How to get pfSense WAN to accept VLAN 0

natbart · Feb 8, 2021, 4:52 AM

@johnpoz having this as an option would be amazing. Would be simple than some of the other work arounds.

Hard to believe others haven’t asked for it based on ATT also needing it (amongst other config). Not used what other ISPs are similarly config’ed.

johnpoz · Feb 8, 2021, 4:56 AM

I haven't combed through redmine yet - but yeah if you want/need this - then it should be submitted to redmine as a feature request..

If it can be done, and there is desire for it - why would it not be implemented.

But to be honest - I do believe part of the reason for such a deployment would be making it harder for isp customers to use non isp hardware.. Since setting vlan id 0 is not really something that is common

natbart · Feb 8, 2021, 5:31 AM

@johnpoz I configured in the initial USG config. Not using the controller software.

natbart · Feb 8, 2021, 5:35 AM

@johnpoz sorry, I am not sure who/ what Redmine is. This is my first post and I just got pfSense installed this week. I am very new to since. My initial excitement did fizzle somewhat when I ran into this issue.

Cool_Corona · Feb 8, 2021, 5:37 AM

Question:

Why not run it in transparent mode and let pfsense handle WAN??

natbart · Feb 8, 2021, 6:09 AM

@cool_corona not sure I understand what you mean. New to pfSense can you elaborate?

Cool_Corona · Feb 8, 2021, 9:34 AM

@natbart You put the Nokia in bridge mode and connect the pfsense WAN on RJ45.

Then handle WAN via DHCP to see if it works. And then you are rid of the USG

stephenw10 · Feb 9, 2021, 5:08 PM

As I understand it that is the plan here. But the ISP requires the traffic tagged as VLAN0 and pfSense does not currently have any way to set that.

Netgraph still defeating me!

Steve

natbart · Feb 8, 2021, 3:12 PM

This post is deleted!

natbart · Feb 8, 2021, 3:15 PM

@cool_corona said in How to get pfSense WAN to accept VLAN 0:

@natbart You put the Nokia in bridge mode and connect the pfsense WAN on RJ45.

Then handle WAN via DHCP to see if it works. And then you are rid of the USG

thanks for the tip. As far as I know I have no access to the Nokia ONT. It is doing media conversion from Fiber to Ethernet and is otherwise a black box to the end-user.

natbart · Feb 9, 2021, 5:08 PM

@stephenw10 I appreciate any work you are attempting to do with Netgraph! I havent been able to dig into it any more myself.

fresnoboy · Feb 10, 2021, 2:23 AM

@natbart

If you look at the att netgraph scripts, they could be useful in solving the vlan0 issue. They handle that, but have a lot of other functions not needed in your case. You should be able to start with them and pare it down to pretty much nothing if you don't need the gateway auth bypass etc...

natbart · Feb 10, 2021, 2:23 AM

@fresnoboy said in How to get pfSense WAN to accept VLAN 0:

@natbart

If you look at the att netgraph scripts, they could be useful in solving the vlan0 issue. They handle that, but have a lot of other functions not needed in your case. You should be able to start with them and pare it down to pretty much nothing if you don't need the gateway auth bypass etc...

I did start looking into that, but there are more differences than similarities. It got me looking at Netgraph, but that is requiring some more learning. @stephenw10 was also graciously looking into netgraph.

Cool_Corona · Feb 10, 2021, 7:43 AM

@natbart said in How to get pfSense WAN to accept VLAN 0:

@cool_corona said in How to get pfSense WAN to accept VLAN 0:

@natbart You put the Nokia in bridge mode and connect the pfsense WAN on RJ45.

Then handle WAN via DHCP to see if it works. And then you are rid of the USG

thanks for the tip. As far as I know I have no access to the Nokia ONT. It is doing media conversion from Fiber to Ethernet and is otherwise a black box to the end-user.

Try and plug the RJ45 directly into the WAN of pfsense and see if it works

natbart · Feb 16, 2021, 12:10 AM

@cool_corona it does nto work without a switch in between to strip the 802.1q headers (I believe this is the correct explanation). I am using a Cisco ESW54) small business switch.

JKnott · Feb 16, 2021, 3:13 PM

@natbart

If that's what it takes to make it work, you can get a cheap 5 port switch (avoid TP-Link) to do that. You will also be able to configure it for port mirroring, so you have a handy point to run Wireshark.

tquade · Feb 16, 2021, 3:13 PM

@jknott I'm interested in your comment regarding tp-link product. I routinely use a TL-SG105E along with wireshark for network investigation and trouble shooting.

Ted

JKnott · Feb 16, 2021, 3:23 PM

@tquade

I do too. Did you follow my post about creating a data tap? I have mine configured to use port based VLANs, which doesn't seem to have the problems that tagged VLANs do.

tquade · Feb 16, 2021, 3:28 PM

@jknott Your note said to avoid TP-Link. I was curious as to the reason. The TL-SG105E switch I use is a tp-link product.

Ted

JKnott · Feb 16, 2021, 3:37 PM

@tquade

Some TP-Link switches and access points don't handle tagged VLANs properly. The problem I had with my AP was that IPv6 multicasts would leak from the main LAN to the VLAN. As a result, devices using my guest WiFi would wind up with the wrong IPv6 address. I had to disable IPv6 on the VLAN, to make my guest WiFi usable. There are similar issues with the switches. I now have a Unifi AP, which works well with IPv6.

I bought the switch before I was aware of the switch problems and, since my intent was always to use it as a data tap, have never tried to use tagged VLANs with it. @johnpoz can tell you more about the switch issues. So, knowing what I do now, I would not buy a TP-Link managed switch or AP, even though the switch meets my needs for the data tap. The AP also worked well, so long as I didn't try to run IPv6 over a VLAN.
I also have a TP-Link unmanaged switch, which hasn't caused any problems.