Netgear/Vlans/Pfsense
-
I have purchased a Netgear GS308E to try and setup some VLANS for my home network but am unable to access the netgear web gui. I have the following setup.
Internet > Sky Hub SR203 > PfSense Server > Netgear Switch > PC/Laptop etc
I have DHCP v4 and v6 turned on from the SKY hub. Pfsense WAN gets it's IP from DHCP, LAN is static at 192.168.1.1. During initial configuration of my pfsense server I struggled to get static 4 and 6 addresses to work from the sky hub to the server so was able to get it all talking with v4 & v6 DHCP on.
DHCP on the pfsense LAN side is on with a pool 192.168.1.10 - 192.168.1.254
Default switch web gui is on 192.168.0.239
If the switch is getting a lease then I cannot see it displayed in the pfsense webgui.
The switch is working fine as an unmanaged switched.
Any ideas how I can get to the switch web gui, should I change the range on the lan side of pfsense so it matches the default 192.168.0.239?
-
@r79c said in Netgear/Vlans/Pfsense:
should I change the range on the lan side of pfsense so it matches the default 192.168.0.239?
Why not just set a box/laptop to IP on 192.168.0 and connect it to the switch and change the switch IP?
-
@r79c said in Netgear/Vlans/Pfsense:
I have purchased a Netgear GS308E to try and setup some VLANS for my home network but am unable to access the netgear web gui. I have the following setup.
Internet > Sky Hub SR203 > PfSense Server > Netgear Switch > PC/Laptop etc
Default switch web gui is on 192.168.0.239
Any ideas how I can get to the switch web gui, should I change the range on the lan side of pfsense so it matches the default 192.168.0.239?
Use the "ProSAFE Plus Utility" on the supplied Netgear CD that came with the switch to change the switch IP address to whatever you want. This utility is meant to allow you to configure the switch to work in your network. If your computer doesn't have a CD/DVD drive, then download this utility from the Netgear website. Also this utility is what you can use to configure the Netgear switch for the VLANs on the switch.
-
Yup that would be another option
https://kb.netgear.com/000060611/ProSAFE-Plus-Configuration-Utility-v2-7-7
-
Great thanks for the help. I managed to change the IP now.
-
Well thanks again for the help, I am wondering whether anybody could help a little further with a simple VLAN internet connectivity problem. I am trying to setup one VLAN. I have created VLAN5 using the LAN interface on pfsense, enabled it and set up DHCP 192.168.5.50 - 100 gateway 192.168.5.1/24. I have pfsense LAN plugged into port 2 on the netgear switch, a pc plugged into port 1 and an access point serving IoT devices on port 3. I have the LAN DHCP on 192.168.1.10 - 100 gateway 192.168.1.1/24
On the netgear switch I have enabled 802.1Q. In the VLAN configuration tab I have
VLANID 1 with ports 2345678
VLANID 5 ports 12In the VLAN membership TAB I have
VLAN ID 1 all port Untagged apart from 1
VLAN ID 2 ports 1 and 2 Tagged others blankIn the Port PVID I have Port 1 set to PVID 5 all others set to 1.
I have the PC getting a DHCP lease but no internet connectivity. I have HYBRID NAT enabled with an autorule adding the 192.168.5.0/24 as well as 192.168.1.0/24 which is connected to the internet.
I have a rule for the VLAN interface IPV4 * Source VLAN5 net port * destination *
I can't quite get it to all work correctly so any help would be greatly appreciated.
Many thanks
-
I'm having trouble following what you are trying to do. Assuming vlan 1 is your lan, and vlan 5 is the OPTx network, you would want the port pfSense is in to be untag 1, pvid 1, tag 5. Ports with LAN devices would be untag 1, pvid 1. Ports connected to OPTx devices would be untag 5, pvid 5.
In pfsense LAN would be em0 (or whatever the interface is) and OPTx would be 'vlan 5 on em0' (Defined on vlan tab) -
@r79c said in Netgear/Vlans/Pfsense:
gateway 192.168.5.1/24
You mean you set pfsense IP to this, that is not its gateway.
Posting the rules you put on the vlan 5 interface would help.. Also auto outbound rules would auto added any vlan interfaces. What do you have in hybrid setup?
