Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to permit traffic between a VLAN interface and VLAN1 (untagged) interface.

    Firewalling
    3
    3
    527
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gtissington
      last edited by

      I am very very new to this so please forgive me if I've not made myself clear below but I could sure use some help.

      I have a PFSense VLAN100 my LAN devices.

      The Managed switch (DELL2816) only allows management via the untagged VLAN (VLAN1). So, I set up an untagged vlan on PFSENSE. VLAN100 is on a truck port (Tagged VLAN100) This works for all other VLANS. However, I cannot ping from the VLAN100 (10.0.100.1) interface to the Managed switch (10.0.9.111).

      Using the PFSense Diagnostics I can ping from the ADMIN Interface (The untagged vlan 10.0.9.1) to the switch at 10.0.9.11
      Using the PFSense Diagnostics I CANNOT ping from the LAN Interface (VLAN100 at 10.0.100.1) to the switch at 10.0.9.11

      I have added "allow any" rules on both the ADMIN interface and the LAN interface. I still cannot ping from my lan to the switch on an untagged VLAN.

      How do I debug this?

      I have tremendous gratitude that you have even read this far. Please share any suggestions as to how I can figure this out.

      Thanks.

      J johnpozJ 2 Replies Last reply Reply Quote 0
      • J
        Jarhead @gtissington
        last edited by

        @gtissington Are you only trying to ping it?
        Did you set a protocol on the firewall rule?
        A lot of times people set the protocol to TCP/UDP and ping wouldn't be included there as it's ICMP. Make sure you selected ANY as protocol.

        Is the untagged vlan on the trunk port also? If so, is that vlan untagged on the switch side?
        Posting pictures really makes it easier to help.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @gtissington
          last edited by johnpoz

          @gtissington does your switch have a gateway, ie default route set? If not then no you wouldn't be able to ping from a different network..

          example. here is my switch

          sg300-28#sho ip route
          Maximum Parallel Paths: 1 (1 after reset)
          IP Forwarding: enabled
          Codes: > - best, C - connected, S - static
          
          
          S   0.0.0.0/0 [1/1] via 192.168.9.253, 9808:06:37, vlan 9                  
          C   192.168.9.0/24 is directly connected, vlan 9                           
          
          sg300-28#
          
          

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.