Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense dhcp problem using VLANS

    Scheduled Pinned Locked Moved DHCP and DNS
    20 Posts 6 Posters 5.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      Toube
      last edited by

      Hi All,

      I have been struggling for a few days and I don't know what or where I'm going wrong.
      My problem is that I set up some VLANS in pfsense GUEST100 and IOT50 and I want to separate the IOT devices from my LAN.

      I have create the interfaces and set the DHCP for them. Then I'm using Unifi controller with Unifi AP:s.
      So I have created a GUEST and a IOT SSID with VLAN100 and VLAN50 as params for the wifis.

      Now my problem is pretty weird.. If I connect a wired device to a smart switch where the port has a VLAN50 it will get the right ip-address.
      But for the Wifi devices, they have problems.. they struggle to get a ip-address from the dhcp server.

      I have been trying to solve this at the Unifi community but I'm starting to think that it might be a pfsense problem.. or more likely something I have configured the wrong way.
      Here is how my network is setup.
      Pfsense ports

      Eth 0 -> WAN
      Eth 1 -> LAN
      Eth 2 -> IOT + GUEST VLANS 50 and 100
      Eth 2 goes to dumb switch and from there to Unifi port 2 so all devices plugged in to the dumb switch are assigned a VLAN50 address.

      Unifi Switch:
      All other port has the default All except for port 2 that has VLAN 50 and 100 assigned using Profile in Unifi.
      alt text

      JKnottJ 1 Reply Last reply Reply Quote 0
      • JKnottJ
        JKnott @Toube
        last edited by

        @Toube

        Why do you have a connection from pfSesne to the dumb switch and then to the Unifi switch and also from pfSense to Unifi? Also, is the native LAN on eth 2 configured?

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • T
          Toube
          last edited by Toube

          @JKnott
          good question. I changed it bit recently.
          I'm now only using the LAN with the VLANS.. the IGB2 (eth2) is unhooked.
          See below:
          alt text
          The Native LAN on eth2 was probably not configured or what do you mean by configured?
          Still using this way of connecting the iot devices struggle to get an ip-address from the pfsense server.

          JKnottJ 1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott @Toube
            last edited by

            @Toube

            When you go to Status / Interfaces, you can see how every interface, including VLAN, is configured. On my system, bge0 is the LAN and has an IP address. I also have VLAN3 on the same interface, which is listed as bge.3.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            1 Reply Last reply Reply Quote 0
            • T
              Toube
              last edited by

              @JKnott
              yes on mine it shows same as yours:
              IOT Interface (opt1, igb1.50)

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @Toube
                last edited by

                @Toube said in pfSense dhcp problem using VLANS:

                yes on mine it shows same as yours

                So you have an IP address on both igb1 and igb1.50

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • T
                  Toube
                  last edited by

                  Yes:
                  alt text

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @Toube
                    last edited by

                    @Toube

                    So, you've got 192.168.1.1 on igb1. Is that subnet used anywhere else? On that interface you've got 2 VLANs and the native LAN, all with IP addresses.

                    BTW, shouldn't there also be a VLAN 1gb1.100? You had previously said you had VLAN 50 & 100 on that interface.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • T
                      Toube
                      last edited by Toube

                      Hi @JKnott ,
                      The 192.168.1.1 subnet is used by the LAN, not sure I understand your question by used anywhere else.
                      Yes there is the third igb1.100 network I didn't capture it sorry.

                      1 Reply Last reply Reply Quote 0
                      • T
                        Toube
                        last edited by

                        One thing. The port on my Unifi Switch that goes to the pfsense LAN, igb1 port (native), well I haven't set any VLANS on that port. I'm using the port setting ALL.
                        Well actually all ports are set to All..I assume when ALL is used the ports will echo all the VLANS the AP:s are transmitting so it should work correctly?
                        Anyways I still have problems with IOT and sometimes also my Android mobile can't get an IP-address when connecting to the IOT SSID.

