How to get pfSense WAN to accept VLAN 0
-
Any help this forum could provide would be appreciated!!
I am new to pfSense and migrating away from a Ubiquiti Unifi USG3 as my Edge/Firewall device. I am on 1gb Fiber internet and have removed my HH3000 from the configuration and am connected to the Nokia ONT.
Currently (working):
Fiber -> SFP on Nokia ONT -> Nokia ONT DATA1 (RJ45) -> USG 3 WAN (Configuraed with VLAN 0) -> USG LAN 1-> Meraki Switch
Desired Goal:
Fiber -> SFP on Nokia ONT -> Nokia ONT DATA1 (RJ45) -> pfSense WAN (em0) -> pfSense LAN (em1) -> Meraki Switch
** pfSense is on a HW box with 2 physcical Intel NIC recognized as Intel Pro 1000*
Running WireShark on a laptop connected to ONT (get IP and works directly connected no problem), I see that the Ingress packets are 802.1q tagged with VLAN 0.
Any thoughts on how I can make this work when pfSense does not allow me to configure WAN as VLAN 0??
-
@natbart ,
Are you on AT&T internet, or a different fiber provider?
If you ran pfsense on a ESXi host as a VM, it's easy to have vmware handle the VLAN 0 issue for you.
-
@fresnoboy I am on another provider in Canada - Bell MTS.
I might try VMware but was hoping to avoid the extra complexity of adding VMware to the mix. My HW is vmware capable but only 4gb memory right now.
-
Some more digging indicates Netgraph maybe be able to accomplish what I need to do. A portion of pfatt (https://awesomeopensource.com/project/aus/pfatt or https://github.com/MonkWho/pfatt/tree/faa80d09f9c00e4a67bc3cacf2eab5a1631ec3f9) an ATT By-pass seems to tag traffic in & out with VLAN0. I am no Free BSD expert or have any familiarity with Netgraph.
Anyone familiar with this? Or used this before?
-
Yes, you would need to use netgraph to do that in pfSense. You cannot create a VLAN with VID 0 in pfSense/FreeBSD directly.
Steve
-
@natbart said in How to get pfSense WAN to accept VLAN 0:
By-pass seems to tag traffic in & out with VLAN0
I trust you realize VLAN0 only adds the priority tag and does not result in a separate VLAN.
-
@JKnott & @stephenw10 thanks.
Just looking for some resources or guidance. VLAN 0 seems to be only way for me to connect to ONT and grab a DHCP address.
Totally get that it is not creating a new VLAN. Just trying to get pfSense to work with my service provider’s configuration.
Not sure why some service providers like mine and ATT chose this design.
-
Yup, exactly. There's no way to do that in pfSense though AFAIK.
Also I believe some equipment still recognizes that as a VLAN even if it's outside the spec.
Steve
-
The cynic in me suspects they deliberately chose that because it's outside the spec which forces people to use their equipment.
-
Setting vlan id 0 would be when you want to set priority, but not use a vlan - if I recall..
edit: ah jknott bet me too it ;)
But also with steve - they prob do that on purpose as well, not all equipment will support doing that, especially "home" based gear..
-
Super frustrating! My Ubiquiti USG3 let me do it and then I got some great hardware (super excited) and got started on pfSense only to be stopped dead in my tracks because of this.
Want to get rid of the under powered USG3 but sinking hours into trying to understand how to get pfSense to work in this configuration is killing me.
The netgraph option sounds doable but it currently beyond my skill set and taking lots to wrap my head around what is required to get it implemented.
-
I can understand that some hardware doesn't support it properly, but that's no reason why pfsense shouldn't.
-
I don't think you can do it freebsd unless I'm using the wrong incantation.
You can apply a priority tag to a vlan but you can't create a zero tagged vlan to apply it to.
@natbart Does your provider actually require a priority tag?
Steve
-
@jknott said in How to get pfSense WAN to accept VLAN 0:
but that's no reason why pfsense shouldn't.
Well depends - does freebsd support it? I think people sometimes forget pfsense runs freebsd.. Just like the wireless support. Not really a pfsense thing, its a freebsd thing..
And to be honest.. It's not a real common thing to do - not like a million users out there screaming I need to be able to set vlan 0 ;)
Looking to what unifi does, seems for some ATT bypass - the classic UI allows you to set it - most likely because they just didn't set restrictions.. But new UI of the controller seems to..
https://community.ui.com/questions/Using-VLAN-0-for-WAN-with-new-interface/fe455db8-0d3f-4fa4-8d27-0ee337d2cefe?page=0
btw.. In 30 some years I don't recall ever having to set this ever ;)
-
@johnpoz said in How to get pfSense WAN to accept VLAN 0:
not like a million users out there screaming I need to be able to set vlan 0
What's that noise I hear?
IIRC, I was able to set it in Linux. My understanding for using it is to provide priority on the main LAN, but I don't know that you could have both tagged and untagged on the same LAN. I agree there's not a lot of call for it.
-
@stephenw10 not sure what to say... I am told it works on FreeBSD with Netgraph.
ATT users need to do this also to bypass their GATEWAY box. Their are definitely implementations or designs that require it.
Some users maybe just gave up and moved to other hardware that could accomplish it.
Wireshark shows packets tagged 802.1q with VLAN0 when my laptop was connected.
