Netgear/Vlans/Pfsense



  • I have purchased a Netgear GS308E to try and setup some VLANS for my home network but am unable to access the netgear web gui. I have the following setup.

    Internet > Sky Hub SR203 > PfSense Server > Netgear Switch > PC/Laptop etc

    I have DHCP v4 and v6 turned on from the SKY hub. Pfsense WAN gets it's IP from DHCP, LAN is static at 192.168.1.1. During initial configuration of my pfsense server I struggled to get static 4 and 6 addresses to work from the sky hub to the server so was able to get it all talking with v4 & v6 DHCP on.

    DHCP on the pfsense LAN side is on with a pool 192.168.1.10 - 192.168.1.254

    Default switch web gui is on 192.168.0.239

    If the switch is getting a lease then I cannot see it displayed in the pfsense webgui.

    The switch is working fine as an unmanaged switched.

    Any ideas how I can get to the switch web gui, should I change the range on the lan side of pfsense so it matches the default 192.168.0.239?


  • LAYER 8 Global Moderator

    @r79c said in Netgear/Vlans/Pfsense:

    should I change the range on the lan side of pfsense so it matches the default 192.168.0.239?

    Why not just set a box/laptop to IP on 192.168.0 and connect it to the switch and change the switch IP?



  • @r79c said in Netgear/Vlans/Pfsense:

    I have purchased a Netgear GS308E to try and setup some VLANS for my home network but am unable to access the netgear web gui. I have the following setup.

    Internet > Sky Hub SR203 > PfSense Server > Netgear Switch > PC/Laptop etc

    Default switch web gui is on 192.168.0.239

    Any ideas how I can get to the switch web gui, should I change the range on the lan side of pfsense so it matches the default 192.168.0.239?

    Use the "ProSAFE Plus Utility" on the supplied Netgear CD that came with the switch to change the switch IP address to whatever you want. This utility is meant to allow you to configure the switch to work in your network. If your computer doesn't have a CD/DVD drive, then download this utility from the Netgear website. Also this utility is what you can use to configure the Netgear switch for the VLANs on the switch.


  • LAYER 8 Global Moderator



  • Great thanks for the help. I managed to change the IP now.



  • Well thanks again for the help, I am wondering whether anybody could help a little further with a simple VLAN internet connectivity problem. I am trying to setup one VLAN. I have created VLAN5 using the LAN interface on pfsense, enabled it and set up DHCP 192.168.5.50 - 100 gateway 192.168.5.1/24. I have pfsense LAN plugged into port 2 on the netgear switch, a pc plugged into port 1 and an access point serving IoT devices on port 3. I have the LAN DHCP on 192.168.1.10 - 100 gateway 192.168.1.1/24

    On the netgear switch I have enabled 802.1Q. In the VLAN configuration tab I have

    VLANID 1 with ports 2345678
    VLANID 5 ports 12

    In the VLAN membership TAB I have

    VLAN ID 1 all port Untagged apart from 1
    VLAN ID 2 ports 1 and 2 Tagged others blank

    In the Port PVID I have Port 1 set to PVID 5 all others set to 1.

    I have the PC getting a DHCP lease but no internet connectivity. I have HYBRID NAT enabled with an autorule adding the 192.168.5.0/24 as well as 192.168.1.0/24 which is connected to the internet.

    I have a rule for the VLAN interface IPV4 * Source VLAN5 net port * destination *

    I can't quite get it to all work correctly so any help would be greatly appreciated.

    Many thanks



  • I'm having trouble following what you are trying to do. Assuming vlan 1 is your lan, and vlan 5 is the OPTx network, you would want the port pfSense is in to be untag 1, pvid 1, tag 5. Ports with LAN devices would be untag 1, pvid 1. Ports connected to OPTx devices would be untag 5, pvid 5.
    In pfsense LAN would be em0 (or whatever the interface is) and OPTx would be 'vlan 5 on em0' (Defined on vlan tab)


  • LAYER 8 Global Moderator

    @r79c said in Netgear/Vlans/Pfsense:

    gateway 192.168.5.1/24

    You mean you set pfsense IP to this, that is not its gateway.

    Posting the rules you put on the vlan 5 interface would help.. Also auto outbound rules would auto added any vlan interfaces. What do you have in hybrid setup?

    VLAN ID 1 all port Untagged apart from 1

    What device do you have on vlan 5, port 2? This would not have vlan 1 in it, and would be untagged vlan 5, with pvid set to 5.

