Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLAN Questions

    Scheduled Pinned Locked Moved General pfSense Questions
    33 Posts 4 Posters 22.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jamerson
      last edited by

      Good Day guys,
      today is my first  day on configuring a pfsense hardware with 4 nic's
      the scenario is as next :
      LAN1 is 192.168.10/24
      i have created 2 VLANS on the LAN1 interface .
      VLAN10 : 192.168.10.0/24 and VLAN 20 : 192.168.20.0/24
      i have disabled the DHCP of the LAN and enabled the DHCP of VLAN10, somehow i am not receiving a IP of the VLAN10 over the NIC1. is this behavior normal ? the VLANS are not serving DHCP over the LAN NIC1 ?
      if i have a switch and tag the VLANS 10 and 20 on the Switch is it gonna works over the Switch ?

      Hope someone can help me as i am stuck on this for two days now .

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        so you have 4 physical nics and only need 3 networks, wan and 2 on the lan side why are you using vlans.  Just use the physical nic..

        But yes if you going to create vlans on pfsense that are tagged then your switch port that connects to that nic has to allow for the tagged vlans.  Then the ports devices connect to can be untagged in those vlans.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • J
          Jamerson
          last edited by

          @johnpoz:

          so you have 4 physical nics and only need 3 networks, wan and 2 on the lan side why are you using vlans.  Just use the physical nic..

          But yes if you going to create vlans on pfsense that are tagged then your switch port that connects to that nic has to allow for the tagged vlans.  Then the ports devices connect to can be untagged in those vlans.

          than you john for your answer.
          i have in total 7 VLANS , the Cisco firewall has already those VLANS created and ports are trunked everything works fine on the production.
          we want to upgrade the hardware and software to  Pfsense with hardware 120SSD, 4GB memory 4CPU.
          I want to have the same configuration on the PFsense so the down time on the production will be limited.

          On our production we have 3 stacked netgear s3300 , connected to port 1 of the Cisco as trunk switch one is VLAN10, Switch 2 is Vlan 20 and Switch 3 VLAN 30 all VLANS are tagged on each switch and working as we wished.

          If i create on the LAN1 of Pfsense VLAN10,20,30 and connect it to the Switch S3300 up link, everything should works or not ?
          VLAN50 is a Guest VLAN and want to restrict it from accessing the other VLANS, should i created a Deny rule from each VLAN to VLAN 50 ?
          thank you

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            where are you 7 vlans you only listed 3 going to 3 different switches.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • J
              Jamerson
              last edited by

              @johnpoz:

              where are you 7 vlans you only listed 3 going to 3 different switches.

              right now there only 3 but the new configuration is going to be 7.
              if i understand how to configure the 3 VLANS i will be fine thank you .

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Not sure what your not getting?  In cisco terms it would be a trunked port, that allows your tagged vlans.  That is all there is too it..

                The vlans you put on pfsense interface would be tagged.  You create the vlans in pfsense on the physical interface with the same vlan id's

                So attached is 3 vlans that are on em2 in pfsense, there is also a native network/vlan on this interface that is untagged - this is vlan 20 on the switch.

                em2.jpg
                em2.jpg_thumb

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • J
                  Jamerson
                  last edited by

                  Thank you john,
                  i am going to test this tomorrow.
                  on the em0 i need to create VLANS, and em1 3 VLANS.
                  should i create firewall rules between the VLANS , or Pfsense does the routing automatically ?

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    routing is done automatic but they will not be able to talk to each other unless you allow it via firewall rules.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • J
                      Jamerson
                      last edited by

                      @johnpoz:

                      routing is done automatic but they will not be able to talk to each other unless you allow it via firewall rules.

                      Thank you John.
                      so i have to create on each VLAN a allow list to each others ?
                      is it possible to create a Group VLANS for the firewall rules and create one rules that applies to group of the Alias ?
                      i don't know if this even possible.

                      thank you

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        If all the rules are substantially the same you can create an interface group and apply rules to the group.

                        Rules on an interface group are processed before per-interface rules are so you can have generic rules like

                        Pass to DNS to this DNS server
                        Block access to this private network

                        Then have per-interface rules specific to that interface.

                        Don't get wrapped around the axle about "VLANs." Once you create a VLAN and assign a firewall interface to it, it's just another interface as far as the firewall is concerned.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • J
                          Jamerson
                          last edited by

                          Thank you so much guys for the help.
                          on the em0 : i have created VLAN 2.3.4 and on the em2 i have created VLAN 5.6.7
                          on each VLAN i have created allow any to any rules . on VLAN 7 i didn't create any rules yet as it guest network and want the traffic from the other VLANS blocked to the VLAN 7 and opposite too.

                          on the em2 VLAN 6 have access point seeding wifi using dhcp of lan 3 however this is not coming through .
                          should i create some rules between the interfaces em0 and em2 ? or rules any to any is enough to make the routing between the vlans working ?

