Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Quad port Pfsense box - no switch VLAN setup help

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    14 Posts 4 Posters 1.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pbshaan
      last edited by pbshaan

      Hi,

      Trying to setup a new pfSense machine with quad port Intel NIC. First installed pfSense without any VLAN setup as follows. Connected laptop directly to LAN port, able to ping pfSense machine, have internet - all good.

      WAN - igb0
      LAN - igb1

      Now, I want to create VLANs based off the LAN interface. Following online resources, I created a VLAN with the configuration as shown in this screenshot -- https://drive.google.com/file/d/1rHEEVzGWMUkSq5yVCTQ-7-C4Ky41tKm1/view?usp=sharing

      Then on my laptop, I created two static connection profiles.

      1. Static IP - 192.168.1.2 -- connect to LAN -- everything works.
      2. Static IP - 192.168.10.2 -- connect to VLAN -- can't ping pfSense box, no internet.

      I'm not sure why the 2nd profile doesn't allow me to reach anywhere. I went through forum questions and found many have managed switch added to the mix. I assume, it should be doable with the single standalone machine too w/o the managed switch.

      • Is my understanding - machines assigned different static IP to put them on appropriate VLANs - correct ?
      • Also, is testing via a laptop (static IP assignment) correct, or does the laptop also needs to understand the VLAN tags etc.?

      Any help/pointer is appreciated. Thank you.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        A pass any rule is automatically placed on LAN. If you create new interfaces, you must create rules on those interfaces to pass any traffic.

        You can use the LAN rule as a model.

        Yes, the laptop would need to tag and be prepared to receive tagged traffic.

        On a mac:

        8bb099dc-6451-4bbf-8991-4527e8fdd161-image.png

        f1bf6a93-811c-4cd5-8eff-aba3512dcffb-image.png

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • P
          pbshaan
          last edited by

          Thank you for the quick reply @Derelict.

          I do have the firewall rule setup on OPT1 (mimicking the LAN rule - last section in my Google Drive hosted screenshot).

          I was testing on a Linux laptop, would give it a try on the Macbook and share results.

          1 Reply Last reply Reply Quote 0
          • O
            orangehand
            last edited by

            Do you not have a Switch config page in Interfaces either? I think I'm facing the same issue on an APU2 box where I cannot work out how to add the vlan tag to the LAN interface

            bingo600B 1 Reply Last reply Reply Quote 0
            • bingo600B
              bingo600 @orangehand
              last edited by

              @orangehand

              https://forum.netgate.com/post/944426

              If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

              pfSense+ 23.05.1 (ZFS)

              QOTOM-Q355G4 Quad Lan.
              CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
              LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by Derelict

                Interfaces > Assignments - Add the VLAN to the physical interface
                Interfaces > Assignments - Create the interface using the select list at the bottom
                Edit the interface, enable it, number it
                Put the desired firewall rules on the new interface
                Enable DHCP servers, etc.
                If you have (for some reason) enabled Manual Outbound NAT, add rules for the new interface's source addresses.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                O 1 Reply Last reply Reply Quote 0
                • O
                  orangehand @Derelict
                  last edited by

                  @Derelict This is my interfaces list: Screenshot 2020-11-28 at 17.50.03.png

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by Derelict

                    OK?

                    You should see the VLAN in the Available network ports at the bottom like I described. Select it and hit add.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    O 1 Reply Last reply Reply Quote 0
                    • O
                      orangehand @Derelict
                      last edited by

                      @Derelict Nope!
                      Screenshot 2020-11-28 at 19.29.47.png

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Then you haven't added the VLAN to the interface. Use the VLANs tab at the top of that page.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        O 1 Reply Last reply Reply Quote 0
                        • O
                          orangehand @Derelict
                          last edited by

                          @Derelict Screenshot 2020-11-28 at 19.40.36.png Not sure what else I can do beyond this!

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            If you want to use VLAN 20 on the GuestNet interface you have already done that. Click on GuestNet, enable it, number it, add rules, DHCP servers, etc.

                            Whatever is connected to igb1 will need to be expecting traffic tagged with VLAN 20.

                            Tagged traffic will be on GuestNet. Untagged traffic will be on LAN.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            bingo600B 1 Reply Last reply Reply Quote 0
                            • bingo600B
                              bingo600 @Derelict
                              last edited by bingo600

                              @Derelict

                              Dual topic ... See here
                              https://forum.netgate.com/topic/158698/port-tagging-on-apu2

                              I think it must be outbound nat , or something really weird.

                              Edit: He gets a Vlan20 (Guest ip) on his wifi guest.

                              He can (via Guest WiFi) ping Guest IF , he can ping devices on his Lan (def-gw works)
                              He cant ping 8.8.8.8 , or anything on INET

                              /Bingo

                              If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                              pfSense+ 23.05.1 (ZFS)

                              QOTOM-Q355G4 Quad Lan.
                              CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                              LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                              1 Reply Last reply Reply Quote 0
                              • P
                                pbshaan
                                last edited by

                                @Derelict - It worked as expected on the Macbook (must be config issue on my Linux laptop). Thanks.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.