    VLAN ID 2

    What is vlan 2?



  • @dotdash I have tried your configuration. I have posted some screenshots to show that. To qualify LAN is interface igb0 VLAN5 is VLAN5 on igb0. Still getting DHCP lease but no connectivity to the internet.

    @johnpoz Pfsense is plugged into Port 2 of the netgear switch from the LAN igb0 2 should be 5 typo.

    Here some screens.

    https://ibb.co/tHjqbvG
    https://ibb.co/cYhbTBR
    https://ibb.co/M2wcfws

    VLAN1 is default, unassigned in pfsense as I read everything is default vlan1 so no need to configure. Basically I am just trying to create one vlan with one PC attached and connected to the internet.



  • You could have an issue with the rules or outbound NAT from the vlan 5 lan- they should be similar to your LAN rules. The screenshots look like you have both 1 and 5 untagged on many ports. There should be an option to clear the box- not a member. Computers just on lan or vlan 5 should not have the other vlan on their ports, and you generally never have a port U on multiple vlans.



  • @dotdash The netgear software in advanced configuration of 802.1q will not let me untag the many unused ports on VLAN ID 1 due to the following error

    802.1Q
    Cannot remove port 8 from this VLAN. Change its PVID first.

    Here's the current outbound nat and one of vlan5 rule

    https://ibb.co/8dzx2FK
    https://ibb.co/SBwzZQG


  • LAYER 8 Global Moderator

    well your forcing vlan 5 out some vpn group. I thought vlan 5 was 192.168.5.0/24 - so how would it it ever nat to some vpn connection.

    Also your hybrid rules for wan interface are pointless - since those are already in the automatic rules.

    Well you can not remove a vlan X from a port if pvid is set to vlan X..

    If you just want 1 port on vlan 5 the only thing that needs to happen on the switch is tag vlan 5 on port connected to pfsense. And the port connected to device you want in vlan 5 would have vlan 1 removed and untagged vlan 5, and pvid vlan 5



  • vlan5 static ip is 192.168.5.1/24

    I assumed I would be able to NAT the VLAN5 to use the VPN_GROUP I set up which is basically three openvpn clients, just like the LAN does?

    I have followed your advice for the switch I have taken four more screenshots of the switch configuration.

    https://ibb.co/j88PF1j
    https://ibb.co/KWQbQQF
    https://ibb.co/k0rn4Mg
    https://ibb.co/WyKjjLZ


  • LAYER 8 Global Moderator

    You have port all ports untagged vlan 1 - that is WRONG!!!

    That even lets you have 1 an 5 untagged on port 1 is just stupid.. You should not be able to put more than 1 untagged vlan on a port.. Its a borked configuration!!

    ssumed I would be able to NAT the VLAN5 to use the VPN_GROUP

    How - you don't have anything in outbound nat natting 192.168.5/24 to your vpn interface.. You only have 192.168.1/24



  • @johnpoz For me to change the port setup in membership tab on vlan1 I have to change the Port PVID

    ah apart from port 1 which I can blank

    like so

    https://ibb.co/16BV4hz


  • LAYER 8 Global Moderator

    You have its pvid set to 5.. So remove the vlan 1 untagged on that port!

    Which is correct... Your telling the switch hey any untagged traffic you see ingress to this port is vlan 5 traffic!! And putting the switch in vlan 5 untagged tells the switch hey only send vlan 5 traffic out this port, and remove the tag.

    Now the device connected to this port is in vlan 5, but it doesn't really know.. It just sees untagged traffic..



  • right ok I think I've done that

    https://ibb.co/16BV4hz
    https://ibb.co/w7ZLhMV


  • LAYER 8 Global Moderator

    That looks right yes.

    Now you just need to fix your hybrid rules if you want vlan5 to go out your vpn connection.



  • So I would need to add a rule for 192.168.5.0/24 LAN to WAN?? altho I have an automatic rule with that.

    BTW thanks for your help, I'm learning, albeit slowly!


  • LAYER 8 Global Moderator

    No you need an outbound nat so that pfsense will nat 192.168.5 to one of your vpn interfaces.. You only had 192.168.1 in your hybrid natting to yoru vpn interface ips.

    Why would you need a rule for lan to wan?? Wan net is not the internet - its just wan net, that is it... Your rule on sending vlan 5 out your vpn would send it out a vpn... But you had no outbound nat to nat 192.168.5 to vpn interface.



