VLAN Help!!…..

[wyzard]

Good afternoon….

I'm trying to set up a VLAN with my pfSense box.  Here's what i have...

• pfSense box running 2.4.3

• Netgear ProSAFE Plus switch JGS524Ev2

• Ubiquiti AP

I set up the VLAN information in pfSense.  My issue is trying to get a separate wireless SSID (which I've set up on the Ubiquiti AP) to access the internet.  I've setup firewall rules, etc. but to no luck.  Since I only have one AP, I'm trying to run everything through that, to the switch, then to the pfSense box for internet access.  So far I've had no luck.  Can someone provide some detailed information on how to do this (or can I do this?) and what steps I need to take. I'm sure I'm missing something.

Thanks.

[Derelict]

Of course you can.

What isn't working? DHCP? DNS? NAT?

https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

[wyzard]

So I've set up a VLAN on pfSense with a tag of 50.  My AP is connected to my switch on port 14.  I setup another SSID on my AP and call it 2ndWiFi (for example).  I indicate it's a VLAN and put the tag in where indicated, the 50 from my pfSense setup.  When I go to the switch I set up a new VLAN and put the tag in of 50.  I then Tag Port 1 (which goes to the WAN port of the pfSense box).  I also try to tag port 14 with the tag of 50.  When I do this I can connect to the 2ndWiFi SSID but have no internet access.  Also my internet access on my main SSID loses connection.

Any thoughts or help?

Thanks for the initial response.

[johnpoz]

"I then Tag Port 1 (which goes to the WAN port of the pfSense box)."

Huh??

So does your ISP connection run through your switch?  Typical setup would be more like this

isp device –- wan pfsense lan --- switch - devices

You can have multiple uplinks from your switch to different interfaces on pfsense if you have them and they would just be different vlans on your switch.  Pfsense would not need to know anything about what vlan IDs these are an the ports connected to pfsense would be untagged in those vlans.

if your going to run tagged network then the the vlans would be tagged on the port connected to the physical interface on pfsense that has the vlans on it.

unifi AP normally would have untagged network for management.  So lets assume this your lan network.. So on the port connected to pfsense you would lan (untagged) and your tagged vlan 50... On your switch port connected to your AP you would have untagged lan vlan (default vlan 1 on your switch) and your tagged SSID vlan 50.

[wyzard]

So…

• Port one on switch goes to the LAN switch on my pfSense (misstated in previous post, sorry).  So VLAN1 would remain untagged and VLAN50 would be tagged on that port, correct?

• Port 14 on switch goes to my AP.  So that port should be set the same as port 1, (VLAN1 untagged, VLAN50 tagged).

• The AP switch would have the new the SSID which would also be indicated on the AP as VLAN50.

Is that correct or am I missing something?

Do I need to identify my main SSID as VLAN1 on my AP?

[Derelict]

That sounds fine.

You also need to:

assign an interface to VLAN 50, enable it, and number it
put firewall rules on that interface to pass the desired traffic
enable a DHCP server on the interface
and be sure outbound NAT is in place.

[wyzard]

Everything been set that way, but it still won't get me an internet connection on my second SSID and my main SSID drops internet connection.

Thanks…..

[Derelict]

If everything was set that way it would be working.

You're going to have to post all those settings because you obviously haven't done what you think you've done.

[wyzard]

Thanks.  I will play with this a bit more and see what happens.

One more question…  for now...

I have four ethernet ports on my pfSense box, one currently used for WAN and the other for LAN leaving two "unused".  If I run an ethernet cable from one of those ports to an open port on my switch, then set the VLAN to that interface, will the traffic from the AP on my 2nd SSID  come into port 14 and got out to the pfSense through that port?  So in other words, if I run a LAN connection from opt2 (currently unused on pfSense) to say port 20 on my switch, will my second SSID (which is identified as VLAN50) go into port 14 on my switch than out through port 20 (as log as I tag port 20 as VLAN50) to the pfsense then out to the internet?  In essences I'm separating the physical LAN ports for my main SSID and the 2nd SSID.

Hope that makes sense.

[Derelict]

Not exactly sure what you're asking…


[wyzard]

I obviously don't have something right…

How do I post screen shots here?

[Derelict]

Click Attachments and other options.

Attach files


[wyzard]

Hopefully this will help figure this out..

settings.txt

[Gertjan]

An nearly empty text file  ?

[wyzard]

Try again…

[pfsense settings.zip](/public/imported_attachments/1/pfsense settings.zip)

[Derelict]

What is so hard about screen shots?

Asking us to do a lot of work here.

ETA: A word document? Really?

EATA: What are those 5 errors in the upper right? Click that and post it.


[wyzard]

There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-06 23:43:18
There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-06 23:48:18
There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-06 23:48:54
There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-07 00:17:09
There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [19]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-07 00:18:44

[wyzard]

Here's a zip with PNG images…  Sorry about the word doc.. it was late....

settings.zip

[johnpoz]

Your going to want to fix that bogon problem or you going to have issues with your rules..

System > Advanced > Firewall Maximum Table Entries

Set that to say 400000

Your rules are wrong on your iot interface that is for sure.

Rules are evaluated top down, first rule to trigger wins.  You have a any any rule that lets iot do anything on ipv4.  Your block to lan net would never be evaluated..  If you don't want iot going to lan net, then put that block ABOVE your any any.

[wyzard]

Got it!!!

Thanks for all the help and patience.