Help with physical interfaces and VLANs

  • Hi, I am planning a new home pfsense install on an HP T730 that will have 5 physical ethernet ports. Obviously one is WAN. However I am not sure how to set up the others. If I will have an outbuilding that will contain a managed switch and a wifi AP with three VLANs that will connect to one physical port on the pfsense box, how do I set up that port? Can I assign mutliple VLANs to the port? Each VLAN should have its own subnet. For example, those VLANs would be for Wifi, Guest Wifi and iOT devices, all different subnets with pfsense doing the dhcp for each. Would I create the VLANs and assign them each to their physical port? And then under interfaces, assign them each with the OPT# and the VLAN? Would the outbuilding switch be configured with an IP in the same subnet as the pfsense box ?

  • You probably have this post in the incorrect topic for what you're asking, maybe a mod can move it later...

    Anyway, you can either run your VLANs on 1 interface, or you can break them out on their own interfaces. If you don't actually need them to talk to each other, separate interfaces is really easy. But, if for say, you want a common wireless network, both for mixed "trusted" LAN traffic and "untrusted" GUEST traffic, you should run them both over the same interface, and in turn, the same wire. I don't want to confuse you, but you can also allow talking between all networks and all interfaces, on either setup, simply by using appropriate firewall rules.

    So, if I were you, just to keep things simple, use just the LAN interface, and setup your VLANs in pfsense to use the LAN interface as their parent interfaces. It's the first box when you config a new or existing VLAN.


    Then, on your switch, you have to setup your VLANs correctly. When it's all setup correctly, everything should work just fine. You might have to consult your switch user manual, or online resources, to figure out the switch settings.

    The answer to your question, yes you can run multiple VLANs off of a common interface. Be warned, if they are all high-traffic networks, you're splitting up the speed of the single port between that many VLAN networks. In most home settings, this is ok to do.

    Hope that helps!


  • Thanks, yes this should probably be moved, when I saw "virtualization" I immediately thought it was for VLANs lol.

    As far as putting everything on one physical LAN interface, would that impact the performance either hardware/cpu wise or bandwidth wise on the pfsense box?

  • LAYER 8 Netgate

    All tagged VLANs on one physical interface will share the same bandwidth (probably gigabit).

    Whether that is or is not an issue depends on the traffic levels in play.

    It is often more convenient to use VLANs but you will have to decide for yourself whether you need more than one gigabit pipe for your traffic.

    If you are not moving, say, 600Mbits/sec consistently I wouldn't worry about it. Especially if your NIC drivers can use multiple cores for multiple queues.

  • LAYER 8 Global Moderator

    If you have the physical nics, and you have the ports on your switch - its better use 1 gig for each vlan since as mentioned vlans on the same physical port share the bandwidth. And if your doing intervlan routing and traffic is routing over the vlans on the same physical interface your hairpinning your traffic.

    So if you have the physical media why not use it.. If you don't have enough for all - spread your vlans out over different physical interfaces that makes the most sense for traffic flow, put some lower use vlans on the same physical for example - that don't really talk to each other if you can.

    For example my wireless vlans share the same physical interface on my router.. Since these are not even capable of gig anyway, So sharing a physical gig interface is less likely to cause a bottle neck. And wireless clients are never talking to each other with anything that would require any real bandwidth at all..

  • Thanks, yes that is why I put the quad port NIC in it, I would like to use all ports. So lets say on igb0 (LAN), I can put vlan 100 for lan mgmnt. On igb1, I can put vlan 200 for my in-law suite outbuilding. Everything on that interface/vlan will be coming from one wire and can all be vlan 200 with no access to anything else but internet. On igb2 I can put vlan 300 for guest wifi, vlan 400 for main wifi, vlan 500 for iOT and vlan 600 for a/v. The last interfance, igb3, can be future use. Does that sound ok? or am I over engineering things? Would/should each vlan have their own subnet?

  • LAYER 8 Netgate

    Yes - each VLAN will be a different broadcast domain (the whole point) so they all need their own subnets.

    Again, it depends on traffic levels, not the number of VLANs.

    I have pretty much all of my VLANs here on one 2 x 1G LACP to my switching gear.

    Some things, like the hypervisor to NAS shared storage are direct-attach for obvious reasons.

    Never give it a second thought.

