@hudri said in Assigning Clients to VLANs:

where they just manually switched back and forth between the VLANs,

You can - where you set the pc to understand the tag, but again that is not a vlan... That is some user without a clue to networking thinking they have setup a vlan and all they did is run multiple IP schemes on the same network. There is no actual security there, anything can talk to anything, be it you setup a firewall rule or not - broadcast and multicast traffic is going to be seen by every device.

That is not a vlan. A vlan actually isolates traffic at layer 2..

You could move your pc into another vlan that is on that port, by changing the pvid on trunk port so the untagged traffic is now in X vs Y, etc. But just changing on the IP on the pc isn't going to work if you actually have vlans setup.

@onepiece said in Creating VLANs and subnets (and SSIDs) using pfSense:

Do most modern APs allow multiple SSID transmissions using separate subnets simultaneously?

Proper APs usually do, but using a router as an AP won't. Just read the specs to see what an AP can do.

I have a Unifi AC-Lite AP, which supports multiple SSIDs and VLANs, as did a TP-Link AP I used before.

BTW, some people here like the Unifi APs.

@stephenw10 I guess there is VLAN configured because I didn't need to set it on the pfsense

I would verify with a packet capture that the traffic is crossing into the pfSense side properly.
What's the LAN interface VLAN in the that list? 4084? 4083? 4082?

And logins to other more remote sites will be encrypted with https or similar.

@msid

Voici la configuration du switch (HP) :

PORT 13-14-15-16 -> Agrégat des 4 liens Mode TRUNK -> Untagg le VLAN défault (1) -> TAGG sur les autres TRUNK dont le 160 (LIEN VERS LE NETGATE)
PORT 20 -> untagg sur le VLAN 160

e6a46564-1765-4613-91ee-c3ba37fed005.jpg

@adminproconer said in Firewall rule problems. (Client-to-client forward):

Where should I start troubleshooting the issue?

With the network settings and firewall config of the concerned device.

Ensure that all devices in both subnets use pfSense as gateway.

If you can access a device from within it's own subnet, but not from another network segment check its firewall and ensure that it allows access from outside.

@adminproconer And how about you remove the link aggregation..

If still slow then I would sniff - but if you have full speed, and ping is 1ms - your issue is not network related, but most likely server or performance related.

Sniff to see what is slow, nothing the network the router can do if server answers slowly.

@bob-dig
yes destination is internet.

So this is why I get the NAT3 on the ps4 right?
in short, because the vlan's gateway is not exposed to internet but is behind the wan.. right?

sorry what you mean with If the destination is at your place then number 3
another vlan or the lan?

thanks again

Are you sure hyper-v is passing the tagged traffic? Can you test running baremetal on something?

Steve

I assume you only have one NIC in that device?

You can still leave LAN assigned as the parent interface directly and assign VLAN99 as an OPT interface.

Steve

@johnpoz Since both my phone and desktop are on LAN and the phone can see the chromecast and cast to it and the desktop cannot.

doesn't that mean something is wrong somewhere?

@johnpoz : Linksys EA7300 - You said it would work, but it doesn't!!! 😆 🤣

Not listed as supported on the DD-WRT web site. 😞

But it is supported on OpenWRT with vLan! Yay!

So, cool beans! I can (probably) take it from here.
Thanks for your, and everyone's, help!!!

No worries, glad you're up and running. 👍

@gertjan The suggested system patch fixed the issue. Thank you!

@g-luke said in Configurazione OpenFiber WAN - PPPoE VLAN:

@wifi75 non mancava nulla.
Avevo fatto tutto esattamente come hai suggerito tu, ma non c'era login.
Ho chiamato il provider il quale ha inizialmente detto che poteva essere un problema del mio router, così mi sono procurato un altro router ma neanche con questo c'era login.
Di conseguenza hanno aperto un ticket con OpenFiber, e alla fine è venuto fuori che quando hanno fatto l'allacciamento si sono dimenticati di attivare qualcosa, per cui non c'era possibilità di connettersi.
Io avevo dato per scontato che fosse un problema di configurazione perché dopo che OpenFiber ha fatto l'allacciamento ho chiesto espressamente se la linea dovesse essere attivata dal provider, ma mi hanno assicurato che "potevo già navigare!"

Che provider?

@viragomann said in Multiple VLANs in HA config:

So ensure the VLAN is also properly configured on the switch.

omg , so stupid :)

Thx it all works now

@waldy327 said in FTTH (AON): Fritz!Box 5530 works, pfSense not:

Or is it enough to disable
"Hardware TCP Segmentation Offloading"
"Hardware Large Receive Offloading"

Those should be disabled anyway, they are disabled by default so definitely disabled them if you have set them enabled.

Hardware offloading requires the driver and hardware to work correctly together. Something that works on an igb NIC might work on ix. It might not even work on a different NIC that also uses the igb driver.
They usually do though because those Intels are the best supported. Intel contributes their own driver code to FreeBSD.

To disable that as a test you can run at the command line:

ifconfig ix0 -vlanhwfilter -vlanmtu -vlanhwtag -vlanhwcsum

I had assumed your igb NICs are not SFP?

Steve

Yes you could use pools in one subnet and filter them differently using aliases but you can't filter traffic between the clients on one subnet that way. Traffic would just go between them directly without passing through pfSense. Only one interface.
Really you need to use VLANs in there to separate the traffic at layer 2.

Steve