Help with physical interfaces and VLANs
-
@Derelict said in Help with physical interfaces and VLANs:
fine if This Firewall and rfc1918 cover everything you don't want them to be able to access.
Well, I don't want them accessing anything on pfs other then ping their gw. And my alias of rfc1918 includes all private networks. I think that should work?
-
@johnpoz said in Help with physical interfaces and VLANs:
So I take it they are going to use external dns?
That is what I want to happen, I want dhcp to provide external dns servers from my isp. Whether or not I have it configured that way .... 'Nother story lol
-
Regarding DHCP on my VLANs, if everything is setup correctly on the interface, dhcp server, vlan, etc., should I be able to grab an address by plugging a PC directly into that interface on pfs? I am trying to troubleshoot not getting the correct DHCP address downstream. I am only getting the main LAN address after configuring my switch port VLANs. Obviously something is not correct or it'd be working. When I plug a pc directly into the interface, I do not get any address.
-
@BlankSpace said in Help with physical interfaces and VLANs:
Regarding DHCP on my VLANs, if everything is setup correctly on the interface, dhcp server, vlan, etc., should I be able to grab an address by plugging a PC directly into that interface on pfs? I am trying to troubleshoot not getting the correct DHCP address downstream. I am only getting the main LAN address after configuring my switch port VLANs. Obviously something is not correct or it'd be working. When I plug a pc directly into the interface, I do not get any address.
Well I got it working, not sure if it's how it's supposed to be but it works. Not a pfs issue - I changed the pvid of the device port and marked it untagged on the downstream switch to match the VLAN and it got an address from that VLAN.
-
I done did it now. I somehow locked myself out of pfs except for console. I was trying to troubleshoot why one of my VLANs (100) was not giving DHCP and I found that igb0 did not have VLAN100 assigned, it was just the physical NIC under interfaces. So when I assigned VLAN100 to igb0, I no longer could access pfs. I would assume that's because I have something screwed up downstream and its not tagging my port with vl100?
Any ideas how to remove the VLAN 100 from igb0 and just have igb0 be the physical interface using the console?
-
@BlankSpace said in Help with physical interfaces and VLANs:
I done did it now. I somehow locked myself out of pfs except for console. I was trying to troubleshoot why one of my VLANs (100) was not giving DHCP and I found that igb0 did not have VLAN100 assigned, it was just the physical NIC under interfaces. So when I assigned VLAN100 to igb0, I no longer could access pfs. I would assume that's because I have something screwed up downstream and its not tagging my port with vl100?
Any ideas how to remove the VLAN 100 from igb0 and just have igb0 be the physical interface using the console?
Got pfs reverted to igb0 being the physical nic and not VLAN100 by assigning the PVID on the switch to 100, reconnecting and changing it back.
-
@Derelict I think I am starting to get this. Maybe. For purposes of this scenario, say I have 4 physical LAN interfaces on pfs. If I only have the need for 4 subnets, then really no need to VLAN if each subnet will be contained to only their physical interface? Just setup each interface with DHCP and use rules to segregate as needed? So if I have one subnet that goes to an outbuilding and in that outbuilding is a consumer Netgear wifi router with no VLAN capabilities, I would simply set that interface up with dhcp or static, no VLAN. The netgear router would be static or grab an IP from that interface and be good to go.
-
^ true... But unless your going to have these networks physically isolated on their own switches or AP, you would need to do vlans on your switches and APs. But pfsense doesn't need to know anything about that.
-
@johnpoz said in Help with physical interfaces and VLANs:
^ true... But unless your going to have these networks physically isolated on their own switches or AP, you would need to do vlans on your switches and APs. But pfsense doesn't need to know anything about that.
Thanks, yes one of the outbuildings I have is actually an "in-law" suite where my aunt resides. She uses my internet but has her own Netgear consumer wifi router. I'm going to do a direct connection to that interface on pfs. I've actually setup a little test network exactly how I want it and so far so good after working out some bugs.
-
Is it possible to find the MAC address of an IP that's listed in the firewall logs? I want to find out what this is or what machine it's coming from:
-
If you want to find the MAC address, ping the IP address and then you can check the ARP cache.
-
@JKnott said in Help with physical interfaces and VLANs:
If you want to find the MAC address, ping the IP address and then you can check the ARP cache.
It doesn't ping... it looks like its one of those default windows IP's if the machine can't get dhcp.
Pinging 169.254.196.231 with 32 bytes of data:
PING: transmit failed. General failure. -
I have no problem pinging one of those addresses on Windows 10
-
@BlankSpace said in Help with physical interfaces and VLANs:
PING: transmit failed. General failure.
That looks like you can not ping anything... Can you ping anything from that machine your trying to ping, like your gateway?
You could have issues trying to ping IP that is not on your L2.. If your on a machine that is on that same L2 network.. Give it an IP in the 169.254/16 range and then try pinging it... Or another way is just sniff the traffic on pfsense and look to the mac address in the sniff..
-
Actually, I think it's more than just the wrong L2 network. For some reason, the ping isn't being transmitted. Otherwise there'd be a message about no reply or not reachable etc..
-
Not sure guys... the machine I tried from has no issues pinging anything else. Not really a big deal, I was just curious if I could track it.
-
Does that other machine also have an address in the 169.254.0.0 /16 range? If not, of course it will fail. Also, before I posted that message, I set up a test network, between 2 ThinkPads, both with those addresses and had no problem at all.
-
@JKnott said in Help with physical interfaces and VLANs:
Does that other machine also have an address in the 169.254.0.0 /16 range? If not, of course it will fail. Also, before I posted that message, I set up a test network, between 2 ThinkPads, both with those addresses and had no problem at all.
I changed it to that range, got the same response. It might have even been the same machine because I have a test network setup and I was constantly plugging and unplugging NICs and sometimes they default to that.
-
Try a simple experiment. Connect that computer to a switch, with nothing else connected. Can you ping? You should get the normal failure, when there's no reply. If you're still getting that transmit error, you have something wrong with that computer. As I mentioned, I have no problem pinging those 169.254.x.y addresses.
-
Which is why I asked you if you could even ping your gateway for the network you actually on.
When you set an IP in the 169.254 range can you ping?
example
$ ping 169.254.100.200 Pinging 169.254.100.200 with 32 bytes of data: PING: transmit failed. General failure. PING: transmit failed. General failure. PING: transmit failed. General failure. PING: transmit failed. General failure.Give myself an address.
$ ipconfig Windows IP Configuration Ethernet adapter Local: Connection-specific DNS Suffix . : IPv4 Address. . . . . . . . . . . : 192.168.9.100 Subnet Mask . . . . . . . . . . . : 255.255.255.0 **IPv4 Address. . . . . . . . . . . : 169.254.10.20** Subnet Mask . . . . . . . . . . . : 255.255.0.0 Default Gateway . . . . . . . . . : 192.168.9.253$ ping 169.254.100.200 Pinging 169.254.100.200 with 32 bytes of data: Reply from 169.254.10.20: Destination host unreachable.
