Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Vlan10 to LAN

    Scheduled Pinned Locked Moved General pfSense Questions
    18 Posts 4 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      spider85
      last edited by

      Hi,

      I made a Vlan, named VLAN10.
      I would like to make it possible to connect from VLAN10 to one specific Host, i made alias for it and created a pass rule at the VLAN10 TAb.
      But i couldnt connect to it, what did i do wrong, do i need to setup some routing rule from LAN to VLAN10?

      Hope somedody could help.

      Tnx in Adv,

      1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott
        last edited by

        How is that host connected?  Some computers can be configured to use a VLAN.  Otherwise, you need a managed switch, to put an access port on the VLAN.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • S
          spider85
          last edited by

          Tnx for your answer, its connected as following.

          I have a managed switch (Zyxel GS 1900 - 24) at this switch i created a vlan (Vlan10) at this vlan I have port 1 - tagged (this is the trunk port to pfsense) and Port 11-14 untagged. all other ports are excluded

          Vlan1 (default vlan at the switch) all ports are untagged.

          At pfsense i have a wan and a lan interface and a Vlan (called vlan10, lan interface as parent). The lan has a DHCP range at 192.168.0.x and the vlan has a DHCP range at 192.168.10.x.

          At this moment port 11-14 get a IP from the VLAN range, and the other ports gets a ip from the lan range (like I would) only thing is how can I setup that a host from Vlan10 can connect a certain host at the LAN. Like I said I created a rule with a alias, but no luck.

          Hope this clarifies things

          Kind Regards

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Please post your rules because that is what you need to do. If you did and it is not working, we'll need more details to see what you did wrong.

            https://doc.pfsense.org/index.php/Firewall_Rule_Basics

            https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • S
              spider85
              last edited by

              LAN

              vlan

              wan

              hope it helps, i can ping the lan proxy from the vlan but thats it

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                You need to bypass policy routing for the local networks.

                https://doc.pfsense.org/index.php/Bypassing_Policy_Routing

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • H
                  heper
                  last edited by

                  you ordering is wrong. only the first rule gets triggered.

                  also:

                  Vlan1 (default vlan at the switch) all ports are untagged.

                  untagging multiple vlans on the same ports isn't really a good idea….

                  1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott
                    last edited by

                    I have a managed switch (Zyxel GS 1900 - 24) at this switch i created a vlan (Vlan10) at this vlan I have port 1 - tagged (this is the trunk port to pfsense) and Port 11-14 untagged. all other ports are excluded

                    Do you have any ports configured as an access port, but on VLAN 10?  A trunk port carries all VLANs plus native LAN.  To separate out the VLANs for computers etc., you have to assign an access port to a VLAN.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • S
                      spider85
                      last edited by

                      @Derelict:

                      You need to bypass policy routing for the local networks.

                      https://doc.pfsense.org/index.php/Bypassing_Policy_Routing

                      Made the following two rules in the LAN interface for testing:

                      But cant ping anybody on the other vlan, any ideas?

                      @heper:

                      you ordering is wrong. only the first rule gets triggered.

                      also:

                      Vlan1 (default vlan at the switch) all ports are untagged.

                      untagging multiple vlans on the same ports isn't really a good idea….

                      Thanks changed it!

                      @JKnott:

                      I have a managed switch (Zyxel GS 1900 - 24) at this switch i created a vlan (Vlan10) at this vlan I have port 1 - tagged (this is the trunk port to pfsense) and Port 11-14 untagged. all other ports are excluded

                      Do you have any ports configured as an access port, but on VLAN 10?  A trunk port carries all VLANs plus native LAN.  To separate out the VLANs for computers etc., you have to assign an access port to a VLAN.

                      Cant find anything about it, i dont know if the switch has such a option, will do some researched on it!

                      1 Reply Last reply Reply Quote 0
                      • JKnottJ
                        JKnott
                        last edited by

                        Cant find anything about it, i dont know if the switch has such a option, will do some researched on it!

                        If it's a managed switch, it should.  One of the features of a managed switch is configuring access ports to be on a specific VLAN.

                        PfSense running on Qotom mini PC
                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                        UniFi AC-Lite access point

                        I haven't lost my mind. It's around here...somewhere...

                        1 Reply Last reply Reply Quote 0
                        • S
                          spider85
                          last edited by

                          Still no luck, as a switch i've got a Zyxel SG1900 "L2" switch, can that be the problem?

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            SG1900 or GS1900?

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • S
                              spider85
                              last edited by

                              Gs1900, sorry for the typo  :o

                              1 Reply Last reply Reply Quote 0
                              • H
                                heper
                                last edited by

                                For zyxel look for
                                advanced application–>Vlan-->vlan configuration>static vlan
                                &
                                advanced application-->Vlan-->vlan configuration>vlan port setup (for pvid)

                                above depends a bit on the firmware version of the switch. (am currently not at a location with a gs1900, only 1920's)

                                1 Reply Last reply Reply Quote 0
                                • S
                                  spider85
                                  last edited by

                                  Oke iam doing some progress;

                                  At this moment i can ping fron lan to vlan and from vlan to lan, but i have this strange thing.

                                  I can enter shares and rdp from lan to Vlan, but i cant rdp or enter smb shares from vlan to lan, opend all ports, rules etc. anybody a idea?

                                  Kind reagards

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    Without seeing your rules, no. No ideas.

                                    Be sure you are not confusing not being able to mount shares with not being able to discover the shares/nodes.

                                    Try it by IP address instead of name.

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      spider85
                                      last edited by

                                      LAN rules

                                      Vlan rules

                                      So with these rules i can ping from lan to vlan and from vlan to lan
                                      I can RDP and enter shares on IP from lan to vlan
                                      But cant RDP and enter shares from vlan to lan

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        Well, it's not your firewall riles.

                                        Check the local firewall (think windows firewall) on the LAN hosts.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.