Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLANs blocked by Firewall

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    36 Posts 6 Posters 4.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      r801248 @cburbs
      last edited by

      @cburbs Hello,

      This is what they look like...
      vlans.png
      vlans status.png

      C 1 Reply Last reply Reply Quote 0
      • C
        cburbs @r801248
        last edited by cburbs

        @r801248

        And if you plug your laptop into ports 3-7 you mentioned you do get a dhcp from VLAN10 (10.70.10.0/24) ? Can you also get out to the internet on those ports?

        Have you tried to add say Port 5 to vlan10 untagged and plug into that to see what happens?

        Maybe delete that Vlan 10 from the switch and start over with it?

        R 1 Reply Last reply Reply Quote 0
        • R
          r801248 @cburbs
          last edited by

          @cburbs
          When I plug the laptop into g3-g7 I get a DHCP from the parent interface (10.70.0.0/24) - Yes, I get out to the internet.
          Adding any other port (untagged) makes it behave like g1-g2.

          kiokomanK 1 Reply Last reply Reply Quote 0
          • kiokomanK
            kiokoman LAYER 8 @r801248
            last edited by

            @r801248
            did you check if there is a firmware update for that netgear?

            ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
            Please do not use chat/PM to ask for help
            we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
            Don't forget to Upvote with the 👍 button for any post you find to be helpful.

            R 1 Reply Last reply Reply Quote 0
            • R
              r801248 @kiokoman
              last edited by

              @kiokoman
              There is an upgrade. I guess I'll go that route.
              Thanks,

              R 1 Reply Last reply Reply Quote 0
              • R
                r801248 @r801248
                last edited by

                @r801248
                Upgraded. Same results. Frustrating.

                C 1 Reply Last reply Reply Quote 0
                • C
                  cburbs @r801248
                  last edited by cburbs

                  @r801248

                  And the switch has a static IP not in any of the DHCP ranges?

                  You may want to set the switch back to default and start over with it again.

                  R 1 Reply Last reply Reply Quote 0
                  • R
                    r801248 @cburbs
                    last edited by

                    @cburbs Yes, the static address is outside the range. Resetting to default values did not change the results.

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @r801248
                      last edited by Gertjan

                      Normally, with these :

                      04b63da2-9c97-4f85-bf86-0a0db93f10aa-image.png

                      Traffic can enter OPT3.

                      Before the final, hidden "drop all" (non-vsible) there is a another hidden rule that let DHCP traffic (UDP, port 67 and ...) come in.
                      So, what ever happens, DHCP should work. But you can see it work.
                      Place an pass rule at the top with proto is UDP and port = 67.
                      Do not use "OPT3 net" as a source, as DHCP traffic is mostly broadcast = 0.0.0.0

                      What you should see now is that these :

                      485d0d72-ba35-47c5-b8b5-5e8af3afa17e-image.png

                      should start to count.

                      If not : check the NIC, cable, switch and the most obvious one : VLAN settings.

                      Btw : when issues, go check the real firewall.
                      It's here, a file : /tmp/rules.debug

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        marvosa @Gertjan
                        last edited by marvosa

                        Some of this stuff has already been mentioned, but the rules on OPT3 have zero hits. So there are multiple areas to look at.

                        My suggestion:

                        • Put an any/any rule at the top of OPT3 and disable everything else until basic IP communication is established.
                        • Remove VLAN1 from g8 on the switch
                        • Remove the 10.70.0.0/24 subnet from OPT2 and leave it undefined
                        • Bounce the DHCP server on OPT3
                        • Reboot the PC connected to g1 or g2

                        After the above, provided the switch is configured properly... everything should be passed and working as expected.

                        A cleanup item once you get everything working... remove that OPT3 net/OPT3 net rule... it's doing absolutely nothing.

                        R 1 Reply Last reply Reply Quote 1
                        • R
                          r801248 @marvosa
                          last edited by r801248

                          @marvosa
                          Hi,
                          The switch loses connectivity when VLAN1 is removed from g8, tried it before.
                          Also, upon rebooting the router, there is a brief connection through VLAN10. Only lasts a couple of seconds though. Logs below -

                          DHCP Leases
                          vlan10 status.png
                          DHCP Log
                          dhcp log.png

                          Then it drops,

                          Firewall log
                          firewall log.png

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            marvosa @r801248
                            last edited by

                            Also, upon rebooting the router, there is a brief connection through VLAN10. Only lasts a couple of seconds though. Logs below -

                            Sounds like traffic may be passing until the rules get loaded. Did you add the any/any rule?

                            R 1 Reply Last reply Reply Quote 0
                            • R
                              r801248 @marvosa
                              last edited by

                              @marvosa
                              I did. That's the only rule in OPT3

                              27fa52c1-c28d-47ff-8afd-7cac9e5f2a29-image.png

                              C 1 Reply Last reply Reply Quote 0
                              • C
                                cburbs @r801248
                                last edited by cburbs

                                @r801248

                                This setup is on igb3 correct?

                                Have you tried to get a vlan going correctly on igb0 instead - maybe something flaky going on with igb3.

                                I just came across this so maybe look into this - https://community.netgear.com/t5/Managed-Switches/GS110TP-won-t-retain-VLAN-membership-on-port-8/td-p/1446089

                                See if that is set for port mirroring.

                                Or I guess just try port 7 as your trunk/tagged port and see what happens as well.

                                M 1 Reply Last reply Reply Quote 0
                                • M
                                  marvosa @cburbs
                                  last edited by marvosa

                                  I agree. The usual suspects are typically... something's not configured properly, not plugged in properly, or not function properly.

                                  Not seeing anything glaring in the configs, so I'd start trying things like...different ports on the switch, different cables, try moving the VLANs to a different NIC, try a different switch, etc.

                                  I've also read a few posts where after trying everything... people have reset PFsense to factory default, re-built their config from scratch and everything somehow magically starts working.

                                  R 1 Reply Last reply Reply Quote 0
                                  • R
                                    r801248 @marvosa
                                    last edited by

                                    @marvosa

                                    I guess I'll go that route and reset and reconfigure the box.

                                    Thanks,

                                    C 1 Reply Last reply Reply Quote 0
                                    • C
                                      cburbs @r801248
                                      last edited by

                                      @r801248 said in VLANs blocked by Firewall:

                                      @marvosa

                                      I guess I'll go that route and reset and reconfigure the box.

                                      Thanks,

                                      Look at the last thing I posted to see if you see anything odd with port 8 -

                                      Try port 7 before you do a reconfigure as your trunk port just to see.

                                      Then maybe reconfigure.

                                      R 1 Reply Last reply Reply Quote 0
                                      • R
                                        r801248 @cburbs
                                        last edited by

                                        @cburbs
                                        There's no port mirroring, but I'll try 7 as you suggested.

                                        Thanks,

                                        C 1 Reply Last reply Reply Quote 1
                                        • C
                                          cburbs @r801248
                                          last edited by

                                          @r801248 Status update?

                                          R 1 Reply Last reply Reply Quote 0
                                          • R
                                            r801248 @cburbs
                                            last edited by

                                            @cburbs

                                            It did not work on port 7 either. I will reset pfSense to factory defaults over the weekend as the wife works from home and we need the connection.

                                            Thanks,

                                            C 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.