Ubiquiti switch VLANs problem
-
I assume this is not a problem with pfSense since it worked fine before, but I am simply out of ideas, and perhaps someone knowledgeable will have some ideas.
I replaced TP-Link switch in the house with Unifi, and I can't get VLANs to work.
Here's the situation:
There is a router running pfSense in front of the switch where DHCP server runs. The LAN has range of 192.168.0.x, and there is virtual interface with VLAN id 20 where all the wireless devices should go, and get IP in the 192.168.4.x range.
The problem is, I have no idea how to achieve this on the Unifi switch.
There is the default VLAN 1 that's set on all ports. Ok.
There is one AP connected to port 8, so I simply set the native VLAN on that port to 20, expecting it to be enough, but nope. It's getting ip from the LAN range. Then I changed the van tagging setting from "allow all" to "block all", and that also did nothing. -
I think I might have gotten it to work, the only problem is I can't open the web interface of the APs from my PC, which most likely needs an extra rule for the LAN interface, but that's where my real struggle with pfSense is. Can anyone help me out with that please? What kind of traffic do I need to pass from where to where?
-
You need to trunk the port connected to pfsense interface. then port would be vlan 20 untagged that connects to some dumb AP.
To set vlans on unifi switch you would need to be using the controller I do believe - what specific unifi switch do you have?
example - here is a little flex mini have on my network
So port 5 allows all tagged traffic, where my vlan 2 is native and untagged. Then the other ports are in just other vlans as native, tagged traffic is no allowed
So what switch do you have from unifi? You would need to setup the controller, adopt the switch and then setup what you want. Creating the vlans in the controller, etc.
I was not aware of switches from unifi you could control without the controller software?
Other switches allow you to control which specific tagged vlans can be allowed on a port. But the mini its all or none
What APs do you have - you mention you can not open the web interface - unifi AP don't have web interfaces. You use the controller to manage them as well. Or believe you can use a phone app to manage them if you do not have a controller.
-
@johnpoz It turned out I was doing it backwards. What I had to do was keep default VLAN on all ports and then add the extra one as tagged. None of this makes any sense, but then networking is like klingon to me.
And the APs, I just had to enable L3 something in the GUI, then it would work.
I have Pro Max 24 PoE switch btw. I'll have to install the server OS something as a VM on the home server though, because the friggin thing runs on Java and has to run in the background, which is pain in the arse.
Why they chose to do this instead of interface that runs off the device do not understand. -
@Octopuss you do not need to run the controller 24/7. I run mine on a VM, I do leave mine running 24/7 because of stats from the wifi.
But if your not worried about that turn on, make your settings.. Turn off until you need to change something.
-
@Octopuss said in Ubiquiti switch VLANs problem:
Why they chose to do this instead of interface that runs off the device do not understand.
The UniFi architecture makes plenty of sense once you understand it as meant for large-scale networks. They are not eager to put enough horsepower into individual switches or wifi APs to allow those devices to run full-on configuration GUIs. Yeah, it's just an incremental cost, but it adds up. So the idea is to keep the network devices cheap by having one controller device that is the configuration source for all your other devices. (They do sell boxes that are combined controller + router, but not controllers combined with switches or APs.)
As @johnpoz said, you don't have to run the controller when you're not busy changing network configuration, unless you want to make use of its other function of collecting statistics and monitoring for problems. Which again is something that makes sense to centralize, not duplicate on N independent devices.
-
@tgl said in Ubiquiti switch VLANs problem:
but not controllers combined with switches or APs.
Very pedantic of me but there are the UniFi Express, UniFi Express 7, Dream Router/Router 7 and Dream Wall which are gateway & AP & cloud controller.