                        Chromecast is the one with most problems.
                        The thing is that if I connect the IOT and chromecast to my primary LAN network without VLAN they will work and the dhcp assignes all IOT devices ip-addresses without a glitch.

                        1 Reply Last reply Reply Quote 0
                        • T
                          Toube
                          last edited by Toube

                          The DNS forwarder, should it be disabled?
                          alt text
                          I guess the DNS resolver handles the DNS requests?

                          GertjanG 1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @Toube
                            last edited by

                            @Toube said in pfSense dhcp problem using VLANS:

                            The DNS forwarder, should it be disabled?

                            It is :

                            fc13ce4c-4064-4842-b9c6-12c4909c758e-image.png

                            @Toube said in pfSense dhcp problem using VLANS:

                            I guess the DNS resolver handles the DNS requests?

                            By default, the Resolver (unbound) is enabled.
                            It will work for any LAN type interface - keep in mind that on any OPTx type interface (and VLAN) a protocol UDP & TCP destination port 53 needs to be added..

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • T
                              Toube
                              last edited by

                              Hi @Gertjan ,
                              do I need to add any rules to the IOT network?
                              alt text
                              Currently only one rule active for the IOT.

                              GertjanG 1 Reply Last reply Reply Quote 0
                              • T
                                Toube
                                last edited by

                                Current situation is that all wireless clients are not getting an IP-address when a VLAN tag is set to the SSID. But for wired connection for example.
                                If I connect my laptop to a smart switch port that has the VLAN50 tag in the port then my laptop will be given the correct ip-address from the IOT dhcp scope.

                                1 Reply Last reply Reply Quote 0
                                • B
                                  bcruze
                                  last edited by bcruze

                                  did you setup the vlan ONLY within the UBNT controller?

                                  settings > networks > create network > purpose vlan only name of vlan and vlan ID

                                  this doesn't sound like a Pfsense issue(yet) it doesn't sound like the vlan was setup properly yet

                                  T 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @Toube
                                    last edited by

                                    @Toube said in pfSense dhcp problem using VLANS:

                                    Hi @Gertjan ,
                                    do I need to add any rules to the IOT network?
                                    alt text
                                    Currently only one rule active for the IOT.

                                    The IOT firewall rule is ok.

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      Toube @bcruze
                                      last edited by Toube

                                      Hi @bcruze,
                                      the Unifi VLAN (Created 2 x with Vlan only IOT VLANID 50 and GUEST VLANID 100) is at least to my knowledge setup as it should be.
                                      Then added these VLANIDs to the SSID configurations.
                                      On the switch ports where the ap:s are connected I have set the switch profile with LAN as native network and then included the tagged VLANS 50 and 100.

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        Toube
                                        last edited by

                                        So it seems was neither Unifi or Pfsense problem.. the problem was my small Netgear smart switches two of them.. they were improperly configured and thus causing the VLAN50 and 100 not to be able to be forwarded to the pfsense router. Thanks all for answering me.

                                        ? 1 Reply Last reply Reply Quote 1
                                        • ?
                                          A Former User @Toube
                                          last edited by

                                          @toube
                                          What change to your Netgear switch did you make? Having same issue and I'm using Netgear switches.

                                          Thanks

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jaspery
                                            last edited by

                                            I didn't work with UniFi switches, however I'm planning to later this year.

                                            But concept I'm using with other switches that support VLAN is like this:

                                            Chromecast will need to receive traffic only from IOT VLAN (if I understand your requirement correctly. But for Chromecast (and other consumer grade appliance) it is important to receive this traffic as untagged, so if it is possible in Unify switch you need to configure ports to which devices are connected directly as belonging to proper VLAN but sending untagged traffic.

                                            Also I'm seeing you seem to have solved your issue already, but I'd suggest to consider configuring untagged ports properly (if Unify allows it, maybe it is too smart and guesses proper config on it's own)

                                            I'm just thinking if e.g. Chromecast is connected to port which sends tagged traffic, Chromecast will probably be able to receive some packets, but some portion of packets may be dropped, and this will affect quality of the connection.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.