Help with physical interfaces and VLANs
-
If you have the physical nics, and you have the ports on your switch - its better use 1 gig for each vlan since as mentioned vlans on the same physical port share the bandwidth. And if your doing intervlan routing and traffic is routing over the vlans on the same physical interface your hairpinning your traffic.
So if you have the physical media why not use it.. If you don't have enough for all - spread your vlans out over different physical interfaces that makes the most sense for traffic flow, put some lower use vlans on the same physical for example - that don't really talk to each other if you can.
For example my wireless vlans share the same physical interface on my router.. Since these are not even capable of gig anyway, So sharing a physical gig interface is less likely to cause a bottle neck. And wireless clients are never talking to each other with anything that would require any real bandwidth at all..
-
Thanks, yes that is why I put the quad port NIC in it, I would like to use all ports. So lets say on igb0 (LAN), I can put vlan 100 for lan mgmnt. On igb1, I can put vlan 200 for my in-law suite outbuilding. Everything on that interface/vlan will be coming from one wire and can all be vlan 200 with no access to anything else but internet. On igb2 I can put vlan 300 for guest wifi, vlan 400 for main wifi, vlan 500 for iOT and vlan 600 for a/v. The last interfance, igb3, can be future use. Does that sound ok? or am I over engineering things? Would/should each vlan have their own subnet?
-
Yes - each VLAN will be a different broadcast domain (the whole point) so they all need their own subnets.
Again, it depends on traffic levels, not the number of VLANs.
I have pretty much all of my VLANs here on one 2 x 1G LACP to my switching gear.
Some things, like the hypervisor to NAS shared storage are direct-attach for obvious reasons.
Never give it a second thought.
-
Ok I think I understand that enough to be dangerous. Now I need assistance with configuring my LAN and VLAN100 to get internet access. For testing purposes, lets pretend my Linksys router is the cable modem. I have my pfsense WAN plugged into my Linksys router. Pfsense has a WAN DHCP of 192.168.100.100 and WAN gateway of 192.168.100.1 (that is the Linksys router). The LAN interface IP is 192.168.200.1, with DHCP on the same subnet. I have a PC on that VLAN that obtained address 192.168.200.10, but the PC cannot access the internet. What gateway should be on the LAN interface or what am I missing? Do I need a firewall rule to allow VLAN100 internet access across the WAN?
-
@BlankSpace said in Help with physical interfaces and VLANs:
Do I need a firewall rule to allow VLAN100 internet access across the WAN?
You would need to create rule(s) yes - only lan gets default any rules, if you fire up another interface or vlan there will be no rules.. To get things working for testing you can just duplicate your lan rule any any with the new vlan net as source vs lan net. Once your sure things are working you can lock stuff down how you want.
-
I am not even sure the WAN side of things has internet. Should I be able to ping WAN hosts (google.com) from the CLI shell? because I cannot.
-
Well yeah pfsense needs internet to be able to give it to clients behind ;)
Does your pfsense show its wan up, it will tell you if it can reach its gateway, even if just your other router.
You sure when you setup your lan 192.168.200 you didn't use a /16 mask did you? if your wan mask is /24 which should be common your lan should be /24 as well - if 16 it would overlap your wan and then yeah things would have issues.
-
The WAN_DHCP gateway (192.168.100.1) is listed as online, then there is another GW_LAN (default) (192.168.0.1) that is offline.
-
@BlankSpace said in Help with physical interfaces and VLANs:
GW_LAN (default) (192.168.0.1) that is offline.
Well that is WRONG!!! you wouldn't set a gateway on your lan! I never understand how users do this - it doesn't ask you to do that... And even if you set one up, it tells you shouldn't
-
In the LAN interface config, the IPv4 Upstream gateway is listed as "none", but I think I have more problems then that lol. If I can't ping internet hosts from the WAN. Also my LAN is 192.168.200.0/24 not 192.168.0.1.
-
Post up your gateways... You shouldn't have any gateways other than your wan, which I assume you got from dhcp... Your sure pfsense wan is actually 192.168.100
-
Ok I deleted the 192.168.0.1 gateway. The only one now is the WAN which was from DHCP as you stated. It is listed as WAN_DHCP, WAN, 192.168.100.1 192.168.100.1 Interface WAN_DHCP Gateway.
-
Something going on with the WAN tho, can't ping Internet, destination unreachable.
-
@BlankSpace said in Help with physical interfaces and VLANs:
WAN_DHCP, WAN, 192.168.100.1 192.168.100.1
can you you ping that? From pfsense
You can not ping say 8.8.8.8 from pfsense or you can not resolve www.google.com
-
Yes I can ping that from pfsense shell and no, I cannot ping 8.8.8.8 or resolve google.com.
-
what about 8.8.8.8
That 192.168.100.1 is your current router?
-
@johnpoz said in Help with physical interfaces and VLANs:
what about 8.8.8.8
That 192.168.100.1 is your current router..
Correct, which would be the WAN gateway. Its actually a port off of a linksys LRT214 with its own vlan and subnet. If I plug my pc directly into that, I would get the same DHCP and have internet access.
-
Well if you can not ping 8.8.8.8 then you have something wrong with upstream.. Do a sniff on your wan while you ping 8.8.8.8 - do you see it go out??
-
From the shell when trying to ping, I get no route to host. Packet capture shows:
16:15:19 IP 192.168.100.100 > 192.168.100.1: ICMP echo request. id 2892, seq 3180, length 8
16:15:19 IP 192.168.100.1 > 192.168.100.100: ICMP echo reply. id 2892, seq 3180, length 8
-
Then you don't have a gateway setup if you don't have a default route... Post your gateways, show your routes..
Did you get your wan via dhcp, or did you manually set it?
