How to get pfSense WAN to accept VLAN 0
-
@stephenw10 said in How to get pfSense WAN to accept VLAN 0:
Try running a packet capture on the parent interface and see what's actually being tagged.
Hi Steve, when you say "parent interface" are you refering to the "WAN Interface"?
-
No I mean the hardware NIC that ng0 is on. So probably igb0 but it's whatever you are using for WAN.
-
@stephenw10 said in How to get pfSense WAN to accept VLAN 0:
No I mean the hardware NIC that ng0 is on. So probably igb0 but it's whatever you are using for WAN.
Steve,
I did a small captur eof the WAN, see attached PCAP....I am not a WS expert, perhaps you or someone from the board can make more sense than me out of it.packetcapture.cap -
There are no tagged packets in that pcap so either the script is not working as expected or the pcap is in the wrong place or maybe just unable to show that.
Are you able to repeat that in 2.5.2, where it's known to work, so we can check the pcap shows what we think it should?
Steve
-
-
@cucu007 using 2.5,2 the vlan 0 script appears to be working, hope someone can get this working for 2.6.0, I am hoping someone can get this going for us wanting to mvoe to 2.6.0 or even 2.7.0 snapshot.
-
Hmm, no VLAN tags shown there either. But there we see only inbound traffic and only outbound in 2.6.
How exactly are you capturing that?
-
Steve,
I basically went to the GUI and click on start full capture then a proceeded to do a IP release/renew in the WAN interface then proceeded to stop the capture and uploaded the PCAP file to the forum for review. -
But which interface? Did you enable promiscuous mode? Was it filtered?
-
@stephenw10 said in How to get pfSense WAN to accept VLAN 0:
But which interface? Did you enable promiscuous mode? Was it filtered?
I didnt enable promiscuous mode, I only did the capture on the WAN interface (igb0). So far in release 2.5.0 is working, but if at all possible I would like to get this running on 2.6.0 or even the upcoming 2.7.0 release.
-
I kind of expect netgraph to put the NIC in promiscuous mode anyway but if it doesn't you'd need to set that.
When you run the script WAN should be assigned as ngeth0 but you need to pcap on igb0 directly to see the tagged traffic. So if it isn't already you'd have to assign/enable it and then pcap there via the GUI. At the CLI you can just capture on igb0 directly.As far as I know netgraph should work equally well in 2.5, 2.6 or 2.7, the only thing that has changes in the igb driver. So it should work in 2.6 with the alternative Intel driver. It might work in 2.7 with either driver since the apparent issue is fixed there. But AFAIK we haven't seen confirmation of that.
Steve
-
@stephenw10
Hi Steve,
I did a small packet capture, see attached....I was uanbel to get this going on 2.6.0, hope you or someonecan shine some light on this pending item. Thank you.packetcapture (1).cap -
Hmm, still doesn't show any tagged traffic. I assume that was taken in 2.5.2 when it was connecting as expected?
-
Yes, I had to rollback to 2.5.2 in order to get things moving...I tried just about everything in 2.6.0 and 2.7.0 to get it working, nothing works for me on those releases unfortunately. Please advise.
-
Well we need to way to capture the vlan0 tagged packets so we can then be sure what's happening in 2.6 or 2.7.
We know it should work in 2.6 with Intel's non-iflib driver since others are successfully using that with pfatt.
We are yet to hear from anyone running either script that it definitely works or doesn't work in 2.7.Steve
-
@stephenw10 Have we made any additional progress on getting this issue fix permanently for those of us using Fiber (AT&T and Frontier)?
-
No. One of our staff uses pfatt and he tested it in a 2.7 snapshot but hit other issues trying to run the script there. The way netgraph handles opening connections changed.
The script here though doesn't require any of auth stuff that pfatt does, it only creates VLAN0 tagged traffic so may work, I haven't heard either way.A better solution there would be to just add priority tagging to FreeBSD. That's not immediately straight forward though because of the security implications.
In order to upstream something like that we would need clear evidence of a real world use case so the more people who can add their names to the open bug report for this the better.
https://redmine.pfsense.org/issues/12070
Steve
-
Try to put pfsense into a VM and run VLAN tagging on the WAN interface using VLAN 0.
Then see if it works.
-
@stephenw10 I can confirm it doesn't work in 2.7 on both igb0 and em0.
I did a clean install to 2.5.2 confirmed everything was working and then upgrade to 2.7.0. (Note: After the upgrade, it asked me for my default WAN and LAN again which were already set to igb0 and em0.)
Received the following error on both when running the vlanzero script:
===groupFatal error: Uncaught Error: Call to undefined function pfSense_ngctl_attach() in Command line code:1 Stack trace: #0 {main} thrown in Command line code on line 1 === -
@c45p32 said in How to get pfSense WAN to accept VLAN 0:
@stephenw10 I can confirm it doesn't work in 2.7 on both igb0 and em0.
I did a clean install to 2.5.2 confirmed everything was working and then upgrade to 2.7.0. (Note: After the upgrade, it asked me for my default WAN and LAN again which were already set to igb0 and em0.)
Received the following error on both when running the vlanzero script:
===groupFatal error: Uncaught Error: Call to undefined function pfSense_ngctl_attach() in Command line code:1 Stack trace: #0 {main} thrown in Command line code on line 1 ===I am stuck on 2.5.2 for now until this is sorted out by the pfsense crew.
I hope we get some pfsense developer to work on this prior to 2.7 release. I miss working under 2.6 and would hate to go back to work under openwrt, pfsense is my favorite FW.