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            What are you rules now?  You want clients on vlan 6 to get IP from dhcp server running on vlan 3?  Did you setup a relay?  I have to assume you have different dhcp server than pfsense since pfsense dhcp doesn't work unless has an interface in that network.

                            Post up your rules.  Keep in mind if you don't want vlans to talk to vlan 7, those rules go on those interfaces not vlan 7 interface.  Pfsense evaluates the rules on the interface the traffic first enters pfsense on.. So if you don't want vlans X talking to vlan 7 then you would need rules on those interfaces blocking that access to dest vlan 7 net.

                            Rules are evaluated top down, first rule to trigger wins.  If you have questions post your rules and we can discuss.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • jahonixJ
                              jahonix
                              last edited by

                              Dumb question to the guys in knowledge:
                              Could we create VLANs 11, 12, 13 on IF/trunk A and 21, 22, 23 on IF/trunk B and bridge V12 and V22 to create one broadcast domain with one set of rules/DHCP/etc. on two different trunks/switches?
                              AFAIK having the same VLAN on two different trunks isn't possible otherwise.
                              What am I missing?

                              Granted, this is useless if you have a core switch feeding the edge-switches and pfSense hanging off of it as well.
                              In Jamerson's case there's no core switch and the edge switches are fed directly from the router's interfaces (if I got that right).

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                Why would you want to do that? Different VLANs bridged into one broadcast domain makes no sense in almost all cases.

                                By definition VLANs are separate broadcast domains. Why make two then bridge them back into one?

                                Get another switch to go at the physical pfSense location and tag the VLAN in question to both switches.

                                The cheapest managed switch will perform better than a pfSense bridge. I just don't get it.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • jahonixJ
                                  jahonix
                                  last edited by

                                  @Derelict:

                                  Why make two then bridge them back into one?

                                  The scenario is sketched above already.

                                  I don't want to build it that way I'm just asking if it is possible to bridge VLANs, that's all.
                                  And no, I will not write down "A bridge is not a switch!" 100 times.  ;)

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    Seems like you can if you must:

                                    
                                    bridge0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                                    	ether 02:29:b8:be:74:00
                                    	nd6 options=1 <performnud>id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
                                    	maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200
                                    	root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
                                    	member: re2_vlan100 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 9 priority 128 path cost 200000
                                    	member: re0_vlan100 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 8 priority 128 path cost 200000</learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></performnud></up,broadcast,running,simplex,multicast> 
                                    

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      Why would you bridge 2 vlans???  For starters why would 2 vlans have the same layer 3 IP ranges.. So if they don't there is ZERO point in making them the same layer 2.

                                      If you want devices to all be on the same layer 2, then that would be 1 vlan.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • jahonixJ
                                        jahonix
                                        last edited by

                                        Once again since it seems hard to read above posts:
                                        ASSUMING we don't have a core switch and using two native interfaces to feed two separate (edge-) switches with trunks it is the only possibility to share one VLAN among the two switches.
                                        You can't have VLAN_xy on trunk_A and trunk_B.
                                        This is a hypothetical setup which I DO NOT want to build.

                                        Side note: since my workbench is currently covered with digital mixing desks and outboard gear to check CobraNet, Dante and AVB (all digital audio networking protocols) I neither have the time nor the place to evaluate it myself.

                                        Now back to you, Jamerson!  ;D

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          What does a core switch have to do with anything.. If both switches can reach pfsense then just put a switch there.. Go to the store and get a $40 smart switch..  If you have no budget, connect your 2 switches to that.  This is 1 vlan!

                                          There is NO scenario that would make sense to bridge 2 different vlans.  The act of bridging them would make it 1 vlan..  Why would you use something like pfsense to connect them.  You just need to plug one switch into the other switch.  Make the vlan id the same, there you go 1 vlan.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            Jamerson
                                            last edited by

                                            Thank you guys and John for the help.
                                            I managed to get this fixed.
                                            I've configured one up link for all the switches and all the VLANS running on one interface and everything runs fine.

                                            I've enabled DHCP on each VLANS however didn't specify the dns on the dhcp . I've noticed that the users are having some difficulties to contact the file server .
                                            The users logs in local on their MAC machines.
                                            There is no internal DNS at all. The DNS is the gateway, DNS forward is configured fine.
                                            What am I doing wrong ?

                                            Before we migrate to offense we could build VPN to our Cisco firewall in holland to access the Internet as we may know the chiness are blocking a lot of sites .
                                            Is this gonna work with the openvpn tunnel we build ? I've forced the tunnel over the VPN but when I am connect over the openvpn and I went to whatismyip it's not showing our office IP but the local IP

                                            Thank you guys for the support
                                            Modify message

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.