  • Ok I think I understand that enough to be dangerous. Now I need assistance with configuring my LAN and VLAN100 to get internet access. For testing purposes, lets pretend my Linksys router is the cable modem. I have my pfsense WAN plugged into my Linksys router. Pfsense has a WAN DHCP of and WAN gateway of (that is the Linksys router). The LAN interface IP is, with DHCP on the same subnet. I have a PC on that VLAN that obtained address, but the PC cannot access the internet. What gateway should be on the LAN interface or what am I missing? Do I need a firewall rule to allow VLAN100 internet access across the WAN?

  • LAYER 8 Global Moderator

    @BlankSpace said in Help with physical interfaces and VLANs:

    Do I need a firewall rule to allow VLAN100 internet access across the WAN?

    You would need to create rule(s) yes - only lan gets default any rules, if you fire up another interface or vlan there will be no rules.. To get things working for testing you can just duplicate your lan rule any any with the new vlan net as source vs lan net. Once your sure things are working you can lock stuff down how you want.

  • I am not even sure the WAN side of things has internet. Should I be able to ping WAN hosts ( from the CLI shell? because I cannot.

  • LAYER 8 Global Moderator

    Well yeah pfsense needs internet to be able to give it to clients behind ;)

    Does your pfsense show its wan up, it will tell you if it can reach its gateway, even if just your other router.


    You sure when you setup your lan 192.168.200 you didn't use a /16 mask did you? if your wan mask is /24 which should be common your lan should be /24 as well - if 16 it would overlap your wan and then yeah things would have issues.

  • The WAN_DHCP gateway ( is listed as online, then there is another GW_LAN (default) ( that is offline.

  • LAYER 8 Global Moderator

    @BlankSpace said in Help with physical interfaces and VLANs:

    GW_LAN (default) ( that is offline.

    Well that is WRONG!!! you wouldn't set a gateway on your lan! I never understand how users do this - it doesn't ask you to do that... And even if you set one up, it tells you shouldn't



  • In the LAN interface config, the IPv4 Upstream gateway is listed as "none", but I think I have more problems then that lol. If I can't ping internet hosts from the WAN. Also my LAN is not

  • LAYER 8 Global Moderator

    Post up your gateways... You shouldn't have any gateways other than your wan, which I assume you got from dhcp... Your sure pfsense wan is actually 192.168.100


  • Ok I deleted the gateway. The only one now is the WAN which was from DHCP as you stated. It is listed as WAN_DHCP, WAN, Interface WAN_DHCP Gateway.

  • Something going on with the WAN tho, can't ping Internet, destination unreachable.

  • LAYER 8 Global Moderator

    @BlankSpace said in Help with physical interfaces and VLANs:


    can you you ping that? From pfsense

    You can not ping say from pfsense or you can not resolve

  • Yes I can ping that from pfsense shell and no, I cannot ping or resolve

  • LAYER 8 Global Moderator

    what about

    That is your current router?

  • @johnpoz said in Help with physical interfaces and VLANs:

    what about

    That is your current router..

    Correct, which would be the WAN gateway. Its actually a port off of a linksys LRT214 with its own vlan and subnet. If I plug my pc directly into that, I would get the same DHCP and have internet access.

  • LAYER 8 Global Moderator

    Well if you can not ping then you have something wrong with upstream.. Do a sniff on your wan while you ping - do you see it go out??


  • From the shell when trying to ping, I get no route to host. Packet capture shows:

    16:15:19 IP > ICMP echo request. id 2892, seq 3180, length 8

    16:15:19 IP > ICMP echo reply. id 2892, seq 3180, length 8

  • LAYER 8 Global Moderator

    Then you don't have a gateway setup if you don't have a default route... Post your gateways, show your routes..

    Did you get your wan via dhcp, or did you manually set it?


  • Ok, I put a USB NIC on this PC so I can copy and paste directly from pfsense. Yes the gateway was obtained from the DHCP. My routes are all weird:

    routes.png gateways.png

  • LAYER 8 Global Moderator

    Dude why do you have openvpn setup... Get the thing working before you start trying to setup pfsense as a vpn client!

    And your not going anywhere without a default route..

  • I was testing with no WAN, just using the LAN interface with openvpn, which did work just using the LAN. Shouldn't the default have been created automagically? Do I need to go System>Routing>Add and put a new static route?

  • LAYER 8 Global Moderator

    You have gateway set to auto? specifically set it to your wan gateway. Like you see in my post.