  • I added a rule to one of the vpn interfaces that I have outbound

    https://ibb.co/4TspV7G

    Is this correct?


  • LAYER 8 Global Moderator

    Again those wan outbound hybrids are POINTLESS!!!

    And how you sure that outbound nat is gong to use that vpn interface, if your policy routing it out a group... What if it goes out a different vpn interface?



  • So i have the following configuration and I still have no internet connectivity on the pc plugged into port 1 on the netgear switch. The VLAN5 interface is up, I have outbound NAT rules and firewall rules in the VLAN tab. I just dont understand it at the moment????? It should be relatively simple.

    on the pc i get a dhcp lease but am unable to ping 192.168.5.1 or google.com

    LAN is on 192.168.1.
    VLAN is on 192.168.5.

    here are some more screens of the configuration.

    https://ibb.co/0ft99fJ
    https://ibb.co/D9W0ZXV
    https://ibb.co/wy401MF
    https://ibb.co/z7Rv26Z
    https://ibb.co/dcXmmCQ
    https://ibb.co/8r27zTG
    https://ibb.co/vsmjRxW
    https://ibb.co/7JGDVS1
    https://ibb.co/HTCjhpN

    I've just read that you cannot send vlan over vpn!

    https://forum.netgate.com/topic/148170/specific-vlan-over-vpn-only/5



  • Not sure how that NordVPN stuff works, but I think you need the 192.168.5.0 natting out the VPN gateway instead of the redundant WAN. Why don't you just verify the vlan works out the WAN first. I'll refrain from giving my opinions of 'privacy' vpn providers.
    RE: That last link, i'm not sure what JP is on about- you can't carry the vlan tag over a VPN, but you can absolutely have a vlan interface with a unique subnet and route that. My experience however is with site to site tunnels.



  • I thought that as well, getting it to work with the WAN first so I added the following mapping...

    https://ibb.co/WF4NFYm

    still no internet, It has to be something stupid that I'm not configuring properly...


  • LAYER 8 Global Moderator

    @r79c said in Netgear/Vlans/Pfsense:

    on the pc i get a dhcp lease but am unable to ping 192.168.5.1

    Well then look to the client for why... Can you arp pfsense 192.168.5.1 on the client? You have no rules allowing to ping pfsense.. Its possible everything thing is getting shoved out your policy.. So no you wouldn't be able to ping 192.168.5.1... Create a rule above your policy route rule that allows ping to vlan address

    I've just read that you cannot send vlan over vpn!

    Your reading that WRONG... That has nothing to do with what your doing, which is routing a specific network/vlan over a vpn connection.

    As to getting to the internet - well how and the F do you think its going to go out your vpn which your forcing via your policy route.. But your not natting to it... We already went over this!!!

    What I would highly suggest you do is get your vlan 5 working as a normal network before you worry about shoving all its traffic down some vpn connection.



  • @johnpoz What I would highly suggest you do is get your vlan 5 working as a normal network before you worry about shoving all its traffic down some vpn connection.

    that's what I'm trying to do

    @johnpoz Create a rule above your policy route rule that allows ping to vlan address

    By policy route rule you mean a firewall rule in the vlan tab that allows me to ping vlan address?

    if i do arp -a 192.168.5.1 i get

    Interface: 192.168.5.0 --- 0x7
    Internet Address 192.168.5.1
    Physical Address MAC
    Type Dynamic

    rules picture

    https://ibb.co/cyTRT9s


  • LAYER 8 Global Moderator

    @r79c said in Netgear/Vlans/Pfsense:

    I dont get a response with arp 192.168.5.1

    Look in your client that is on this vlan 5, look in its arp table.. If you do not see pfsense mac address then NO your never going to be able to ping it.

    And would say your not getting dhcp from it either..

    I am assuming this is a windows box.

    lets see its ipconfig /all
    ping 192.168.5.1
    look in your arp table
    arp -a

    This is WRONG

    Interface: 192.168.5.0 --- 0x7
    

    Post your ipconfig /all

    Your interface sure and the hell should not have a .0 address with a /24 mask.



