Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Problem with DNS on management VLAN

    DHCP and DNS
    2
    6
    522
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      thompsonm last edited by

      I don't really know what topic to put this under but I am having to troubleshoot an issue with VLANs.

      A few months ago I bough a TP-Link switch and an AP that support VLANs. I basically created 3 VLAN in pfSense and on the switch and ap, one for wireless clients, one for wired clients, and a management VLAN. The ap and switch and pfSense LAN interface are meant to be on the management VLAN. I had some difficulty with it and had to reset the switch multiple times but eventually I managed to get it working and created some firewall rules and I confirmed that it was all working properly.

      However, the other day, due to a vulnerability in WPA2 protocol, I meant to check my ap for a firmware update, and I noticed I was locked out of both the switch and ap.

      On the switch, when i put myself on the management VLAN to troubleshoot I can ping the switch and ap but not the pfSense LAN interface. I checked the system logs in pfSense and I get this obscure message in the DHCP log:

      icmp_echorequest 192.168.3.12: Invalid argument

      and in the DNS log:

      unbound 48589:3 notice: sendto failed: Invalid argument
      unbound 48589:3 notice: remote address is 192.168.3.12 port 61711

      On the management VLAN, DHCP works but I have no internet connection. I don't know what to do to troubleshoot further. Any suggestions?

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        "TP-Link switch"

        What specific switch?  The E line you can not remove vlan 1 from every port..  So yeah that could cause you some oddness for sure..

        To be honest its CRAP switch… it can kind of be used.. But any broadcast traffic on vlan 1 is going to be seen on every port..  So pretty much any untagged broadcast traffic the switch sees is broadcast to every port. After I was done validating it was crap.. I had just got it because some many people were here asking questions about it..  And it was only $25 so figured play with it.

        I replaced it with a dlink dgs-1100, which allows you to remove vlan 1 from ports you don't want it on ;)

        If you could post up your switch config we can try and work through what might be the problem.  And how you have it connected to pfsense..  Just 1 uplink with tagged vlans and using vlan 1 as native? etc..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 22.05 | Lab VMs CE 2.6, 2.7

        1 Reply Last reply Reply Quote 0
        • T
          thompsonm last edited by

          The specific switch I bought was the TL-SG108E.

          Here's a picture of my switch configurations:
          https://imgur.com/a/7zWnt

          Although, I should say, I don't think it's a problem with the switch because I'm doing a packet capture on the LAN interface and I can see myself ping but there's no response. And there's also those two obscure messages I got in the DHCP and DNS logs which I was wondering about.

          1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by

            Yeah that switch blows… You can not remove vlan 1 from any port..

            What interface are you sniffing on in pfsense.. The vlan interface or the naked interface?

            Your using unifi AP right?  The IP on the AP can not be tagged.  So your running a untagged vlan for the AP..

            So what do you have

            pfsense int (IP/mask vlan tags of vlans, naked interface ip/mask) ---- tagged and untagged --- switch --- (tagged and untagged) --- AP

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 22.05 | Lab VMs CE 2.6, 2.7

            1 Reply Last reply Reply Quote 0
            • T
              thompsonm last edited by

              I'm doing packet capture on the naked LAN interface. Yes it's a unifi AP. For the ap, that's exactly what I want, to be on the management VLAN (untagged) and also be configured to be on a trunk port, send traffic from the other two vlans. So I have a trunk port between the ap and switch and switch and pfSense interface.

              1 Reply Last reply Reply Quote 0
              • T
                thompsonm last edited by

                Yeah I actually figured out what happened. I had just set up a whole network VPN and the traffic between VLANs was being routed through the VPN link… lmao

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post