• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

How to get pfSense WAN to accept VLAN 0

General pfSense Questions
25
414
206.2k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J
    JKnott @natbart
    last edited by Feb 7, 2021, 1:49 PM

    @natbart said in How to get pfSense WAN to accept VLAN 0:

    By-pass seems to tag traffic in & out with VLAN0

    I trust you realize VLAN0 only adds the priority tag and does not result in a separate VLAN.

    "The reserved value 0x000 indicates that the frame does not carry a VLAN ID; in this case, the 802.1Q tag specifies only a priority (in PCP and DEI fields) and is referred to as a priority tag."

    PfSense running on Qotom mini PC
    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
    UniFi AC-Lite access point

    I haven't lost my mind. It's around here...somewhere...

    1 Reply Last reply Reply Quote 2
    • N
      natbart
      last edited by Feb 7, 2021, 5:27 PM

      @JKnott & @stephenw10 thanks.

      Just looking for some resources or guidance. VLAN 0 seems to be only way for me to connect to ONT and grab a DHCP address.

      Totally get that it is not creating a new VLAN. Just trying to get pfSense to work with my service provider’s configuration.

      Not sure why some service providers like mine and ATT chose this design.

      1 Reply Last reply Reply Quote 1
      • S
        stephenw10 Netgate Administrator
        last edited by Feb 7, 2021, 5:28 PM

        Yup, exactly. There's no way to do that in pfSense though AFAIK.

        Also I believe some equipment still recognizes that as a VLAN even if it's outside the spec.

        Steve

        1 Reply Last reply Reply Quote 0
        • S
          stephenw10 Netgate Administrator
          last edited by Feb 7, 2021, 5:30 PM

          The cynic in me suspects they deliberately chose that because it's outside the spec which forces people to use their equipment. 😉

          J 1 Reply Last reply Feb 7, 2021, 5:55 PM Reply Quote 2
          • J
            johnpoz LAYER 8 Global Moderator @stephenw10
            last edited by johnpoz Feb 7, 2021, 5:57 PM Feb 7, 2021, 5:55 PM

            Setting vlan id 0 would be when you want to set priority, but not use a vlan - if I recall..

            edit: ah jknott bet me too it ;)

            But also with steve - they prob do that on purpose as well, not all equipment will support doing that, especially "home" based gear..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            J 1 Reply Last reply Feb 7, 2021, 6:32 PM Reply Quote 0
            • N
              natbart
              last edited by Feb 7, 2021, 6:03 PM

              Super frustrating! My Ubiquiti USG3 let me do it and then I got some great hardware (super excited) and got started on pfSense only to be stopped dead in my tracks because of this.

              Want to get rid of the under powered USG3 but sinking hours into trying to understand how to get pfSense to work in this configuration is killing me.

              The netgraph option sounds doable but it currently beyond my skill set and taking lots to wrap my head around what is required to get it implemented.

              1 Reply Last reply Reply Quote 0
              • J
                JKnott @johnpoz
                last edited by Feb 7, 2021, 6:32 PM

                @johnpoz

                I can understand that some hardware doesn't support it properly, but that's no reason why pfsense shouldn't.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                J 1 Reply Last reply Feb 7, 2021, 6:55 PM Reply Quote 0
                • S
                  stephenw10 Netgate Administrator
                  last edited by stephenw10 Feb 7, 2021, 6:50 PM Feb 7, 2021, 6:48 PM

                  I don't think you can do it freebsd unless I'm using the wrong incantation.

                  You can apply a priority tag to a vlan but you can't create a zero tagged vlan to apply it to.

                  @natbart Does your provider actually require a priority tag?

                  Steve

                  N 1 Reply Last reply Feb 7, 2021, 8:10 PM Reply Quote 0
                  • J
                    johnpoz LAYER 8 Global Moderator @JKnott
                    last edited by johnpoz Feb 7, 2021, 6:59 PM Feb 7, 2021, 6:55 PM

                    @jknott said in How to get pfSense WAN to accept VLAN 0:

                    but that's no reason why pfsense shouldn't.

                    Well depends - does freebsd support it? I think people sometimes forget pfsense runs freebsd.. Just like the wireless support. Not really a pfsense thing, its a freebsd thing..

                    And to be honest.. It's not a real common thing to do - not like a million users out there screaming I need to be able to set vlan 0 ;)

                    Looking to what unifi does, seems for some ATT bypass - the classic UI allows you to set it - most likely because they just didn't set restrictions.. But new UI of the controller seems to..

                    https://community.ui.com/questions/Using-VLAN-0-for-WAN-with-new-interface/fe455db8-0d3f-4fa4-8d27-0ee337d2cefe?page=0

                    btw.. In 30 some years I don't recall ever having to set this ever ;)

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                    J 1 Reply Last reply Feb 7, 2021, 7:04 PM Reply Quote 1
                    • J
                      JKnott @johnpoz
                      last edited by Feb 7, 2021, 7:04 PM

                      @johnpoz said in How to get pfSense WAN to accept VLAN 0:

                      not like a million users out there screaming I need to be able to set vlan 0

                      What's that noise I hear? 😉

                      IIRC, I was able to set it in Linux. My understanding for using it is to provide priority on the main LAN, but I don't know that you could have both tagged and untagged on the same LAN. I agree there's not a lot of call for it.