  • arp -a on the client gives me

    Interface: 192.168.5.50 --- 0x7

    Internet Address
    192.168.1.125
    192.168.1.201
    192.168.1.202
    192.168.5.1 - mac address is that of LAN interface on Pfsense
    192.168.5.255
    224.0.0.2
    224.0.0.251
    224.0.0.252
    239.255.255.250
    255.255.255.255

    with all the physical address as well

    ipconfig /all

    Connection : localdomain
    description: intel gb network connection
    physical: mac
    dhcp enabled: yes
    auto config: yes
    link local ipv6: ...
    ipv4 192.168.5.50
    subnet mask: 255.255.255.0
    default gateway: 192.168.5.1
    dhcp server: 192.168.5.1
    dhcpv6 iaid: 133459204
    dhcpv6 client duid: ...
    dns server: 192.168.5.1
    netbios over tcip: enabled

    yes client is a windows box


  • LAYER 8 Global Moderator

    Well is the mac address for 5.1 pfsense mac address. Where were you seeing 5.0? for your interface?

    You have something really F'd up

    192.168.1.125
    192.168.1.201
    192.168.1.202
    

    You shouldn't be seeing 192.168.1 address if your in vlan 5!!!



  • @johnpoz yes the mac address for 5.1 is the mac address of the lan interface

    5.0 must have been a typo

    two of those 192.168.1 address are static IP mappings for devices
    192.168.1.125 is the IP address of an access point

    all these IP addresses go through port 3 on the netgear switch which is connected to a wireless access point mesh


  • LAYER 8 Global Moderator

    @r79c said in Netgear/Vlans/Pfsense:

    two of those 192.168.1 address are static IP mappings for devices

    Doesn't matter! So you created those on the device directly with arp? For why? It is pointless, and does nothing - sure and the F not going to work..

    I take it basic understanding of how vlans actually work, and what they do is where we need to start..



  • @johnpoz So you created those on the device directly with arp? For why?

    I statically mapped those IP addresses using Pfsense with arp yes, why, because those two devices are TV's which I did not want to put the traffic over VPN connection.

    @johnpoz I take it basic understanding of how vlans actually work, and what they do is where we need to start..

    sure, your the only one responding to this, and I'm grateful because I can't seem to get this working at all!!! I'm starting to wonder why I'm bothering really, as I only wanted to setup up one VLAN with one PC on my home network LoL


  • LAYER 8 Global Moderator

    @r79c said in Netgear/Vlans/Pfsense:

    I statically mapped those IP addresses using Pfsense with arp yes,

    Dude ON THE CLIENT!!! we need to see the arp table on the CLIENT that is in vlan 5 and connected to port 1 of your switch... Not the arp table of pfsense!!!!

    Here

    $ arp -a                                                      
                                                                  
    Interface: 192.168.9.100 --- 0xc                              
      Internet Address      Physical Address      Type            
      192.168.9.10          00-11-32-7b-29-7d     dynamic         
      192.168.9.11          00-11-32-7b-29-7e     dynamic         
      192.168.9.99          70-6e-6d-f3-11-93     dynamic         
      192.168.9.208         02-11-32-2d-aa-61     dynamic         
      192.168.9.253         00-08-a2-0c-e6-24     dynamic         
      192.168.9.255         ff-ff-ff-ff-ff-ff     static          
      224.0.0.22            01-00-5e-00-00-16     static          
      239.192.0.0           01-00-5e-40-00-00     static          
      239.255.255.250       01-00-5e-7f-ff-fa     static          
      255.255.255.255       ff-ff-ff-ff-ff-ff     static          
                                                                  
    Interface: 192.168.9.101 --- 0x14                             
      Internet Address      Physical Address      Type            
      192.168.9.10          00-11-32-7b-29-7d     dynamic         
      192.168.9.11          00-11-32-7b-29-7e     dynamic         
      192.168.9.253         00-08-a2-0c-e6-24     dynamic         
      192.168.9.255         ff-ff-ff-ff-ff-ff     static          
      224.0.0.22            01-00-5e-00-00-16     static          
      239.192.0.0           01-00-5e-40-00-00     static          
      239.255.255.250       01-00-5e-7f-ff-fa     static          
      255.255.255.255       ff-ff-ff-ff-ff-ff     static          
    

    This is my windows box arp table... Post yours up from the BOX connected to port 1 of your switch! if on that box your seeing 192.168.1 IPs then your setup is BORKED!!!

