How to set an interface matching VLAN 1

Hakim · Jun 23, 2021, 1:47 PM

@johnpoz Thanks for your answer

Until this new appliance, in order to access my network equipment 192.168.10.10, i add a VLAN interface (VLAN 1) associated with 192.168.10.0/24.
I then add rules to restrict the access to this interface.

This only work if the traffic going out of the pfsense is tagged with 1.

Am I missing something ?

johnpoz · Jun 23, 2021, 2:30 PM

@hakim said in How to set an interface matching VLAN 1:

Am I missing something ?

Yeah the wrongly configured setup of the network tagging vlan 1 ;)

The fix here would be to change your management vlan away from 1 if you want to tag it. This is common practice on every enterprise network have ever worked on. Every customer site have ever been on, etc..

It is pretty common practice for vlan 1 to actually be disabled, or if the device does not allow it to be disabled completely remove it from every port. And use some other vlan for management, etc.

While I have seen vlan 1 tagged between switches.. The ability to do that would be dependent on the switch etc.. Not normally done..

Vs trying to tag vlan 1 leaving pfsense - I would think the smarter course of action, even if more painful would be to move away from vlan 1 for your management. Or atleast not tag it on the interface your going to connect to pfsense.

Hakim · Jun 23, 2021, 2:38 PM

Hmm, not really what I expected, but thanks a lot for your help.
At least, I wil stop spending time trying to find a solution... ;-)

johnpoz · Jun 23, 2021, 2:51 PM

Not saying its not possible, lets tag @Derelict and @stephenw10 maybe they would know if possible.

I have never looked into trying to do it - because its not done.. 30 years in the biz, been around before there was vlans ;) Never seen anyone ever tag vlan 1, especially to a router... Let alone even use vlan 1 in any sort of enterprise setup..

edit: Here you go, answer from pfsense guru/god if ever this was one

https://forum.netgate.com/post/736714

Just run away from tagging vlan id 1. Run away.

If you want to deal with untagged traffic and tag it later, set the PVID on that switch port to something other than VLAN ID 1 and tag that VLAN ID on your trunk ports.

The last time I looked, it did not seem like it was forbidden to tag with 1 but it's pretty asinine and you will probably find gear that doesn't play nicely with it.

As soon as you start tagging traffic around it is usually best to just forget VLAN ID 1 exists.

Hakim · Jun 23, 2021, 2:47 PM

@johnpoz I would have changed it since the beginning I set my network (some years ago) but I have a switch on which I cannot change the management vlan ID ... which is set to 1 ... :-/

johnpoz · Jun 23, 2021, 2:54 PM

Entry level switches almost always use vlan 1 for management. But there is no reason to TAG it.. And agree many of these types of switches do not allow for changing it.. The nonsense that is tp-link comes to mind as example... So bad they didn't allow you to even remove vlan 1 from ports.. So every port had vlan 1 on it.. They thought this was normal and ok <rolleyes> There are few posts around here discussing the POS that is their entry level switches ;)

What specific switch do you have? So I can look up its manual..

Hakim · Jun 23, 2021, 2:57 PM

@johnpoz The switch on which I cannot set the management VLAN ID is a Netgear GSS108E (I did recheck the management interface but did not find it)

johnpoz · Jun 23, 2021, 3:01 PM

@hakim said in How to set an interface matching VLAN 1:

Netgear GSS108E

Ok - why did you tag vlan 1? Just use it UNTAGGED on the port you connect to pfsense.

Vlan 1 is common native vlan, its the default.

Still at a loss to why your tagging it on the port connecting to pfsense.. Leave that vlan untagged, and tag any other vlans you want to carry over the same wire..

Hakim · Jun 23, 2021, 4:38 PM

@johnpoz In my pfSense config all the interfaces are associated with a VLAN (by default WAN is associated with VLAN 4090 and LAN with 4091 - and I have added the VLAN that I am using).

Should I create an interface on the port LAGG0 to fallback on this default VLAN 1 ?

johnpoz · Jun 23, 2021, 4:43 PM

Those are INTERNAL vlan IDs... Nothing to do with external... Create a network on an interface, not a vlan - and it will be whatever untagged traffic comes into the interface and it will leave untagged... ie vlan 1 on your switch.

Hakim · Jun 23, 2021, 5:06 PM

@johnpoz OK, thanks I will give a try