VLANs without a 'Smart' Switch?
-
@johnpoz I'll have to read through that in a bit (or in a few days, at this point...)
I was wondering and poking around at maybe using something like vSwitch in a VM or even on the same Ubuntu VM w/ pi-hole, but hadn't made it that far down the rabbit hole yet.
I've got strong networking and general tech background, but still very new to VLANs, so mostly just trying to learn at this point.
-
Well have not setup any vlans with virtualbox.. I have it installed - guess I could fire it up and do some testing..
You could prob set it up with vswitch doing the tags in virtualbox. If your going to setup vlan on pfsense the tag has to get to pfsense, if pfsense sees the traffic with the tag, it will send the traffic back with the tag.
But if pfsense doesn't see the tagged traffic, then no it could never send it back with a tag..
There are a few ways to skin this cat - but while a dumb switch might not strip tags. If your going to pass vlan traffic over a dumb switch your not actually securing anything unless the switch can isolate actually isolate the traffic via the tags..
While you could do such a thing in a lab, or in a pinch for a test setup, etc. If your going to do vlans - your switches really need to understand them to actually do it correctly!!!
-
@johnpoz at the moment, my primary goal is to get the IOT traffic segmented away from the rest of the network (hence the multiple SSID w/ corresponding VLAN).
I'll eventually get a proper switch which will obviously help... just wasn't sure if this was even feasible as-is, or even how to tell whether or not the pfSense was getting the VLAN tag in the first place.
I'll try to get some screenshots of the config posted.
-
Well from a 2 minute browsing about virtualbox and vlans - looks like the physical nic can have issues with stripping the tags in a bridged setup..
This is going to be more complicated than prob thought to be honest.. You prob going to want multiple physical interfaces in your virtualbox host, and then do the vlans on your switch..
You prob have better luck with vlans if your host for virtualbox was linux based vs windows 10... I did run across a post about disable vlans and priority on realtek cards - which might have it pass the tags to the vm..
I don't really have time to dig into this at the moment.. And problem is don't have a lot of physical nics to play with - other than the realteks that are in my windows machine.. But seems your using usb nic?
Or if you just used hyper-v vs virtualbox..
When I get some time - prob trmw, I will fire up a vm on virtualbox and try passing it some tagged traffic to see if it sees it.
edit:
So another few minutes of research and does your interface in windows have a setting for vlan & priority (realtek does) and if you set it to disabled.. Its suppose to not strip the tags."The "Realtek PCIe GBE Family Controller" NIC can be configured to not strip the vlan tags, by going to the Adapter Settings and setting "Priority & VLAN" to "Priority & VLAN disabled". All the other values for this option will make the driver delete the VLAN tags from the frame."
-
@johnpoz I saw that earlier but forgot to go back and change it to see if it makes a difference... that was definitely one of the options that the newer USB NIC had that the on-board (2010) didn't have, so... cross your fingers!
-
@johnpoz Houston, we have liftoff!
Now I just have to start writing the firewall rules and get the rest of the vlan's configured... I'm sure I'll be back!
Thank you so much!
-
Great - while you "can" pass vlans over a dumb switch... It is not good setup and not secure.. You need to put actual smart switch(es) on your to buy list... They can be had for like $40 for 8 port gig... So they are not all that expensive..
Just highly suggest you stay away from the cheap tplink ones - they have issues with vlans... I would suggest say the dlink dgs-1100-08 as better choice.
currently see it on amazon for $40
https://www.amazon.com/D-Link-EasySmart-Gigabit-Ethernet-DGS-1100-08/dp/B008ABLU2I -
Wow, those are some huge screenshots lol.
So, even though we're getting an IP from the correct DHCP now, I'm still not getting internet traffic through on that SSID... see firewall config below...
I assume I'm missing something obvious at this point
-
Did you mess with outbound nat? Auto would of auto added your vlans, but if you set it to manual for some reason that could cause you problems.
Can you ping pfsense vlan44 IP? Can you ping pfsense wan IP? From your vlan 44 client?
So while it looks like your allowing dns to that 10.10.10.5 address - does it actually return query for dns?
Can you ping 8.8.8.8 from the client.
-
I think I forgot to hit "apply" on that first screenshot, and those settings did work after I applied them...
However, this is how I intended to set it up (probably my own exhaustion and ignorance here), to only allow that SSID/VLAN (IOT devices) to access the internet through the firewall, but disallow them from accessing any other local networks / VLANs...
Also tried it like this...
Most everything I can ping from my phone, including the .5 DNS, just can't make it to the internet...
Here are my other configs, in case it matters...
-
I don't think I did a very good job answering, so I'll be thorough...
- Did you mess with outbound nat? No.
- Can you ping pfsense vlan44 IP? From my PC (LAN), no - also no from phone (VLAN44). I assumed that the interface just wasn't responding to pings in general.
- Can you ping pfsense wan IP? Yes, from PC (LAN) and Phone (VLAN44)
- From your vlan 44 client? Yes.
- So while it looks like your allowing dns to that 10.10.10.5 address - does it actually return query for dns? Haven't checked query, but I can ping it from my phone
- Can you ping 8.8.8.8 from the client. Phone (VLAN44), no.
-
Just testing my own understanding at this point... adding the top line does allow me to ping 10.10.10.1 from VLAN44, but the second line does not.
As I understand it, the bottom rule should be passing traffic between VLAN44 and WAN, but that doesn't appear to be the case...
Just noticed this in the firewall logs, probably related but I'll poke more...
-
If you want internet - internet is ANY, not wan or wan net, etc.
Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated..
If you don't want vlan44 to get to other vlans, then put in a rule that blocks above the any allow rule.. Setup an alias with say all rfc1918 space..
Here is example I use to show users how it "can" be setup..
They are labeled what they do.
-
Okay, we're rolling... I need to get some rest, but truly appreciate all the help. I'm sure things will run along smoothly once I have a fresh set of eyes!
-
Great - any questions just ask, here to help.
Remember get those smart switch(es) on order! ;)
