Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLAN Not Routing Traffic

    Scheduled Pinned Locked Moved General pfSense Questions
    12 Posts 2 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      david.mundt
      last edited by

      I've created a new VLAN 100 (TestLABnet) 10.0.0.0/24, assigned it to the LAN interface, created Rules on both LAN and VLAN 100(TestLABnet) to allow traffic to and from both, and a rule to allow traffic from VLAN 100 out the WAN interface. I created the new VLAN100 on my Cisco SG300-10 switch and assigned it to the port my Test Server is attached to, as Access Port untagged on VLAN 100. I don't have internet connectivity from the device on VLAN100 but can ping 10.0.0.1. I can also ping 10.0.0.1 on a device connected to the LAN. The attached device is 10.0.0.10 and I cannot ping it from the LAN.

      As a Rule Test I set the LAN rule allowing traffic to pass to TestLABnet to block and the ping from LAN to TestLABnet failed, I set it to allow and was able to ping again. So the rule is good. But I've obviously missed something. Anyone got any ideas?

      Thanks,
      David

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        A VLAN interface on pfSense will be tagged to the switch, not untagged. In your case the SG300 port going to pfSense will have to be a general mode port with pvid vlan 1 (or whatever the LAN VLAN is) and tagged vlan 100.

        It might also be better to post screen shots of the rules you make instead of a description of what rules you think you made. At least until we know you have a grasp on what needs to go where.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • D
          david.mundt
          last edited by

          Here are some screenshots of my config… GE5 is the port patched straight through to my Test Server

          1.png
          1.png_thumb
          2.png
          2.png_thumb
          3.png
          3.png_thumb
          4.png
          4.png_thumb
          5.png
          5.png_thumb
          6.png
          6.png_thumb

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            What switch port is connected to pfSense?

            If GE5 is connected to your test device, that is not an access port on VLAN 100. VLAN 100 is tagged there, not untagged.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • D
              david.mundt
              last edited by

              GE1 is to the PFSENSE, I changed GE5 to the setting shown in the screenshot above after you guys informed me it should be tagged. Essentially I put it back to what it was before and added the Tagged VLAN100

              I've got a Ubiquiti WiFi Controller that has Guestnet (VLAN50) on it connected to GE9 of this switch and I mirrored the settings for Guestnet. Guestnet VLAN50 works fine.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Then 100 will also work fine. Did you enable a DHCP server?

                We said tagged to pfSense, not tagged to the edge device.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • D
                  david.mundt
                  last edited by

                  I did not enable DHCP on VLAN100 since the devices attached will have static IPs. I thought I had everything correct but canot explain why I cannot ping 10.0.0.10 from the LAN 172.16.220.0/23, I am able to ping 10.0.0.1 which is the VLAN100 gateway from the LAN.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Because you did something wrong. Probably at layer 2.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • D
                      david.mundt
                      last edited by

                      What do I need to look @? I mirrored the config of GuestNet I've shown my steps above… What do you see that I missed?

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Since you posted a switch config that was not the actual switch config, I suggest you screen shot everything again and post it as it actually is.

                        There isn't anything else to do based on what you already said.

                        What are you pinging? A common problem given that information is a local firewall on the target host that blocks traffic from other subnets.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • D
                          david.mundt
                          last edited by

                          I changed switch port GE5 to Access on VLAN100 untagged and everything is all good now…

                          ![Screen Shot 2017-08-28 at 3.54.19 PM.png](/public/imported_attachments/1/Screen Shot 2017-08-28 at 3.54.19 PM.png)
                          ![Screen Shot 2017-08-28 at 3.54.19 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-08-28 at 3.54.19 PM.png_thumb)

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Glad you got it sorted out.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.