VLAN ID 1 all port Untagged apart from 1
What device do you have on vlan 5, port 2? This would not have vlan 1 in it, and would be untagged vlan 5, with pvid set to 5.
VLAN ID 2
What is vlan 2?
-
@dotdash I have tried your configuration. I have posted some screenshots to show that. To qualify LAN is interface igb0 VLAN5 is VLAN5 on igb0. Still getting DHCP lease but no connectivity to the internet.
@johnpoz Pfsense is plugged into Port 2 of the netgear switch from the LAN igb0 2 should be 5 typo.
Here some screens.
https://ibb.co/tHjqbvG
https://ibb.co/cYhbTBR
https://ibb.co/M2wcfwsVLAN1 is default, unassigned in pfsense as I read everything is default vlan1 so no need to configure. Basically I am just trying to create one vlan with one PC attached and connected to the internet.
-
You could have an issue with the rules or outbound NAT from the vlan 5 lan- they should be similar to your LAN rules. The screenshots look like you have both 1 and 5 untagged on many ports. There should be an option to clear the box- not a member. Computers just on lan or vlan 5 should not have the other vlan on their ports, and you generally never have a port U on multiple vlans.
-
@dotdash The netgear software in advanced configuration of 802.1q will not let me untag the many unused ports on VLAN ID 1 due to the following error
802.1Q
Cannot remove port 8 from this VLAN. Change its PVID first.Here's the current outbound nat and one of vlan5 rule
https://ibb.co/8dzx2FK
https://ibb.co/SBwzZQG -
well your forcing vlan 5 out some vpn group. I thought vlan 5 was 192.168.5.0/24 - so how would it it ever nat to some vpn connection.
Also your hybrid rules for wan interface are pointless - since those are already in the automatic rules.
Well you can not remove a vlan X from a port if pvid is set to vlan X..
If you just want 1 port on vlan 5 the only thing that needs to happen on the switch is tag vlan 5 on port connected to pfsense. And the port connected to device you want in vlan 5 would have vlan 1 removed and untagged vlan 5, and pvid vlan 5
-
vlan5 static ip is 192.168.5.1/24
I assumed I would be able to NAT the VLAN5 to use the VPN_GROUP I set up which is basically three openvpn clients, just like the LAN does?
I have followed your advice for the switch I have taken four more screenshots of the switch configuration.
https://ibb.co/j88PF1j
https://ibb.co/KWQbQQF
https://ibb.co/k0rn4Mg
https://ibb.co/WyKjjLZ -
You have port all ports untagged vlan 1 - that is WRONG!!!
That even lets you have 1 an 5 untagged on port 1 is just stupid.. You should not be able to put more than 1 untagged vlan on a port.. Its a borked configuration!!
ssumed I would be able to NAT the VLAN5 to use the VPN_GROUP
How - you don't have anything in outbound nat natting 192.168.5/24 to your vpn interface.. You only have 192.168.1/24
-
@johnpoz For me to change the port setup in membership tab on vlan1 I have to change the Port PVID
ah apart from port 1 which I can blank
like so
https://ibb.co/16BV4hz
-
You have its pvid set to 5.. So remove the vlan 1 untagged on that port!
Which is correct... Your telling the switch hey any untagged traffic you see ingress to this port is vlan 5 traffic!! And putting the switch in vlan 5 untagged tells the switch hey only send vlan 5 traffic out this port, and remove the tag.
Now the device connected to this port is in vlan 5, but it doesn't really know.. It just sees untagged traffic..
-
right ok I think I've done that
https://ibb.co/16BV4hz
https://ibb.co/w7ZLhMV -
That looks right yes.
Now you just need to fix your hybrid rules if you want vlan5 to go out your vpn connection.
-
So I would need to add a rule for 192.168.5.0/24 LAN to WAN?? altho I have an automatic rule with that.
BTW thanks for your help, I'm learning, albeit slowly!
-
No you need an outbound nat so that pfsense will nat 192.168.5 to one of your vpn interfaces.. You only had 192.168.1 in your hybrid natting to yoru vpn interface ips.
Why would you need a rule for lan to wan?? Wan net is not the internet - its just wan net, that is it... Your rule on sending vlan 5 out your vpn would send it out a vpn... But you had no outbound nat to nat 192.168.5 to vpn interface.