    And post your ipconfig /all

    $ ipconfig /all                                                                     
                                                                                        
    Windows IP Configuration                                                            
                                                                                        
       Host Name . . . . . . . . . . . . : i5-win                                       
       Primary Dns Suffix  . . . . . . . : local.lan                                    
       Node Type . . . . . . . . . . . . : Broadcast                                    
       IP Routing Enabled. . . . . . . . : No                                           
       WINS Proxy Enabled. . . . . . . . : No                                           
       DNS Suffix Search List. . . . . . : local.lan                                    
                                                                                        
    Ethernet adapter Local:                                                             
                                                                                        
       Connection-specific DNS Suffix  . :                                              
       Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller           
       Physical Address. . . . . . . . . : 00-13-3B-2F-67-62                            
       DHCP Enabled. . . . . . . . . . . : No                                           
       Autoconfiguration Enabled . . . . : Yes                                          
       IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred)                     
       Subnet Mask . . . . . . . . . . . : 255.255.255.0                                
       Default Gateway . . . . . . . . . : 192.168.9.253                                
       DNS Servers . . . . . . . . . . . : 192.168.3.10                                 
       NetBIOS over Tcpip. . . . . . . . : Enabled                                      
                                                                                        
    

    At a loss to where your posting that arp info from - because that sure and the F does not look like how pfsense would present it..... And no matter what you did with static arps on pfsense they would not show in your clients arp table.. You do not have your vlans setup how you think you do if your seeing arp entries from 192.168.1 on your box that is suppose to be in vlan 5

    This is switch setup
    pfsense - 1U,5T --- switch --- 5U --- vlan 5 client

    If that is how you have it setup, you should NEVER see arp entries for anything other than what is in vlan 5



  • ok here it is, from the client...

    C:\WINDOWS\system32>arp -a
    
    Interface: 192.68.5.50 --- 0x7
       Internet Address                       Physical Address                  Type
       192.168.1.125                          b0-be-76-b7-cf-8c                  dynamic
       192.168.1.201                          78-bd-bc-34-d0-f3                  dynamic
       192.168.1.202                          08-84-9d-87-b5-d3                 dynamic
       192.168.5.1                              6d-b3-11-1c-6c-77                  dynamic
       192.168.5.255                          ff-ff-ff-ff-ff-ff                                static
       224.0.0.22                                 01-00-5e-00-00-16                 static
       224.0.0.251                               01-00-5e-00-00-fb                  static
       224.0.0.252                               01-00-5e-00-00-fc                  static
       239.255.255.250                      01-00-5e-7f-ff-fa                      static
       255.255.255.255                      ff-ff-ff-ff-ff-ff                                static
    

    BORKED! LOL


  • LAYER 8 Global Moderator

    Yup that is BORKED

    You should not be seeing 192.168.1 address if your in vlan 5.. So your switch is clearly not setup correctly. or its not doing what it should be doing.. If you were in vlan 5 it would not be possible for you to get arp answers for anything in 192.168.1



  • @johnpoz said in Netgear/Vlans/Pfsense:

    This is switch setup
    pfsense - 1U,5T --- switch --- 5U --- vlan 5 client

    If you could look at the following pictures they show the netgear switch setup as it is at the moment.

    https://ibb.co/0ft99fJ
    https://ibb.co/D9W0ZXV
    https://ibb.co/wy401MF
    https://ibb.co/z7Rv26Z

    Pfsense is plugged in to port 2

    VLAN5 PC Client is plugged in to port 1

    Everything else is plugged into port 3


  • LAYER 8 Global Moderator

    that looks correct yes..

    But its not working if your seeing mac of devices in 192.168.1..

    Clear your arp table... Do they come back? trying pinging one of those 192.168.1 address from your client after you clear your arp.

    BTW your rules on vlan 5 are WRONG!!! source would NEVER be pfsense on vlan 5 address.. Source would be vlan 5 net..

    What did you set netgears IP too? You said you changed it.

    What is the hardware of your pfsense box?
    6DB311

    That doesn't resolve as maker of networking gear..



  • @johnpoz said in Netgear/Vlans/Pfsense:

    Clear your arp table

    cleared and not returned

    cannot ping any 192.168.1 or 192.168.5

    i have the following arp entries now

    192.168.5.1
    192.168.5.255
    224.0.0.22
    224.0.0.251
    224.0.0.252
    239.255.255.250
    255.255.255.255


  • LAYER 8 Global Moderator

    Ok that is better!

    So simple test is sniff on pfsense vlan interface while you ping it from the client.. Do you see the ping?

    BTW what hardware is the nic on pfsense? that mac doesn't resolve to anyone..

    ping.jpg


Log in to reply