How to get pfSense WAN to accept VLAN 0
-
As I said, that switch works fine in that role. It's only when you use it to manage VLANs that you have problems. After I came up with that data tap configuration, I tested it to make sure nothing was going to contaminate the circuit I was monitoring. Prior to using the port based VLAN, I could see packets coming from my computer on that connection. One accidental feature is DHCP requests fail, so the monitoring computer winds up with a 169.254 address. I configured the switch to use an address in the same range so, when I want to access the switch management interface, I no longer have to ensure the switch and computer are on the same subnet.
Bottom line, stay away from tagged VLANs and it works fine. Also, it has no problem monitoring connections with tagged VLANs, as it's just data and the tags are not used within the switch.
-
@jknott Thanks for all your help.
Ted
-
@jknott said in How to get pfSense WAN to accept VLAN 0:
If that's what it takes to make it work, you can get a cheap 5 port switch (avoid TP-Link) to do that. You will also be able to configure it for port mirroring, so you have a handy point to run Wireshark.
I am hoping to get Netgraph working so no switch will be required. But will get samll switch if required. Any experience with netgear SG305 vs GS105?
-
@natbart I use a GS105 and have for many years without any issues.
Ted
-
No, I haven't used any Netgear equipment.
-
Consider running pfsense in a VM and tag WAN as VLAN0 on the vswitch.
Then it should be working of the box directly from the modem
-
@cool_corona said in How to get pfSense WAN to accept VLAN 0:
Consider running pfsense in a VM and tag WAN as VLAN0 on the vswitch.
Then it should be working of the box directly from the modem
Not sure what the overhead of VMware will do to the performance on my unit. I have a i5-4570TE with 4gb of ram. I would like to run Snort and still get my 1gb symmetrical
-
@stephenw10 - Started digging into Netgraph again.... I found in another post that in 2.4.5-RELEASE-p1 (amd64) Netgraph is now an in-kernel module.
I am trying to understand the differences of in-kernel modules vs loaded modules and directory structure of where I need to put the script (if any)?
Waiting for weekend to take system down. I think I have the script cleaned up to only change VLAN tagging
-
So... after some troubleshooting (Windows messed up the file so it was not found) and one final error in the script (forgot to assign MAC address) I got it working!!!!
Script loads using Shellcmd (earlyshellcmd) and now I have no need for a switch to front end my connection.
Thanks to everyone for your feedback and help.
Problem solved and on to the next project.
-
Yeah the modules are all in kernel you should not need to load anything.
@natbart said in How to get pfSense WAN to accept VLAN 0:
I got it working!!!!
Nice! Can we see it for reference?
Steve
-
@stephenw10 of course... Here is the result. I think I removed everything that was not needed.vlanzero.sh.tar.gz
-
@natbart Attached the graphviz. Maybe there us some optimizations still left. Feel like maybe the o2m portion is not required?
-
@natbart Any suggestion on getting to this endstate?
or 
-
@natbart I think this is the final version...@stephenw10 - thoughts? vlanzero.sh.tar.gz
-
@natbart Thank you for sharing this. This worked like a charm for me and my brand new Fibe service installed earlier this week. I was able to remove the HH3000 device and use my existing pfSense setup without a problem. Great work!
-
@justask-0 glad it worked for you! The post had no action till now, so I didn’t know if it was helping anyone else.
-
Yeah, nice work.
Did you have to set the priority tag in the end?Steve
-
@stephenw10 Yes. This is handled by ngctl within the provided script and applied to the virtual interface. The only thing I added to my setup was the Shellcmd package in order to run the script at startup.
-
@justask-0 This is amazing, would you mind giving me a few directions so I can get this to work on my pfsense box using Frontier fiber? Thanks
-
Download that script above and put on the firewall, I would put it in /root. Make sure the file permissions allow it to be run as an executable. Create a shellcmd to run it at boot. Using the shellcmd package is the easiest way to do that.
https://docs.netgate.com/pfsense/en/latest/development/boot-commands.htmlSteve
