Port tagging on APU2?
-
On my APU2 box there is no Switch GUI in the Interfaces menu. How do I take the LAN port with a VLAN?
Many thanks -
@orangehand
https://forum.netgate.com/post/944426 -
Forgive me if I am being stupid but I don't understand what you are specifically pointing me to.
I get that you:
Create VLAN
Add it to an interface
Add a DHCP server to it
Add a pass rule
But then you have to tag the LAN network port don't you?On the Sg-1100 I set up yesterday there was a switch submenu in Interfaces where you added the tags. On my APU2 box there isn't a switch submenu so where do I do the tagging?
-
@orangehand said in Port tagging on APU2?:
But then you have to tag the LAN network port don't you?
pfSense can do tagging on an interface, meaning you can transport several vlan(s) data ... down the same wire.
But i'm not sure if you can do something like "native vlan"On a switch you can make an interface an untagged member of a VLAN.
That i'm not sure you can do on a "Non-Switch interface" ..
I know of no way to do it.I describe a bit aboyt tagging here
https://forum.netgate.com/post/944383On the Sg-1100 I set up yesterday there was a switch submenu in Interfaces where you added the tags. On my APU2 box there isn't a switch submenu so where do I do the tagging?
You might want to start with what you want to achieve here.
/Bingo
-
I just want to get a guest VLAN working. The devices get an IP via the tagged SSID on Unifi, but no traffic passes
-
image url) -
Do they get an ip belonging to Guest Vlan , or Lan ?
If you have Lan & Guest Vlan on the same IGB1 port , how do you connect both the Lan devices and the Unifi AP ... (To the same port) ??
-
Guest VLAN
-
Don't you have a spare port in the APU , for the Unifi ?
How do you connect that APAre you using a switch also ?
Right now you are transporting on (IGB1)
LAN - Untagged
Guest - Tagged Vlan20It should work for your wifi ...
But how do you connect LAN devices ??
-
I want the untagged normal traffic AND the tagged VLAN traffic to be sent to the switches and the APs, and just the guest access via Wifi by choosing the relevant SSID (if that make sense!)
-
If you have setup a switch correct to receive untagged (lan) and Tagged vlan20,
that would make sense.Then you have another switch port where the unifi is connected ?
Are you running tagged vlans to the Unifi (ssids)
-
@orangehand said in Port tagging on APU2?:
I just want to get a guest VLAN working. The devices get an IP via the tagged SSID on Unifi, but no traffic passes
I recently set up a Unifi AP with pfsense on an old computer. I had previously set it up for another AP, but it works the same. You add a VLAN to the pfsense interface and use the same VLAN ID at the AP. If you have a managed switch in between, you will also have to configure the same VLAN on the ports connected to pfsense and the AP.
-
That is already set up - Guest SSID with a VLAN tag of 20. A device connected to that SSID gets an IP from the right DHCP pool, but the traffic doesn't get out of the LAN, hence it's useless!
-
@orangehand said in Port tagging on APU2?:
That is already set up - Guest SSID with a VLAN tag of 20. A device connected to that SSID gets an IP from the right DHCP pool, but the traffic doesn't get out of the LAN, hence it's useless!
I suppose you mean WAN ??
Can you ping the pfSense Guest interface from a Wifi client ?
Can you ping 8.8.8.8 -
@orangehand said in Port tagging on APU2?:
That is already set up - Guest SSID with a VLAN tag of 20. A device connected to that SSID gets an IP from the right DHCP pool, but the traffic doesn't get out of the LAN, hence it's useless!
Here's what I have for my rules:
These work well. They block the guest from accessing anything on my network, other than pinging the VLAN3 interface.
-
@bingo600 Yes, I meant out from the LAN to the WAN
-
We are talking about the WiFi clients , that cant access the internet ??
Or did you mean LAN ? -
@JKnott I'm pretty sure it isn't rules that is the issue. Yours are simply rather more elegant versions of mine! I still cannot get onto the Internet from the guest vlan
-
@orangehand
And you're sure it's not an DNS issue ?can you ping : dns.google.com
does it resolve ?Can you ping : 8.8.4.4
-
@bingo600 Yes, Wifi clients. (sorry for delay - it's not letting me post more than once every 2 mins)
-
@bingo600 DNS from DHCP is 1.1.1.1 and 9.9.9.9 and I cannot ping 8.8.8.8 from the Guest SSID, but can from the untagged SSID
-
Can you ping the wifi def-gw (the pfSense Guest interface) from a wifi device ?
