How to get pfSense WAN to accept VLAN 0
-
@stephenw10 I appreciate any work you are attempting to do with Netgraph! I havent been able to dig into it any more myself.
-
If you look at the att netgraph scripts, they could be useful in solving the vlan0 issue. They handle that, but have a lot of other functions not needed in your case. You should be able to start with them and pare it down to pretty much nothing if you don't need the gateway auth bypass etc...
-
@fresnoboy said in How to get pfSense WAN to accept VLAN 0:
If you look at the att netgraph scripts, they could be useful in solving the vlan0 issue. They handle that, but have a lot of other functions not needed in your case. You should be able to start with them and pare it down to pretty much nothing if you don't need the gateway auth bypass etc...
I did start looking into that, but there are more differences than similarities. It got me looking at Netgraph, but that is requiring some more learning. @stephenw10 was also graciously looking into netgraph.
-
@natbart said in How to get pfSense WAN to accept VLAN 0:
@cool_corona said in How to get pfSense WAN to accept VLAN 0:
@natbart You put the Nokia in bridge mode and connect the pfsense WAN on RJ45.
Then handle WAN via DHCP to see if it works. And then you are rid of the USG
thanks for the tip. As far as I know I have no access to the Nokia ONT. It is doing media conversion from Fiber to Ethernet and is otherwise a black box to the end-user.
Try and plug the RJ45 directly into the WAN of pfsense and see if it works
-
@cool_corona it does nto work without a switch in between to strip the 802.1q headers (I believe this is the correct explanation). I am using a Cisco ESW54) small business switch.
-
If that's what it takes to make it work, you can get a cheap 5 port switch (avoid TP-Link) to do that. You will also be able to configure it for port mirroring, so you have a handy point to run Wireshark.
-
@jknott I'm interested in your comment regarding tp-link product. I routinely use a TL-SG105E along with wireshark for network investigation and trouble shooting.
Ted
-
-
@jknott Your note said to avoid TP-Link. I was curious as to the reason. The TL-SG105E switch I use is a tp-link product.
Ted
-
Some TP-Link switches and access points don't handle tagged VLANs properly. The problem I had with my AP was that IPv6 multicasts would leak from the main LAN to the VLAN. As a result, devices using my guest WiFi would wind up with the wrong IPv6 address. I had to disable IPv6 on the VLAN, to make my guest WiFi usable. There are similar issues with the switches. I now have a Unifi AP, which works well with IPv6.
I bought the switch before I was aware of the switch problems and, since my intent was always to use it as a data tap, have never tried to use tagged VLANs with it. @johnpoz can tell you more about the switch issues. So, knowing what I do now, I would not buy a TP-Link managed switch or AP, even though the switch meets my needs for the data tap. The AP also worked well, so long as I didn't try to run IPv6 over a VLAN.
I also have a TP-Link unmanaged switch, which hasn't caused any problems. -
@jknott Thank you for the detail. I'm now on the hunt for a different managed switch to use in conjunction with wireshark. Any suggestions given your experience.
Again thanks!
Ted -
As I said, that switch works fine in that role. It's only when you use it to manage VLANs that you have problems. After I came up with that data tap configuration, I tested it to make sure nothing was going to contaminate the circuit I was monitoring. Prior to using the port based VLAN, I could see packets coming from my computer on that connection. One accidental feature is DHCP requests fail, so the monitoring computer winds up with a 169.254 address. I configured the switch to use an address in the same range so, when I want to access the switch management interface, I no longer have to ensure the switch and computer are on the same subnet.
Bottom line, stay away from tagged VLANs and it works fine. Also, it has no problem monitoring connections with tagged VLANs, as it's just data and the tags are not used within the switch.
-
@jknott Thanks for all your help.
Ted
-
@jknott said in How to get pfSense WAN to accept VLAN 0:
If that's what it takes to make it work, you can get a cheap 5 port switch (avoid TP-Link) to do that. You will also be able to configure it for port mirroring, so you have a handy point to run Wireshark.
I am hoping to get Netgraph working so no switch will be required. But will get samll switch if required. Any experience with netgear SG305 vs GS105?
-
@natbart I use a GS105 and have for many years without any issues.
Ted
-
No, I haven't used any Netgear equipment.
-
Consider running pfsense in a VM and tag WAN as VLAN0 on the vswitch.
Then it should be working of the box directly from the modem
-
@cool_corona said in How to get pfSense WAN to accept VLAN 0:
Consider running pfsense in a VM and tag WAN as VLAN0 on the vswitch.
Then it should be working of the box directly from the modem
Not sure what the overhead of VMware will do to the performance on my unit. I have a i5-4570TE with 4gb of ram. I would like to run Snort and still get my 1gb symmetrical
-
@stephenw10 - Started digging into Netgraph again.... I found in another post that in 2.4.5-RELEASE-p1 (amd64) Netgraph is now an in-kernel module.
I am trying to understand the differences of in-kernel modules vs loaded modules and directory structure of where I need to put the script (if any)?
Waiting for weekend to take system down. I think I have the script cleaned up to only change VLAN tagging
-
So... after some troubleshooting (Windows messed up the file so it was not found) and one final error in the script (forgot to assign MAC address) I got it working!!!!
Script loads using Shellcmd (earlyshellcmd) and now I have no need for a switch to front end my connection.
Thanks to everyone for your feedback and help.
Problem solved and on to the next project.
