                                      239.192.0.0           01-00-5e-40-00-00     static          
                                      239.255.255.250       01-00-5e-7f-ff-fa     static          
                                      255.255.255.255       ff-ff-ff-ff-ff-ff     static          
                                                                                                  
                                    Interface: 192.168.9.101 --- 0x14                             
                                      Internet Address      Physical Address      Type            
                                      192.168.9.10          00-11-32-7b-29-7d     dynamic         
                                      192.168.9.11          00-11-32-7b-29-7e     dynamic         
                                      192.168.9.253         00-08-a2-0c-e6-24     dynamic         
                                      192.168.9.255         ff-ff-ff-ff-ff-ff     static          
                                      224.0.0.22            01-00-5e-00-00-16     static          
                                      239.192.0.0           01-00-5e-40-00-00     static          
                                      239.255.255.250       01-00-5e-7f-ff-fa     static          
                                      255.255.255.255       ff-ff-ff-ff-ff-ff     static          
                                    

                                    This is my windows box arp table... Post yours up from the BOX connected to port 1 of your switch! if on that box your seeing 192.168.1 IPs then your setup is BORKED!!!

                                    And post your ipconfig /all

                                    $ ipconfig /all                                                                     
                                                                                                                        
                                    Windows IP Configuration                                                            
                                                                                                                        
                                       Host Name . . . . . . . . . . . . : i5-win                                       
                                       Primary Dns Suffix  . . . . . . . : local.lan                                    
                                       Node Type . . . . . . . . . . . . : Broadcast                                    
                                       IP Routing Enabled. . . . . . . . : No                                           
                                       WINS Proxy Enabled. . . . . . . . : No                                           
                                       DNS Suffix Search List. . . . . . : local.lan                                    
                                                                                                                        
                                    Ethernet adapter Local:                                                             
                                                                                                                        
                                       Connection-specific DNS Suffix  . :                                              
                                       Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller           
                                       Physical Address. . . . . . . . . : 00-13-3B-2F-67-62                            
                                       DHCP Enabled. . . . . . . . . . . : No                                           
                                       Autoconfiguration Enabled . . . . : Yes                                          
                                       IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred)                     
                                       Subnet Mask . . . . . . . . . . . : 255.255.255.0                                
                                       Default Gateway . . . . . . . . . : 192.168.9.253                                
                                       DNS Servers . . . . . . . . . . . : 192.168.3.10                                 
                                       NetBIOS over Tcpip. . . . . . . . : Enabled                                      
                                                                                                                        
                                    

                                    At a loss to where your posting that arp info from - because that sure and the F does not look like how pfsense would present it..... And no matter what you did with static arps on pfsense they would not show in your clients arp table.. You do not have your vlans setup how you think you do if your seeing arp entries from 192.168.1 on your box that is suppose to be in vlan 5

                                    This is switch setup
                                    pfsense - 1U,5T --- switch --- 5U --- vlan 5 client

                                    If that is how you have it setup, you should NEVER see arp entries for anything other than what is in vlan 5

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    R 1 Reply Last reply Reply Quote 0
                                    • R
                                      r79c
                                      last edited by r79c

                                      ok here it is, from the client...

                                      C:\WINDOWS\system32>arp -a
                                      
                                      Interface: 192.68.5.50 --- 0x7
                                         Internet Address                       Physical Address                  Type
                                         192.168.1.125                          b0-be-76-b7-cf-8c                  dynamic
                                         192.168.1.201                          78-bd-bc-34-d0-f3                  dynamic
                                         192.168.1.202                          08-84-9d-87-b5-d3                 dynamic
                                         192.168.5.1                              6d-b3-11-1c-6c-77                  dynamic
                                         192.168.5.255                          ff-ff-ff-ff-ff-ff                                static
                                         224.0.0.22                                 01-00-5e-00-00-16                 static
                                         224.0.0.251                               01-00-5e-00-00-fb                  static
                                         224.0.0.252                               01-00-5e-00-00-fc                  static
                                         239.255.255.250                      01-00-5e-7f-ff-fa                      static
                                         255.255.255.255                      ff-ff-ff-ff-ff-ff                                static
                                      

                                      BORKED! LOL

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by johnpoz

                                        Yup that is BORKED

                                        You should not be seeing 192.168.1 address if your in vlan 5.. So your switch is clearly not setup correctly. or its not doing what it should be doing.. If you were in vlan 5 it would not be possible for you to get arp answers for anything in 192.168.1

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          r79c @johnpoz
                                          last edited by

                                          @johnpoz said in Netgear/Vlans/Pfsense:

                                          This is switch setup
                                          pfsense - 1U,5T --- switch --- 5U --- vlan 5 client

                                          If you could look at the following pictures they show the netgear switch setup as it is at the moment.

                                          https://ibb.co/0ft99fJ
                                          https://ibb.co/D9W0ZXV
                                          https://ibb.co/wy401MF
                                          https://ibb.co/z7Rv26Z

                                          Pfsense is plugged in to port 2

                                          VLAN5 PC Client is plugged in to port 1

                                          Everything else is plugged into port 3

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            that looks correct yes..

                                            But its not working if your seeing mac of devices in 192.168.1..

                                            Clear your arp table... Do they come back? trying pinging one of those 192.168.1 address from your client after you clear your arp.

                                            BTW your rules on vlan 5 are WRONG!!! source would NEVER be pfsense on vlan 5 address.. Source would be vlan 5 net..

                                            What did you set netgears IP too? You said you changed it.

                                            What is the hardware of your pfsense box?
                                            6DB311

                                            That doesn't resolve as maker of networking gear..

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            R 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.