[Solved] Issues switching the 2100-switch to 802.1q mode

stephenw10

Yes, port 5 is the uplink port in the 2100.

If you created a new interface for the VLAN then you would only get dhcp by default unless you add rules. Only the LAN interface has any default rules to pass traffic. Including to pfSense itself.

Steve

furom

@stephenw10 said in Issues switching the 2100-switch to 802.1q mode:

Yes, port 5 is the uplink port in the 2100.

If you created a new interface for the VLAN then you would only get dhcp by default unless you add rules. Only the LAN interface has any default rules to pass traffic. Including to pfSense itself.

Steve

Ah, but it then sounds like I wasn't so far off as I first thought! Question then would be what minimum rules I would need to add, I would hate to have to redo it all again - I haven't found a way to do this and keep it up at the same time...

My goal with this is to setup two ports on the 2100, one that has my mgnt lan untagged (to connect my Unifi switches), and then on these map/untag vlans to ports as needed. The other one to connect directly to storage (NAS). Does that sound like a sound way of doing it, or would there be better ways (working even, if this won't) :)

SteveITS

@furom Re: rules, it depends on what you want to allow. Maybe:

Allow DNS to This Firewall
Block 22/80/443 to This Firewall (if untrusted)
Block to LAN
Allow to any (to internet)

I’m not caffeinated so not sure I understand your second question. If you’re just looking to create a new interface the steps are https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html.

furom

@steveits said in Issues switching the 2100-switch to 802.1q mode:

@furom Re: rules, it depends on what you want to allow. Maybe:

Allow DNS to This Firewall
Block 22/80/443 to This Firewall (if untrusted)
Block to LAN
Allow to any (to internet)

I’m not caffeinated so not sure I understand your second question. If you’re just looking to create a new interface the steps are https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html.
Thanks,
well, what I tried to say is I basically want to create a trunk with the management lan untagged if possible. I would guess that having the "infra" as in switches etc not having use tags would be easiest?

Yeah, all those rules I think I have under control. But as Stephen wrote above, DHCP will need it's rules apparently, and that I don't need on my other networks, so thought it best to ask before going at it once more, hopefully the final time :)

SteveITS

@furom No, I think you misread. DHCP is allowed by default if enabled.
https://www.reddit.com/r/PFSENSE/comments/3qkufc/comment/cwgzy0m/

furom

@steveits said in Issues switching the 2100-switch to 802.1q mode:

@furom No, I think you misread. DHCP is allowed by default if enabled.
https://www.reddit.com/r/PFSENSE/comments/3qkufc/comment/cwgzy0m/

That makes sense. I thought it might be because of the switch or something. But I could not reach pfSense, without any added rules that is. Would I need to allow that specifically?

Would the "trunk" work out the way I imagine?

rcoleman-netgate

@furom said in Issues switching the 2100-switch to 802.1q mode:

That makes sense. I thought it might be because of the switch or something. But I could not reach pfSense, without any added rules that is. Would I need to allow that specifically?
Would the "trunk" work out the way I imagine?

If you are plugged directly into the switch on the 2100 and not getting DHCP it's a pfSense issue. If you are connecting through another switch and it's not working it's likely a switch config issue.

furom

@rcoleman-netgate said in Issues switching the 2100-switch to 802.1q mode:

@furom said in Issues switching the 2100-switch to 802.1q mode:

That makes sense. I thought it might be because of the switch or something. But I could not reach pfSense, without any added rules that is. Would I need to allow that specifically?
Would the "trunk" work out the way I imagine?

If you are plugged directly into the switch on the 2100 and not getting DHCP it's a pfSense issue. If you are connecting through another switch and it's not working it's likely a switch config issue.

Thanks, I did get dhcp, I misunderstood earlier and thought the built-in switch needed rules for it to work.

rcoleman-netgate

@furom VLANs will need rules, but not for DHCP.

Default the LAN interface passes all traffic - but you need to define traffic rules for each new interface.

furom

The solution and what made this work in the end was me finding a misconfiguration in the SG-2100 switch. I had sadly missed to add the vlan I needed to use to the port I was connected to, therefore not seeing the tags. //