                      PfSense running on Qotom mini PC
                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                      UniFi AC-Lite access point

                      I haven't lost my mind. It's around here...somewhere...

                      S 1 Reply Last reply Feb 7, 2021, 8:48 PM Reply Quote 1
                      • N
                        natbart @stephenw10
                        last edited by natbart Feb 7, 2021, 8:14 PM Feb 7, 2021, 8:10 PM

                        @stephenw10 not sure what to say... I am told it works on FreeBSD with Netgraph.

                        ATT users need to do this also to bypass their GATEWAY box. Their are definitely implementations or designs that require it.

                        Some users maybe just gave up and moved to other hardware that could accomplish it.

                        Wireshark shows packets tagged 802.1q with VLAN0 when my laptop was connected.

                        F 1 Reply Last reply Feb 7, 2021, 8:42 PM Reply Quote 0
                        • N
                          natbart
                          last edited by Feb 7, 2021, 8:21 PM

                          I’m just a guy interested in pfSense and not wanting to use Service Provider gateway (HH3000).

                          I guess I posted here hoping someone might have more experience with this scenario or problem.

                          I appreciate the dialog so far and hope maybe there is some solution that will make this work.

                          1 Reply Last reply Reply Quote 0
                          • F
                            fresnoboy @natbart
                            last edited by Feb 7, 2021, 8:42 PM

                            @natbart

                            I do this with my AT&T fiber connection to get rid of the POS AT&T gateway.

                            BTW, another technique to deal with this VLAN0 silliness is to use a cheap switch to strip the VLAN0 from the WAN connection like the Netgear GS108Ev3 . The AT&T bypass thread here: https://forum.netgate.com/topic/99190/att-uverse-rg-bypass-0-2-btc/328 has all sorts of info on dealing with the VLAN0 problem that AT&T Fiber users have to deal with.

                            N 1 Reply Last reply Feb 7, 2021, 9:13 PM Reply Quote 2
                            • S
                              stephenw10 Netgate Administrator @JKnott
                              last edited by Feb 7, 2021, 8:48 PM

                              There are some providers who require a priority tag on WAN but I've never seen that without a, valid, vlan tag.

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • N
                                natbart @fresnoboy
                                last edited by Feb 7, 2021, 9:13 PM

                                @fresnoboy said in How to get pfSense WAN to accept VLAN 0:

                                Netgear GS108Ev3

                                I will continue to read the ATT bypass solutions. My service provider does not have all the WPA supplicant / certificate requirements that ATT users have, so was trying to distinguish the required element from that fix.

                                I have thought about putting a switch in the mix, but a Netgear GS108 is another $75 CDN on Amazon and adds another layer to the solution as well as cost.

                                What requirements does the switch need to solve my problem? Does it make more sense to throw on VMware and at least deal with one piece of hardware.

                                F T 2 Replies Last reply Feb 7, 2021, 10:34 PM Reply Quote 0
                                • F
                                  fresnoboy @natbart
                                  last edited by Feb 7, 2021, 10:34 PM

                                  @natbart

                                  These switches are usually available on ebay or even Craigslist for a lot less. I'm not saying it's the best solution, but it works without having to run vmware, etc...

                                  Good luck!

                                  1 Reply Last reply Reply Quote 1
                                  • S
                                    stephenw10 Netgate Administrator
                                    last edited by Feb 7, 2021, 10:38 PM

                                    Yeah, it should work with netgraph because there are no restrictions really. You can do whatever you want there unlike ifconfig.

                                    It shouldn't be that hard either. Another think that uses it is QinQ. If you create a QinQ interface and then check in /tmp you can see the file with the netgraph commands used to create it.

                                    Or indeed the example given here.

                                    Steve

                                    N 1 Reply Last reply Feb 8, 2021, 12:15 AM Reply Quote 1
                                    • N
                                      natbart
                                      last edited by Feb 7, 2021, 10:44 PM

                                      Running packet capture on the WAN port all I see is a DHCP discovery broadcast (by my unit) and a DHCP offer by provider which unit never responds to but causes it to put another Discover out there.

                                      Offers are tagged:

                                      802.1Q Virtual LAN, PRI: 7, DEI: 0, ID: 0

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        tquade @natbart
                                        last edited by Feb 7, 2021, 11:12 PM

                                        @natbart

                                        A GS105NA can be had for around $45 on amazon.ca.

                                        Ted

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          stephenw10 Netgate Administrator
                                          last edited by Feb 7, 2021, 11:33 PM

                                          If you didn't have to priority tag it on the USG you wonl't have to here.

                                          This is going to be like a 5 line script but Netgraph always makes my brain hurt!
                                          Just hitting errors right now....

                                          N 1 Reply Last reply Feb 8, 2021, 12:11 AM Reply Quote 0
                                          15 out of 414
                                          • First post
                                            15/414
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.