New to VLAN - Use same VLAN on multiple pfSense ports

randydeb

I have my pfSense (custom HW) running for a while not at home/office, but want to start using VLANs.
The pfSense device has 6 ports

Current situation:
igc0: WAN (DHCP)
igc1: MGMT (10.10.1.1/24)
igc2: OPT1 (192.168.10.1/24) => Wifi AP
igc3: OPT2 (192.168.20.1/24) => Powerline adapter
igc4: OPT3 (192.168.30.1/24) => unused
igc5: OPT4 (192.168.40.1/24) => Home Assistant

There is also a powerline in living room and office, so basicly splitting my wifi & lan capable devices into 2 ip ranges.

So this setup is not as it should be and i want to start using VLANs
1000: Home
1001: Office
1002: IoT
1003: TV/Digibox
1004: IP Cameras

Now i see a VLAN can be on only 1 interface.
Seen some solutions where u can bridge interfaces or create LAGG interface to use a single VLAN on multiple ports.

From what i found on these forums, bridge interfaces to make pfSense ports function as a switch is slow.
What makes it slow? Requires more CPU/RAM?
If so, is this still an issue on 4x 2Ghz / 16 GB ram?

For LAGG, should both ports go to the same device to load balance / double troughput?
Or can both ports go to another device and make both ports work as normal switch?
igc2/igc3 = LAGG interface with VLAN
igc2 => Wifi AP
igc3 => Powerline

3the option is to use just 1 port on pfSense, connect it to a switch and more to the different devices from there.
This makes the other 3 ports pretty much useless.

Looking forward to hear your idea on whats best setup.

Kind regards,
Randy

Tzvia

I wouldn't mess with bridges/LAGGs, what I did was use a vlan capable switch (a 24 port Netgear and a couple of their 8 port switches downstream in my case) with a 6 port 'industrial' mini PC for PFSense. One port on the PFSense box is WAN, another is the default LAN. I then configured three of the other ports to carry VLANs only, and connected all but the wan to my switch which was configured for those vlans as tagged. So 4 ports on my PFSense box go to my Netgear switch, default LAN, and 5 VLANs tagged . I then configured the rest of the switch ports for whatever I am connecting to it. I have the flexibility as my needs change, to just reconfigure the Netgear switch ports for whatever I am connecting. These days, VLAN capable gigabit switches can be had quite reasonably. It's not worth messing with bridges and LAGGS.

johnpoz

@randydeb as @Tzvia mentions switch or switches how you do this.

And using switches does not make your other ports on you router useless.. You could use them as other network interfaces.. But trying to make a switch out of discrete interfaces waste good interfaces and makes for a horrible switch!

Not sure I would use those vlan IDs - those are quite often reserved or special in the cisco world.. You could use lagg if you want for more bandwidth and redundancy. You could put your other vlans/networks on their own interfaces connected to your switch so your not hairpinning traffic.. I for sure would put your IP cameras on their own interface.. Normally cameras are always streaming data.. While it not normally a huge amount.. I wouldn't share this on same physical interface with other networks/vlans if I had the interfaces to use.

1002-1005 Cisco defaults for FDDI and Token Ring. You cannot delete VLANs 1002-1005.

I like to use a vlan ID that matches up with the network, so for example 192.168.9.0/24 the ID is 9, my 192.168.3.0/24 the ID is 3, 192.168.7.0/24 is ID 7, etc..

If you have network/vlans that will do a lot of talking between them - its normally good to put them on their own physical interfaces vs all on the same interface where the traffic will hairpin.