-
I’m just a guy interested in pfSense and not wanting to use Service Provider gateway (HH3000).
I guess I posted here hoping someone might have more experience with this scenario or problem.
I appreciate the dialog so far and hope maybe there is some solution that will make this work.
-
I do this with my AT&T fiber connection to get rid of the POS AT&T gateway.
BTW, another technique to deal with this VLAN0 silliness is to use a cheap switch to strip the VLAN0 from the WAN connection like the Netgear GS108Ev3 . The AT&T bypass thread here: https://forum.netgate.com/topic/99190/att-uverse-rg-bypass-0-2-btc/328 has all sorts of info on dealing with the VLAN0 problem that AT&T Fiber users have to deal with.
-
There are some providers who require a priority tag on WAN but I've never seen that without a, valid, vlan tag.
Steve
-
@fresnoboy said in How to get pfSense WAN to accept VLAN 0:
Netgear GS108Ev3
I will continue to read the ATT bypass solutions. My service provider does not have all the WPA supplicant / certificate requirements that ATT users have, so was trying to distinguish the required element from that fix.
I have thought about putting a switch in the mix, but a Netgear GS108 is another $75 CDN on Amazon and adds another layer to the solution as well as cost.
What requirements does the switch need to solve my problem? Does it make more sense to throw on VMware and at least deal with one piece of hardware.
-
These switches are usually available on ebay or even Craigslist for a lot less. I'm not saying it's the best solution, but it works without having to run vmware, etc...
Good luck!
-
Yeah, it should work with netgraph because there are no restrictions really. You can do whatever you want there unlike ifconfig.
It shouldn't be that hard either. Another think that uses it is QinQ. If you create a QinQ interface and then check in /tmp you can see the file with the netgraph commands used to create it.
Or indeed the example given here.
Steve
-
Running packet capture on the WAN port all I see is a DHCP discovery broadcast (by my unit) and a DHCP offer by provider which unit never responds to but causes it to put another Discover out there.
Offers are tagged:
802.1Q Virtual LAN, PRI: 7, DEI: 0, ID: 0
-
-
If you didn't have to priority tag it on the USG you wonl't have to here.
This is going to be like a 5 line script but Netgraph always makes my brain hurt!
Just hitting errors right now.... -
@stephenw10 the only setting i set on the Unifi USG3 was "Use VLAN ID" and I set it to "0"
I was able to do a temp work around with a 24 port Cisco Small Business switch that I had and put it between ONT and pfSense. This allowed me to grab a DHCP address from provider and surf. Overkill solution.
Will continue to look at the netgraph option... as this seems like the cleanest option. I just need to wrap my head around how netgraph work and how to compile as I dont have a system running FreeBSD (outside of this pfSense box).
-
@stephenw10 will read up at provided link. Thank you for the continued engagement.
-
Just to point out - unifi doesn't make this as easy as made out to be..
They might support it on some versions of the controller software in some places - but like most applications 0 and 4095 are not really valid
Is there a feature request for this? If there are ISPs that want/need this - and freebsd allows for it, etc. I would expect if there was a feature request for it - it would/could be looked at implementing in the gui as a check box, or something.
But in 30 some years in the biz - sorry but setting vlan 0 is not a common thing.
-
@johnpoz having this as an option would be amazing. Would be simple than some of the other work arounds.
Hard to believe others haven’t asked for it based on ATT also needing it (amongst other config). Not used what other ISPs are similarly config’ed.
-
I haven't combed through redmine yet - but yeah if you want/need this - then it should be submitted to redmine as a feature request..
If it can be done, and there is desire for it - why would it not be implemented.
But to be honest - I do believe part of the reason for such a deployment would be making it harder for isp customers to use non isp hardware.. Since setting vlan id 0 is not really something that is common
-
@johnpoz I configured in the initial USG config. Not using the controller software.
-
@johnpoz sorry, I am not sure who/ what Redmine is. This is my first post and I just got pfSense installed this week. I am very new to since. My initial excitement did fizzle somewhat when I ran into this issue.
-
Question:
Why not run it in transparent mode and let pfsense handle WAN??
-
@cool_corona not sure I understand what you mean. New to pfSense can you elaborate?
-
@natbart You put the Nokia in bridge mode and connect the pfsense WAN on RJ45.
Then handle WAN via DHCP to see if it works. And then you are rid of the USG
-
As I understand it that is the plan here. But the ISP requires the traffic tagged as VLAN0 and pfSense does not currently have any way to set that.
Netgraph still defeating me!
Steve
-
This post is deleted! -
@cool_corona said in How to get pfSense WAN to accept VLAN 0:
@natbart You put the Nokia in bridge mode and connect the pfsense WAN on RJ45.
Then handle WAN via DHCP to see if it works. And then you are rid of the USG
thanks for the tip. As far as I know I have no access to the Nokia ONT. It is doing media conversion from Fiber to Ethernet and is otherwise a black box to the end-user.
-
@stephenw10 I appreciate any work you are attempting to do with Netgraph! I havent been able to dig into it any more myself.
-
If you look at the att netgraph scripts, they could be useful in solving the vlan0 issue. They handle that, but have a lot of other functions not needed in your case. You should be able to start with them and pare it down to pretty much nothing if you don't need the gateway auth bypass etc...