  • That would be it. I am not sure why it was set to auto, I've been playing around with so many things before I was able to create my own little network to test the WAN.

  • Thank you for all of the assistance, first time with pfsense here. So "technically" I can drop this in off my cable modem and should at least have one interface and vlan up and running.

  • LAYER 8 Global Moderator

    It should yes - keep in mind that almost always when you change something connected to a cable modem, ie swap out your router for pfsense you would have to reboot your router. I would disconnect your router... Power cycle your cable modem... Wait for it to show online, then connect pfsense and it should grab a public wan IP.. And then yeah all your networks behind should be up and running.. that have rules to allow :)

    Auto should work - but I have seen it be finicky myself sometimes.. Especially if you have something else setup as a gateway - where I saw it have a problem was when I had a downstream router setup (ie another gateway)... But if your not multiwan or whatever doesn't hurt to hard code it.

  • @johnpoz said in Help with physical interfaces and VLANs:

    ...keep in mind that almost always when you change something connected to a cable modem, ie swap out your router for pfsense you would have to reboot your router. I would disconnect your router... Power cycle your cable modem... Wait for it to show online, then connect pfsense and it should grab a public wan IP..

    Found that out last night, actually had the cable company come and replace my modem cuz it took a shit when I put it in bridge mode. It was a Pace D5001. I plan on upgrading to gig internet (500/50 now) so they gave me a docsis3.1 Arris CM8200a which is no frills bridge, easy to work with.

    Now gotta get my Netgear managed switches figured out with the VLANs and I'll be set.

  • LAYER 8 Global Moderator

    Nice... How much a bump in cost for the move to gig, and is it 1k/1k - or is it asymmetrical? I'm also on 500/50 plan - but really want the more up, down 500 is more than enough... But could use more up.. Not worth the cost bump for 1k/100 currently - if it was 1k/1k - would be all over it ;)

    Not so much the monthly cost - but my current modem won't do gig.. It handles 500 without issue, but not really looking to drop money on a new modem, and monthly bump for 50 more up... I don't need the down.. And sure wouldn't be happy paying the extra monthly if couldn't actually get the gig down, even if don't really need it ;) hehehe

    I wish they had a 500/500 plan or 500/200 would be freaking sweet! That would be a sweet spot for me...

    Enjoy your new speed and pfsense - your going to love it!

  • It'd still be 50 up which sucks. I think they also increase the total up/down max data from 4000gb to 6000gb, which I'll probably never hit anyway. I believe its around 20 more a month. I do, however, almost always get 50 up when testing.

  • LAYER 8 Global Moderator

    I'm on no cap.. So not something I would have to worry about.. I do about 2TB a month..


    But curious what the next couple of months will be like - work just put us on work from home for next few weeks. Not sure how long that will last with all this virus stuff, sure hope it gets back to normal sooner vs later..

    And all friends and family all going to be home more, etc. So sure my plex server will be seeing more traffic ;)

  • holy #)(U% that's alot! I'm in PA and the gov just shut down all schools for two weeks so I got a 6yo and 8yo who'll be home. My wife is also on work from home, she works for a hospital and they do not want anyone in the office who doesn't need to be.

  • Next question as I try to draw my future topology for the 1000th time. Management switches - the IP's of those switches only matter to be able to manage them, correct? So if my main LAN and management vlan is vl100 - ALL my managed switches should have an IP in that subnet, correct? It doesn't matter what VLANs are assigned to ports on those switches as long as one is the trunk with vl100?

  • LAYER 8 Netgate

    Generally the only layer 3 interface on a managed layer 2 switch is for management, yes.

  • @Derelict said in Help with physical interfaces and VLANs:

    Generally the only layer 3 interface on a managed layer 2 switch is for management, yes.

    So am I correct in thinking that as I go from my Pfsense box with 4 LAN interfaces, I can put each interface to separate ports on my main, lets call it my "BDM" 16 port managed switch. Then from that BDM switch, I'll go out one wire each to what I'll call my "IDE" managed switches.

  • LAYER 8 Netgate

    Just put the management interfaces for your switches on a VLAN you can access from your management workstation.

    Just like any other host you want to connect to.

    You will find different capabilities in switching gear depending on what you get. Some have to be managed on the untagged VLAN, some allow you to set the VLAN of the management interface. it depends.

    It all boils down to just setting an IP address, subnet mask, and default gateway of the management interface though. DHCP can be used if that fits with your network design.

Log in to reply