Wireless with VLAN not allowing traffic

stephenw10

It's not a switch or VLAN issue. Clients are getting a DHCP lease in the correct subnet.

It's probably not a firewall issue either now that you have added a rule with the correct source.

What happens when you try to visit one of these sites? What is the exact error you see?

Steve

johnpoz

@stephenw10 he said " i dont get any ip addresses"

So who knows what he has going on or how he is setting it up... If he had 1 untagged and 90 tagged on the wap port, and he plugged just a PC into that port - then he should of gotten an IP on whatever the untagged vlan network is.. 192.168.20 I believe..

dridhas

@johnpoz this is the result of the nslookup on wifi/lan via VLAN90

and this is the error message on the browser:

stephenw10

@johnpoz said in Wireless with VLAN not allowing traffic:

@stephenw10 he said " i dont get any ip addresses"

But that's only when VLAN 90 is untagged, which is expected.

When it's tagged correctly it gets an IP. And we can see the client is able to connect to the VLAN 90 interface address and resolve those FQDNs.

So that looks like not DNS or the switch or anything vlan related.

Do you see the same thing with different browsers?

Can you traceroute to uber.com? Or ping it?

Steve

johnpoz

@dridhas well your clearly resolving them - but how ever your setup is borked if you ask me.. If you were asking unbound running on pfsense directly. It should resolve your pfsense name, not come back unknown.

like so

> duckduckgo.com
Server:  sg4860.local.lan
Address:  192.168.9.253

Non-authoritative answer:
Name:    duckduckgo.com
Address:  40.89.244.232

But that error is time out error.. So you looked it up, got an IP - and I show the same IP for duckduck.. So now you need to figure out why your having time out getting an answer. I would first sniff on wan and make sure traffic went out or not.. If you don't see it go out, then sniff on your pfsense lan side interface.. Do you see it get there? If so then pfsense should of sent it out..

dridhas

@stephenw10 ping does not work, im guessing uber has ICMP disabled.
on Edge i see something similar:

here are the results of tracert:

This is ping:

stephenw10

Hmm, interesting. That all looks OK.

And, to be clear, if you connect that same client to the LAN you can then reach those sites as expected?

dridhas

@stephenw10 yes, i can access it normally when im on the LAN network.

i ran a traceroute while on LAN and these are the results.

The only difference is the first hop:

JKnott

@dridhas said in Wireless with VLAN not allowing traffic:

im getting hardwire to port1 where the WAP was and im getting a non-vlan ip.

Any chance you have a TP-Link switch? Some models have problems with VLANs.

johnpoz

@dridhas said in Wireless with VLAN not allowing traffic:

im guessing uber has ICMP disabled.

yeah it doesn't answer ping here either

Pinging uber.com [104.36.195.150] with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

And again - so troubleshoot the problem - does pfsense see/send the syn to where your trying to go, does it send it on? This is 30 seconds of sniffing (packet capture) to see what is happening.

Pfsense doesn't care if the traffic it sees is tagged or not tagged.. It sees traffic - it sends it on or it doesn't..

You need to validate that pfsense sees the syn to whatever IP your trying to send to, and if it sends it on and gets and answer or doesn't - be it that traffic pfsense sees is tagged or not tagged has nothing to do with it.

dridhas

@jknott i do... the model is TL-SG108PE, also the WAP is TPLINK model EAP225

johnpoz

@dridhas said in Wireless with VLAN not allowing traffic:

TL-SG108PE, also the WAP is TPLINK model EAP225

Both complete and utter POS! that have zero clue to what vlan is ;) heheheh

Yeah no wonder your having problems..

dridhas

@johnpoz oh my… I’ve had TPLink before and had no issues… this is the first time I’m having one that can do vlans and poe.

johnpoz

@dridhas search - there are many threads here even that talk about their complete lack of understanding of how vlans work.

But looks from what you posted that you could remove vlan 1, before they had an issue where you could not remove vlan 1 from ports. So on ports where you only wanted vlan X, there was still vlan 1..

I would get other gear.. Can you return that hardware?

dridhas

@johnpoz I could… what would y’all recommend that won’t leave me bankrupt?
Both devices need change (wap/switch)?

also, I was able to use the vlans desired on each port, as long as the nic I was using had that vlanid

JKnott

@dridhas said in Wireless with VLAN not allowing traffic:

@jknott i do... the model is TL-SG108PE, also the WAP is TPLINK model EAP225

I had a TP-Link AP that didn't handle VLANs properly but replaced it with a Unifi AP. I also have a Cisco switch and both devices are fine with VLANs.

In my case, the IPv6 multicasts were crossing from the main LAN to the VLAN, causing devices on my guest WiFi to get the wrong address.

dridhas

@jknott imma take a wild guess and say the AP is working fine and that the switch is the one having the issues with the hard coded vlan1

JKnott

@dridhas

Given TP-Link's history, I don't know that you can say that. However, try just the switch and see what happens. Or temporarily connect only the AP to pfsense and try that.

dridhas

@jknott ive connected directly to the switch using a cable and its the same behaviour for both VLANs... something's fishy with the switch

dridhas

@johnpoz i tried doing a packet capture thru pfsense for vlan90 (i changed the PVID on the switch to an specific port) and i dont see any SYN records

i see something like this on the results: