New VLAN - no internet
-
Hello, trying to get a VLAN working on an SG 3100 running the latest pfSense (22.01-release). I've read the docs and think I have everything set up correctly; however, a laptop connected to the VLAN port on my switch gets an IP address, but cannot connect to anything; not even pinging the gateway.
I created the VLAN like this:
-and-
And set up the DHCP table:
This is where things started to get a little iffy... when defining the VLAN in the "Switch" menu, the ONLY way I can get an IP on the laptop connected is by checking ON the "Tagging" on port 3 (managed switch is plugged directly into LAN3):
If I UNCHECK "tagged" on member port 3, I can never get an IP address on the laptop.
Ports is defined as:
Firewall rules should be letting everything flow (I'll lock these down much tighter once I get the VLAN actually talking):
And finally, outbound NAT:
Not sure where to look next. Any suggestions would help immensely!
Thanks in advance!
-
@skippythemagnificent Click on the PVID "1" for port 3 and change it to "20" and then click Save and try again. That will allow untagged traffic on port 3. if you want tagged traffic on port 3 you need to go to the VLANs tab on the Switch configuration page to permit it.
https://docs.netgate.com/pfsense/en/latest/solutions/sg-3100/switch-overview.html
-
@rcoleman-netgate
I have both tagged and untagged traffic coming through port 3 on the netgate. The switch connected to it has 2 ports configured for the VLAN 20, and 2 defaulted to VLAN 1 (untagged). So, changing the VID to 20, will that block the untagged traffic? Would that also allow me to uncheck the "tagged" value in the VLAN member port? -
@rcoleman-netgate Changing the PVID worked. But I still need to keep the member port set to "tagged" in order for it all to work. At least, things are working now, so I'll leave well enough alone. Thank you!
-
@skippythemagnificent You shouldn't have it tagged if the only thing on it is untagged... but you do have to have the assignment made.
There's a lot of data in this ticket so if you said you have a 802.1Q switch on that interface or other tagged device then that would make sense.