VLAN not working in simple test.

akke023

Hi everyone, I've been trying to setup VLANs on the Pfsense, but without any luck.
I'm not per se a newbie to this, so I'm really puzzled, hopefully someone can help me out.

Here's the situation:
I'm trying to perform a simple test.
Plug in my pc on port 1, and be able to reach the devices VLAN 10 IP.
For this I have done the following:

Created VLAN10 under "Interfaces/VLANs"
Added the new interface under "Interfaces/Interface Assignments"
Created a DHCP scope for the new VLAN
Copied LAN firewall ruleset to the new VLAN10.
Added VLAN10 to the switch ports under "Interfaces/Switch/VLANs"
Added port 1 to VLAN10
NOTE: I tried checking and unchecking the "Tagged" checkbox, neither worked, currently unchecked, as I assume this to be "untagged".
Removed port 1 from VLAN1. To avoid mixing things up.
-> At this point, no result.
Added PVID 10 to the corresponding port 1 under "Interfaces/Switch/Ports"
-> Still no result.

I wish I could post screenshots but I get a parsing error doing so.

I would expect it to go like this:
-> PC connects to the Pfsense port 1
-> Pfsense tags this as VLAN10, since the PVID is set to 10. And the vlan not checked as "tagged" meaning it is set as "untagged".
-> Pfsense recognizes that the client is in VLAN10, and assignes it a VLAN10 DHCP adress.
-> Client can access VLAN10.

However, even when setting my IP as static, I can not connect to the pfsense in any way.
The pfsense packet capture does not recognize any traffic on the VLAN10 interface.
The client's wireshark does not get response to the DHCP Discovery.

I am at a loss right now, as I have never stumbled on a VLAN issue like this, even with our netgear switches I do not have any issue setting them as untagged, pvid 10, and tagged on the trunk line.

Any help would be appreciated! Thanks in advance!

viragomann

@akke023 said in VLAN not working in simple test.:

Copied LAN firewall ruleset to the new VLAN10.

And changed the source to VLAN10 net?

Added VLAN10 to the switch ports under "Interfaces/Switch/VLANs"

Obviously you're talking about a specific Netgate hardware. Do you tell us which?

johnpoz

@akke023 said in VLAN not working in simple test.:

Copied LAN firewall ruleset to the new VLAN10.

There is also some issue with copied rules and not creating an updated ID for them, etc.. Have to dig up specifics - but do recall seeing some issues with "copy" of rules.. Pretty sure resolved in say 23.01 and believe latest 2.7 snaps.. But yeah that is something to look at..

akke023

Thanks for the fast response guys!

@viragomann said in VLAN not working in simple test.:

And changed the source to VLAN10 net?

Yes, here is the ruleset:

@viragomann said in VLAN not working in simple test.:

Obviously you're talking about a specific Netgate hardware. Do you tell us which?

I should've included this, my bad. The device I'm using is the Netgate 2100.

@johnpoz said in VLAN not working in simple test.:

There is also some issue with copied rules and not creating an updated ID for them, etc.. Have to dig up specifics - but do recall seeing some issues with "copy" of rules.. Pretty sure resolved in say 23.01 and believe latest 2.7 snaps.. But yeah that is something to look at..

I tried making them from scratch but no result.
I can't seem to update to 23.01. Currently running 22.05.

Enter an option: 13

>>> Updating repositories metadata...
Updating pfSense-core repository catalogue...
pkg-static: https://repo00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/meta.txz: Service Unavailable
repository pfSense-core has no meta file, using default settings
pkg-static: https://repo00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/packagesite.pkg: Service Unavailable
pkg-static: https://repo00.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-core/packagesite.txz: Service Unavailable
Unable to update repository pfSense-core
Updating pfSense repository catalogue...
pkg-static: https://repo01.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-pfSense_plus_v23_01/meta.txz: Service Unavailable
repository pfSense has no meta file, using default settings
pkg-static: https://repo01.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-pfSense_plus_v23_01/packagesite.pkg: Service Unavailable
pkg-static: https://repo01.atx.netgate.com/pkg/pfSense_plus-v23_01_aarch64-pfSense_plus_v23_01/packagesite.txz: Service Unavailable
Unable to update repository pfSense
Error updating repositories!
>>> Locking package pkg... done.
ERROR: Unable to compare version of pfSense-repo

