Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    New VLAN not receiving DHCP address from its own pool

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    34 Posts 4 Posters 5.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jahnieboi
      last edited by jahnieboi

      We're running pfSense Community Edition 2.4.3-RELEASE-p1.

      I've created a new VLAN and assigned it the id of 40. I've enabled both the interface and VLAN (Under Interfaces/Interface Assignments), I have also enabled DHCP.

      LAN (network port em1 - 192.168.1.0/24)
      VLAN (40 on em1 - 192.168.3.0/24)

      On our switch (Netgear GS752TPv2), I've also created the VLAN with id of 40. I've also untagged it for the VLAN(40) and tagged it for the default LAN (1).

      I'm working with port 1 on the switch and am physically connected to it.

      So here's the problem:

      The DHCP server is giving me the default LAN dhcp pool (192.168.1.0/24) and not the VLAN's (192.168.3.0/24). When I try to configure the device with a static IP address for the newly created VLAN's address space, I'm unable to route.

      Looks like the port is still configured for the default LAN and I thought I had all bases covered. I feel like I'm missing one simple piece.

      Can anyone help me out? I will pay it forward, some how, some way!!!

      Thanks!

      JPK

      Config for VLAN (Interfaces / OPT1)
      0_1536076340939_Screen Shot 2018-09-04 at 8.51.37 AM.png

      Config for Default Lan (Interfaces / LAN)
      0_1536076501531_Screen Shot 2018-09-04 at 8.53.01 AM.png

      Netgear Configs:
      0_1536076723445_Screen Shot 2018-09-04 at 8.55.38 AM.png

      0_1536076768265_Screen Shot 2018-09-04 at 8.59.09 AM.png

      0_1536076802543_Screen Shot 2018-09-04 at 8.59.42 AM.png

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by Derelict

        @jahnieboi said in New VLAN not receiving DHCP address from its own pool:

        I've also untagged it for the VLAN(40) and tagged it for the default LAN (1).

        That is backwards. Default VLAN 1 should be untagged and VLAN 40 tagged. Silly switch shouldn't even let you set VLAN 1 to tagged IMHO. Be sure you check that the PVID on that port is also 1.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • J
          jahnieboi
          last edited by

          @Derelict - it's an honor to receive a response from you. You're a legend in my book! All the posts I've seen, while researching this issue - I've read a lot of your contributions!!

          I've made this proposed changed on the Netgear Switch, but still running into the same issue.

          0_1536079819708_Screen Shot 2018-09-04 at 9.50.02 AM.png

          0_1536079844938_Screen Shot 2018-09-04 at 9.50.27 AM.png

          When I do an c:\ipconfig /release then renew - it keeps giving me a DHCP address from the default pool and not from the VLAN's.

          Any other thoughts or suggestions?

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Is the workstation connected to a port untagged on VLAN 40? I don't see one there.

            Seems to be a conceptual understanding of VLANs that is missing.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            J 1 Reply Last reply Reply Quote 0
            • J
              jahnieboi
              last edited by

              The workstation is physically connected to port 1 on the switch.

              Does this look ok?
              0_1536080511382_Screen Shot 2018-09-04 at 10.00.28 AM.png

              1 Reply Last reply Reply Quote 0
              • J
                jahnieboi @Derelict
                last edited by

                @derelict - forgive me for asking this, but I am new to pfSense (baptism by fire), but am I supposed to bridge the interfaces?

                0_1536081780996_Screen Shot 2018-09-04 at 10.22.46 AM.png

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  @jahnieboi said in New VLAN not receiving DHCP address from its own pool:

                  I've also untagged it for the VLAN(40) and tagged it for the default LAN (1).

                  As Derelict stated already that would be backwards... You created a vlan 40 and put in on em1,

                  So your port on your switch connected to em1 would be vlan 1 untagged, vlan 40 tagged.

                  An NO you wouldn't be bridging any interfaces on pfsense..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    If the workstation is connected to port 1, what port is connected to the pfSense interface?

                    No. Please don't bridge anything.

                    What, exactly, are you trying to do.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    J 2 Replies Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      @jahnieboi said in New VLAN not receiving DHCP address from its own pool:

                      LAN (network port em1 - 192.168.1.0/24)
                      VLAN (40 on em1 - 192.168.3.0/24)

                      That results in this on em1:

                      LAN - untagged
                      VLAN - Tagged VLAN 40

                      That needs to be connected to a switch port that is untagged VLAN 1, Tagged VLAN 40, and has its PVID set to 1.

                      If you want a workstation to be on VLAN, it needs to be connected to a switch port that is untagged on VLAN 40 and has its PVID set to VLAN 40.

                      If you want a workstation to be on LAN it needs to be connected to a switch port that is untagged on VLAN 1 and has its PVID set to VLAN 1.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        jahnieboi @Derelict
                        last edited by

                        @derelict @johnpoz - All I want to do is create a new VLAN (40), which is isolated and contained.

                        The LAN net (1) has full access going into the VLAN (40), but the VLAN (40) doesn't have access to the LAN (1). One-way trust relationship.

                        I also have OpenVPN configured, which would only have access to the VLAN (40).

                        I've made the correction with port tagging. Right now, port 1 on the Netgear switch is set as VLAN 1 untagged and VLAN 40 Tagged.

                        I'm still experiencing the issue with port 1, only receiving DHCP address from VLAN (1)'s pool. It's not getting any addresses from VLAN (40)'s pool.

