Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Three VLAN, unmanaged switch, one interface config questions

    Scheduled Pinned Locked Moved Routing and Multi WAN
    11 Posts 4 Posters 980 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      godinperson
      last edited by

      Hi,

      I have a project but I need help to make it work. I have two companies that I run from home so on my network, I have multiple computers. I have a PFsense with two network card (WAN and LAN) and a TP-Link unmanaged switch.

      Here's what I would want:

      10.20.10.0/24: Company1 computers
      10.20.20.0/24: Company2 computers
      10.20.30.0/24: Home computers

      That, I can probably make it work. Here is the issue now. I use my home computer to access all the computers (RDP, shared files, etc). So I would need one computer to be able to access all VLAN (let's say: 10.20.30.5 needs to be able to communicate on 10.20.10.0 and 10.20.20.0).

      Is that achievable?

      Thanks

      1 Reply Last reply Reply Quote 0
      • NogBadTheBadN
        NogBadTheBad
        last edited by

        You need either :-

        2 more unmanaged switches and 2 more LAN ports for the router

        or

        1 managed switch that does 8.0.1q and vlans on the parent interface

        • firewall rules on each interface

        Andy

        1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Get yourself a smart switch… They can be had for $30... If your going to run vlans then there is ZERO reason not to do it correctly.  Especially if this is any sort of business/company work... Get the correct hardware and charge it to the customer and or write it off.

          Your talking the cost of a couple cups of fancy coffee to do this correctly with a vlan capable switch or switch(es)..

          Screw using that hammer that is on the other side of room to drive this nail, I am just going to whack at this nail with this screwdriver I have in my hand...

          BTW - do not get the smart tplink switches, they are junk and even though they say they do vlans.. They do not actually do it correctly and there is no isolation..

          edit
          NogBadTheBad gives the other option if you want to go the dumb switch route by complete isolation of the networks.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • NogBadTheBadN
            NogBadTheBad
            last edited by

            Actually I also should have also asked, do you require Wi-Fi for each of the subnets ?

            Andy

            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

            1 Reply Last reply Reply Quote 0
            • G
              godinperson
              last edited by

              WiFi only for home network

              I'm just playing with it as a personal project.

              I was sure I could have done it only with pfsense, no need of smart switch or anything. I can specify the vlan id on the network cards

              Company1 = One Hyper-V with VMs
              Company2 = One VMWare ESXi, and two computers
              Home = WiFi, computers, tablets, etc

              Thanks

              1 Reply Last reply Reply Quote 0
              • NogBadTheBadN
                NogBadTheBad
                last edited by

                Any device that can put their network card into promiscuous mode can sniff all 3 subnets if you don't use a switch that does 802.1q

                Andy

                1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                1 Reply Last reply Reply Quote 0
                • G
                  godinperson
                  last edited by

                  Yes, I understand that but I'm the only manager and it's just for a protection against viruses. Right now, they are all on the same network and it works great.

                  1 Reply Last reply Reply Quote 0
                  • NogBadTheBadN
                    NogBadTheBad
                    last edited by

                    A dumb switch will pass all tagged and untagged packets, give it a go.

                    Interfaces -> VLANs

                    Andy

                    1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      So yeah if you hit the nail hard enough with the screwdriver it will work… Doesn't mean you should do it..

                      There is zero reason to do this... Zero!!!  You are not talking thousands or even hundreds of dollars for the correct tool..

                      And the best thing is you will actually learn something..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • H
                        heper
                        last edited by

                        @NogBadTheBad:

                        A dumb switch will pass all tagged and untagged packets, give it a go.

                        Interfaces -> VLANs

                        nope, theres plenty of them that just fuckup the tags in some way or another

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          If your running the connection from pfsense to a vm host… Then you don't need a switch even and you can do tagging and use vswitches with port groups to accomplish what you want.

                          But if your going to break this out into the real world network and connect to a switch and send use multiple layer 3 networks.. Then yes your going to want to isolate said networks at layer 2 with vlans.

                          Don't be that guy - forgo that pizza or that case of beer and get a switch that can do tags.. I mean really its 30 freaking $'s - shit you can drop that in after work beers on a tuesday..  Which I am sure I will prob do tonight ;)

                          Don't be that guy

                          Your switch may or may not pass the tags… But that is really not the point..  Its not going to teach you anything, and all it does is promote bad habits...

                          There is one thing when hey this needs to be up and running in 30 minutes, and all I have is this dumb switch and production is down.. Can we connect using this dumb switch and run multiple layer 3 on the same layer 2 until the replacement switch comes in.

                          And then there is oh lets save $5 and just use this dumb switch..

                          You get a pat on the back for scenario 1, you get fired and ridiculed by your peers in scenario 2..

                          So there is knowing that it "can" be done.. And then there is being smart enough to know that nobody should do that.. Your not using duct tape to save yourself on Apollo 13 here.. What your doing is breaking out your hack saw to cut the pizza because your tool lazy to open the drawer and pull out the pizza cutter.

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.