If you disable the "bloc access to lan" rule on your wifi nterface , can you ping lan devices ?
-
@orangehand said in Port tagging on APU2?:
@bingo600 Yes, Wifi clients. (sorry for delay - it's not letting me post more than once every 2 mins)
Just gave you 3 likes ... Think your (now) 5 , makes that limit go away
-
@orangehand said in Port tagging on APU2?:
@bingo600 DNS from DHCP is 1.1.1.1 and 9.9.9.9 and I cannot ping 8.8.8.8 from the Guest SSID, but can from the untagged SSID
Take things one step at a time. Can you ping your VLAN interface by IP address, not host name? The WAN port? The ISP's gateway? If those work then your routing is set up correctly. If you then try something like google.com, and it works, then your DNS is OK. This is how you troubleshoot a problem. Otherwise, we have to guess and make suggestions.
-
I suppose JKnott is taking over here
He's repeating most of what i suggested -
No, just making sure he's not missing anything.
-
Since you don't get the pfSense box as DNS servers on your WiFi clients , you must have changed the default DHCP Server settings.
You haven't changed the DHCP Server Gateway option , have you ?
-
@bingo600 No -
And to follow your checklist, I can ping the VLAN gateway when on the VLAN SSID. I cannot get any further than that.
-
Did you try to remove/disable the LAN block rule on the Guest Vlan ?
Can you then ping the Lan IF , and/or a Lan device ?Something is fishy ....
Smells of missing or wrong def-gw.But if you havent touched Anything besides what you have posted in the
dhcp screenshot.PfSense should hand out the interface address as def-gw.And that you can ping.
Hey ...
That screenshot is not DHCP Server , that's the IF
You haven't set any upstream gw on the if ... have you
Dooh missed it was set to none -
@bingo600 I removed the custom DNS addresses from the DHCP server and that made no difference. What I am wondering is why the SG-1100 has a switch submenu in Interfaces to enable port tagging, and this APU2 does not. Might that be the crux of this?
-
@orangehand said in Port tagging on APU2?:
@bingo600 I removed the custom DNS addresses from the DHCP server and that made no difference.
I expected that , as your DNS servers are on the INET , and INET can't be reached.
What I am wondering is why the SG-1100 has a switch submenu in Interfaces to enable port tagging, and this APU2 does not. Might that be the crux of this?
Nope .. I'm running a Unifi on a pfSense wo. switch menu , and JKnott does the same (see further up).
Your tagging is working , since you get a Guest Ip address (in Vlan 20)
Post a picture of your DHCP Server settings for Guest
You don't have any group or floating rules , do you ?
-
@bingo600
Anything not shown is default -
Then something is fishy ....
Did you remove the Lan block rule , and tried to ping lan IF and maybe a lan device.
Edit:
Now that you have removed the 9.9.9.9 & 1.1.1.1 as DNS , can you resolve DNS now?
I mean what does ie. ping dns.google.com show ?
Does it resolve like here , where it resolves to 8.8.4.4
$ ping dns.google.com PING dns.google.com (8.8.4.4) 56(84) bytes of data. -
@bingo600 Yes. I can ping devices on both subnets from the guest subnet when that rule is disabled
-
-
@orangehand
Then def-gw ought to be set correct.Can you ping the WAN IF ?
How is your outbound NAT set ?
Do you have "Auto created XXX to wan" for all the interfaces ?
Especially look at Guest , if it's missing there
Maybe post a screenshot
-
Did you get this solved ?
-
@bingo600 No. Here is the Outbound NAT screenshot:
-
@orangehand said in Port tagging on APU2?:
I need to go out to dinner now. Any further thoughts much appreciated!
I like pizza.
-
@orangehand said in Port tagging on APU2?:
On the Sg-1100 I set up yesterday there was a switch submenu in Interfaces where you added the tags. On my APU2 box there isn't a switch submenu so where do I do the tagging?
Just for anyone else wondering: SG1100, 2100, 3100 and 7100 have built in Switch chipsets! Those ports are actually switched internally that's why they have a special pfsense version from Netgate to include the config of said switch chip. You don't have that on any other hardware!
Other than that @JKnott and @bingo600 seem to have things under control, wouldn't want to intrude and confuse everyone :)
