Wireless with VLAN not allowing traffic
-
@johnpoz i tried doing a packet capture thru pfsense for vlan90 (i changed the PVID on the switch to an specific port) and i dont see any SYN records
i see something like this on the results:
-
@dridhas that is 1 ack.. That is all you saw?
Close your browser..
Start your sniff, make sure its set to log more than 100 packets, or limited to where your trying to go say the duckduckgo IP.
Then start up your browser and hit duckduckgo.com - if you do not see anything in pfsense.. Then no there is no way its going to work.
(i changed the PVID on the switch to an specific port)
Huh? What did you do? When you put a port access mode in say vlan 90, then yes the pvid on that port should be 90.. This tells the switch, hey when you see ingress traffic into this port that is untagged, it is vlan 90 traffic.
Some switches will auto do that for you.. But has been a while since I have played with the POS that is tplink.. The one I had is currently being used as just a dumb switch behind my tv for the tv and shield.. Have not swapped it out with the unifi flex mini I got as of yet..
-
At this point I would be amazed if this is a VLAN problem with either the switch or the access point. Yes TP-Link have produced some badly behaved stuff in the past but we have no specific reason to think these are one of them.
Layer 2 issues like that just don't present like this. It would be broken to everywhere for all layer 3 connections.
Here we are seeing some websites are not responding but, as I understand it, most are working fine. Traceroute works. Ping works (to other sites).
This is not a VLAN problem!
Like John said, work the issue. Run a packet capture on VLAN 90 and try to open one of the failing sites. Make sure you are seeing the SYN/ACK TCP handshake. If not where is it failing?
Test again but pcap on the WAN, make sure you see it there.Some websites failing to connect is usually and IP conflict (doesn't seem to apply here) or some MTU issue.
We have also seen cases where something in the AP is causing a problem. Some filtering happening there that should be disabled for example.Steve
-
@stephenw10 said in Wireless with VLAN not allowing traffic:
It would be broken to everywhere for all layer 3 connections.
exactly my thoughts.
-
@dridhas
Yep, but that doesn't rule out the AP. That's why you have to test both. -
@jknott said in Wireless with VLAN not allowing traffic:
Yep, but that doesn't rule out the AP. That's why you have to test both
im still hesitant the WAP could be the culprit as hardwired to the switch was the same scenario.
ill need to check on the MTU because somewhere i saw there was a small difference between LAN and the VLAN i created
-
@dridhas said in Wireless with VLAN not allowing traffic:
i saw there was a small difference between LAN and the VLAN i created
And why would that be? That makes no sense at all..
With a normal 1500 mtu, the actual frame size of non tagged would be 1518, with tag your total frame size would go to 1522.. But there should be no where you have to adjust for that.. You should still be using 1500 for any interface mtu set be it pfsense be it client - and I highly doubt tplink allows for adjustment anyway..
I just looked at my TL-SG108E, and there is no place to set anything about frame size or mtu.
Are you thinking this
MTU VLAN (Multi-Tenant Unit VLAN), that has zero to do with frame size or actual data mtu.. That just an example of their horrible choice of acronyms - heheh
Did you mess with that?
-
@johnpoz nope... MTU VLAN is disabled on the switch, only 802.1Q VLAN is enabled.
this is what i saw in pfsense related to the MTU
-
-
@johnpoz originally this was set to blank, i just updated to 1500
and it still shows as 1496:
-
@dridhas what interface is eu, from the mac that is a tp-link interface..
So they don't understand vlans at any level it seems ;)
-
@johnpoz just remembered, this is a USB3.0 to LAN adapter on the machine hosting pfsense LAN connection.
-
@dridhas At this point I would just junk all that tplink shit to be honest..
But yeah mtu mismatch could cause you all kinds of weird issues..
-
@johnpoz or get a new workstation that is capable of dual nics without USB adapters.
-
@dridhas just created a new VLAN under LAN and the MTU was set to 1496
i then updated the interface to use WAN and the MTU got to 1500
i have another adapter... ill swap them and report.
-
@dridhas Just swapped them out and saw this:
now the websites are accessible normally.
Only downside is that the USB-to-Ethernet adapter is 10/100 only...
-
Aha! USB NICs strike again!
It could conceivably be some hardware off-loading issue. Check the output of
ifconfig -vvvmaand see what is enabled.You probably only have VLANs on the LAN side though so one solution here could be to use em0 as LAN (with VLANs on it) and put the USB NIC as WAN.
Steve
-
@stephenw10 said in Wireless with VLAN not allowing traffic:
solution here could be to use em0 as LAN (with VLANs on it) and put the USB NIC as WAN.
Yup good idea..
So you swapped out different usb nics and 1 that does it correct with a 1500 mtu, and the other changes the mtu to 1496.. Same maker? 1 only 10/100 and other gig?
Advice - stay away from anything with the tplink name on it ;)
Just at a complete loss why they would think mtu should be changed to 1496 because of a vlan?? Man they just don't get how vlans work at all.. ;)
So running a lower mtu if same wouldn't be all that bad - but yeah 1500 on 1 side and 1496 on other interface on same network - going to be problematic for sure.
-
Mmm, I'm not aware of any chipset that cannot do 1504B but it's conceivable. It might be using the generic cdce driver that doesn't assume anything about the hardware perhaps? The boot log would show that.
Yeah setting everything to 1496 should also solve it but I would certainly try em0 as LAN first.Steve
-
@johnpoz i swapped out the cables and interfaces and got the same results... 1500 MTU on both interfaces.
More than likely the TPLink USB adapter the one at fault.one thing that i saw is that the internet speed got throttled to 100 MB where before pfsense it was 300, not sure if this is normal, still good speed tho.