Update from WebUI gives me the following:

SteveITS

@akke023 if you’re trying to make them independent ports that is here:
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html

Upgrades to 1100/2100 have been paused due to a bug apparently affecting older models with a small EFI partition, resulting in not booting and a firmware reinstall.

You can change the update branch to Previous (or whatever shows 22.05 now) if you need to install packages.

akke023

@steveits said in VLAN not working in simple test.:

if you’re trying to make them independent ports that is here:
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html

Tried that, and my config looks exactly like that, let me show you, now that screenshots work:

(Last image wouldn't paste, but i've got PVID of port 1 set to 10, all other are still at default 1.)

I would assume that in this case, all traffic on port 1 should be tagged as vlan 10, but for port 2 vlan 10 is allowed, but not tagged onto untagged packages.
This was so I could test both senarios, but I don't get anything...

@steveits said in VLAN not working in simple test.:

Upgrades to 1100/2100 have been paused...

Thanks for that.

akke023

@akke023 said in VLAN not working in simple test.:

(Last image wouldn't paste, but i've got PVID of port 1 set to 10, all other are still at default 1.)

viragomann

@akke023 said in VLAN not working in simple test.:

I would assume that in this case, all traffic on port 1 should be tagged as vlan 10, but for port 2 vlan 10 is allowed, but not tagged onto untagged packages.

Not clear, why you've added port 2 to the VLAN, but you will have to add port 5 as tagged, since this is the uplink to the kernel.

NightlyShark

@akke023 Sorry to bump in, but:
If you want to push all VLANs through another port (to another switch or whatever), what is called a 'trunk', you need to have VLAN 10 in port LAN untagged, and set the PVID (port ID, which is the VLAN ID tag the switch slaps on packets from PC to switch) to 10

If you want your PC to use 802.11q VLAN frames (for test cases), you need to set port LAN VLAN ID 10 as tagged and PVID as 1 or none (I don't own a netgate device, so I haven't configured a switch on pfsense, so I don't know)

So, to sum up:
Port VID -> what the switch slaps on incoming packets
VLAN Tag -> what must be slapped on outgoing packets in order to leave through the LAN port, in esense, what VLANs the port sees
Tagged/Untagged->If the VLAN ID in question is seen on the packets by the devices connected on the port in question (LAN), that is tagged (the tag is untouched) or if the tag for that VLAN is invisible to the device on the port in question (LAN), that is untagged (the device on the port has no idea the VLAN exists, as all tags for that VLAN are removed and the device connected on the port sees only a normal LAN, or a normal LAN and some VLANs, if you have other VLANs tagged on that port)

Also, I think @viragomann has a point and I think you need to consult the documentation for:

PfSense Switch configuration
PfSense VLAN configuration
PfSense Layer3 switching - kernel handling of VLANs

akke023

@viragomann said in VLAN not working in simple test.:

Not clear, why you've added port 2 to the VLAN

So that I could see if maybe I could let the tagging of the vlan happen on another device.
eg. on my client/switch I could set a vlan 10 for my device, the pfsense should see this, and since port 2 tagged in vlan 10, I should be able to access vlan 10 also.
Either way, neither way work, lol.

@viragomann said in VLAN not working in simple test.:

but you will have to add port 5 as tagged, since this is the uplink to the kernel.

This is the way!

I realize now it was right in my face all along...
But I guess after staring yourself blind on a problem you start missing things...

So I'd like to thank you all for the help!
Consider this one solved guys!

Just need to add port 5! For some reason my mind did not register the fact this was not a physical port...