                        When I configure the workstation connected to port 1, with a static IP address of VLAN(40) - it's unable to route and can't even ping it's own gateway (192.168.3.1).

                        1 Reply Last reply Reply Quote 0
                        • J
                          jahnieboi @Derelict
                          last edited by

                          @derelict - The pfSense interface is connected to port 48.

                          1 Reply Last reply Reply Quote 0
                          • J
                            jahnieboi @Derelict
                            last edited by

                            @derelict

                            I'm getting closer!

                            "If you want a workstation to be on VLAN, it needs to be connected to a switch port that is untagged on VLAN 40 and has its PVID set to VLAN 40." - This is what I need to do and this is what I did, but this time - I did set the PVID to 40 and this time, when I configure a static IP address ... I'm able to now ping the gateway.

                            However, I can't ping the LAN(1) gateway and can't browse the internet. I've checked the firewall settings and everything looks good there. Anything else that I may need to do?

                            Also - Thank you for being patient and Thank you for being responsive and supportive!!!

                            0_1536085542548_c0b7e87f-0c9c-403e-b646-2e0740b91cb6-image.png

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              Those rules make no sense..

                              When would 192.168.1 be source into your opt network of 192.168.3?
                              When would lan net be a source into opt net? On your vlan interface?

                              your only rule that really makes any sense the last which is opt net any any..

                              This would allow opt net to go anywhere, internet or lan.. If internet is not working did you mess with outbound nat. Automatic would of allowed your opt1 network to be natted to your wan.

                              Rules are evaluated as traffic enters an interface from the network its connected too. Top down, first rule to trigger wins.. No other rules are evaluated..

                              Do you have any rules setup on floating - since none of these rules show any hits, the 0/0 B on the left of your rules..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              J 1 Reply Last reply Reply Quote 0
                              • J
                                jahnieboi @johnpoz
                                last edited by

                                @johnpoz - ur right, out of desperation I added those on top, hoping that maybe it would work!

                                I removed those - Thanks for the review.

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  Your ipv6 is tcp only... Which you need icmpv6 for ipv6 to function... But pretty sure pfsense adds those in the background when you put ipv6 on the interface.

                                  Derelict told you exactly how to configure the ports connected to both pfsense em1 and the the port your device is connected.. End devices like a PC almost never have any sort of vlan tag set.. They are almost always untagged. Exception might be if you were running say VMs on the box, etc. Or it was routing, etc. etc.

                                  pfsense - 1 UP, 40 T -- switch -- 40UP - PC

                                  That is all there is too it.. .
                                  U = untagged
                                  T = Tagged
                                  P = PVID..

                                  PVID is the vlan a switch uses for traffic that hits the interface untagged..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  J 1 Reply Last reply Reply Quote 0
                                  • J
                                    jahnieboi @johnpoz
                                    last edited by

                                    @johnpoz - Thank you so much for the clarification and for taking time to explain things.

                                    I've now made all of these corrections and I'm at least now able to ping from the PC (192.168.3.10) to the gateway (192.168.3.1) - also getting a response.

                                    However, I'm unable to ping from the PC (192.168.3.10) to the gateway of the default LAN on em1 (192.168.1.1).

                                    From my other computer that's on the main LAN (192.168.1.0/24), I'm able to ping the gateway on the VLAN (192.168.3.0/24), but I'm unable to ping the PC (192.168.3.10).

                                    What am I missing? :(

                                    Again - Many Thanks for your help!!

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by Derelict

                                      @jahnieboi said in New VLAN not receiving DHCP address from its own pool:

                                      However, I'm unable to ping from the PC (192.168.3.10) to the gateway of the default LAN on em1 (192.168.1.1).

                                      From my other computer that's on the main LAN (192.168.1.0/24), I'm able to ping the gateway on the VLAN (192.168.3.0/24), but I'm unable to ping the PC (192.168.3.10).

                                      There is nothing in the rules that will stop that ping from working.

                                      Most likely suspect is the default gateway set on the source PC (192.168.3.10) itself.

                                      The latter problem could possibly also be a firewall on 192.168.3.10 itself preventing connections from subnets other than its own. It could also be the default gateway setting there.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      J 1 Reply Last reply Reply Quote 0
                                      • J
                                        jahnieboi @Derelict
                                        last edited by

                                        @derelict

                                        That's what's confusing me. I had put in the correct default gateway on the PC and I've disabled the local firewall on the PC as well.

                                        Any other thoughts? ;-P

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by Derelict

                                          You'll need to post everything. ipconfig/ifconfig, firewall rules as they exist now, switchport VLAN configurations, etc.

                                          There are only so many things it can be and we've already given you about everything so something must be not set like you think it's set.

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          J 1 Reply Last reply Reply Quote 0
                                          • J
                                            jahnieboi @Derelict
                                            last edited by

                                            @derelict

                                            PC ipconfig output:
                                            0_1536097935884_image.png

                                            Firewall Rules:
                                            0_1536097988637_Screen Shot 2018-09-04 at 2.52.40 PM.png

                                            Switch Port config (Netgear):
                                            0_1536098068600_Screen Shot 2018-09-04 at 2.54.13 PM.png

                                            0_1536098101157_Screen Shot 2018-09-04 at 2.54.45 PM.png

                                            0_1536098159842_Screen Shot 2018-09-04 at 2.55.42 PM.png

                                            Please let me know if I missed anything or if you need anything else.

                                            Again - Thank you so much!!!! :)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.