VLAN creation and internet service denial for clients
-
Hi
I am using pfsense for 3 years now having accomplished services for vpn (wireguard, openvpn), geolocation vpn, pfblocking...etc. It is a week now, after having watched and read some guides about creation of VLANS and I m having problem giving clients connecting to that VLAN access to internet.
From a hardware perspective, pfsense is installed upon a Qotom device with 4 ports (igb0, igb1, igb2, igb3).WAN is used on igb0 and lan on igb1. Switch is a Microtik one.
I have created VLAN and at the same time written down a guide so here it is......
Path for creation
Interfaces->Assignments->VLans
Click AddParent Interface: you need to know where you are going to assign it.
It can be an already used one like that of the lan.
Lets assume it will be assigned to igb2
VLAN Tag : you can assign a number from 2 - 4095. 1 is used by
default for the physical lan = VLAN1
VLan Priority : no need yet for tinkering it
Description : give a name to help you remember what it is used for like IoT
click save////////////////////////////////////////////////////////////////////////////////////////////////////////
go back to Interface/Interface Assignments and find it under Avaliable network ports
select it and click Add. Enter that interface in order to configure it.General Configuration:
Enable : tick it
Description : give it something memorable like the number of the VLan used VLAN50
IPV4 Configuration : Static IPV4Static IPV4 Configuration:
ipv4 address 172.16.50.1 / 24
click save and apply changes////////////////////////////////////////////////////////////////////////////////////////////////////////
Firewall->Rules->IoT (vlan name)
Edit Firewall Rule
Action : Pass
Interface : IoT
Address Family : IPV4
Protocol : Any
Source : Any or select the vlan
Destination : Invert match: tick it in order for the VLan can t have access to your other ones
like private for instance, else it will have (for intercommunication
leave it unchecked)Single host or alias : check that (else select any) Destination Address : Private_Networks (this means you have already created aliases for your networks Firewall/Aliases/Edit-> Network or FQDN)Extra Options:
Description : Put something descriptive (allow all for instance)
click save and apply changes////////////////////////////////////////////////////////////////////////////////////////////////////////
Create a DHCP Server for the LAN to assign addresses
Services->DHSP Server -> IoT (or whatever name you gave your VLAN)
General Options
Enable : ticked
Range : give a range for your network to assign ip addresses
save changes////////////////////////////////////////////////////////////////////////////////////////////////////////
Firewall -> NAT -> Outbound
I have it setup as Hybrid Outbound NAT rule generation. And each time i create a vlan 2 automatic rules are being created which I can t edit somehow. On top of that I create 2 additional ones based on the lan and change the interface and description.
////////////////////////////////////////////////////////////////////////////////////////////////////////
Switch connects with pfsense through port1
On the switch side, I set port 24 as a tagged one and port 23 as untagged one. They are both being assigned to the default bridge of the switch. At ports tab of the switch, I have set the PVID of port 23 as 50. So by connecting a cable from port 23 to a notebook it does get an ip for example 172.16.50.10 and as Default DHCP/DNS/Gateway it is 172.16.50.1 .That s it . VLAN50 doesn't have access to the internet.
What is missing? Maybe the Vlan50 needs to come from the same physical cable the VLAN1 does? When configure different private subnet, which is also different than that of the LAN (192.168.1.0 / 172.16..50.0) some extra configuration needed?
-
@ierosgr It looks like igb2 isn't being used before this so why use a vlan at all?
Just assign the network to igb2 and you're done.If you just want to learn about vlans, then use igb1 (LAN) and add vlan 50 to it. Then the switchport connected to the LAN port will need to be a trunk with vlan1 untagged and vlan50 tagged. Untagged vlan 50 on another port and you'll have the new vlan on that port.
-
@jarhead
Thank you for your quick reply but I dont get it. Do you mean that if a port isnt being used (used by what?) then you can t create a VLAN on that port at first place? If yes why is that?
If I can recall in Lawrence Systems channel I remember him saying if you have the spare ports use them for vlans in order to avoid unnecessary traffic to the main port.Yes I am experimenting with VLans and also tried igb1 as well before a while. Still no net access.
Also created manually 2 outbound rules except those that are automatically created.I just dont get what am I missing here
PD If i would assign the network to igb2 then i would need an extra switch to assign those ips to different clients. So no optimal solution,
-
Done it.
Its been a week and a half I m trying out things and the one thing needed none showed in any video or guide watched or followed.A damnnnnnnnnnnnnnnnn restart of the pfsense.
Both VLANs with 192.168.20.0 and 172.16.50.0 played right along. -
@ierosgr said in VLAN creation and internet service denial for clients:
the one thing needed none showed
You sure do not need a restart of psfense to create and start using a vlan..
-
@johnpoz
Probably, but only that seemed to work though....no other changes made and nothing worked until the restart. Probably a restart of a specific service could do it as well. Bug or not , my pfsense doesn t seem to work not only for vlans but for Firewall rules as well. I created a rule in order for the vlan not to be able to access the lan and didn t work. I restarted the laptop, still nothing , restarted the router still nothing, restarted pfsense and guess what,....It is not like spreading false/wrong info but if anyone else is having similar kind of problems it would be nice to know one extra thing to try out.
