default vlan on default lan -security weakness or misunderstanding

nirmelamoud

Hi,

I think this is what going on on my pfsense, is that correct ? if it is , isnt that a security big no no ???

I have lan configured on my pfsense lan (port) lets say 192.168.1.1
if I connect laptop to it, the traffic get untagged and the ip is in subnet 192.168.1.x

Than I configured vlan (lets say 5 - 192.168.5.1)

my expectation was that if I connect my laptop directly to the lan port , now traffic from it will get tag as vlan 5
but i think it getting tag 1 as if the LAN still an existing interface and it tag the traffic as if it was vlan not lan 1

is that make sense ?

thanks

johnpoz

@nirmelamoud why would your device get vlan 5, if you want your device to be on vlan 5 it would have to be set to tag vlan 5.

Normally if you put vlan 5 (tagged) on your lan interface with its native network (untagged). You would connect this to a vlan capable switch that where on the port on the switch would be set untagged (normally default vlan 1 is fine).. And you would also set this port for tagged vlan 5.. This is called a trunk in the cisco world.

Now on other ports if you want device connected to that port you would set it to vlan 1 (access in the cisco world).. If you wanted a different port on this vlan 5 network you would set that port access vlan 5..

Traffic coming into this vlan 5 port on your switch would be untagged.. But as the switch sent it to your pfsense up the trunk it would tag that traffic so pfsense knows which traffic is the native network 192.168.1 and which traffic is 192.168.5.x traffic.

nirmelamoud

thanks for the reply but thats not what I did, and not answering the question, I do nto want to build a trunk and connect to a switch , I want to force a vlan , from this port, in my ubiquity for example if you create a vlan on a port it automatically remove the basic lan underneath, and I only have vlan traffic on this port , so the laptop that connect to this port traffic ALWAYS get vlan tag 5 -I do not have two interfaces and create automatic vlan 1 that I might not have taking into account in my firewall rules for example

johnpoz

@nirmelamoud if you just want a vlan (tagged) on an interface, just don't set a native network on that physical interface.

Understanding that device would have to be set to tag. On a windows machine this would be done on the interface, under advanced and setting the vlan ID..

But makes no sense to tag if there is only going to be 1 device connected.. Just set it native on the interface on pfsense (untagged) and connect your device.

Or you could just set your interface as 192.168.5 native - an not tag it.. If your only running 1 network on a physical port why would you tag it if your only connecting 1 device..

As to how unifi does it - same any typical switch, if I set a port on the switch to vlan X, then yeah it removes all other vlans on that switch port.. Be it they call it access port or not.. You can not run more than one untagged vlan on the same physical port.

Unifi switch, see port 4 - no tags its in vlan 7, port 5 is the uplink and is set to allow all tags.

I believe non mini unifi switches do allow you to trim the vlans allowed vs just allow all tags. With the custom option you see there, but its not an available option on their mini switches. if you want to limit what vlans go over that port you would need to trim them on the port the switch is connected to.

If you think setting a specific tag on an interface without a native is some security thing from preventing some from just plugging into the port, but since they don't know the vlan ID.. This might keep grandma from connecting. But its not going to stop someone with any basic understanding of networking. Setting no native interface IP (untagged) is fine - but device would have to understand to tag. Unless you are dealing with pfsense with a switch. Discrete ports on pfsense native networks on the interface would just be untagged, and since its not really a switch then yeah they would all be considered vlan 1. But since not a switch port - there would be no cross traffic between say lan native traffic, and opt interface X native networks.

stephenw10

Yup seeing tagged and untagged traffic on a NIC is fine and many many networks do that.

IMO best practice is to avoid tagged and untagged traffic on the same port because it's very easy to misconfigure a switch or client and end up with unexpected untagged traffic. If the port responds on that you may end up crossing subnets. Though usually only one way. Still undesirable.

pfSense will allow you configure a port either way. Not a weakness if you understand what's happening.

dennypage

@stephenw10 said in default vlan on default lan -security weakness or misunderstanding:

IMO best practice is to avoid tagged and untagged traffic on the same port because it's very easy to misconfigure a switch or client and end up with unexpected untagged traffic. If the port responds on that you may end up crossing subnets. Though usually only one way. Still undesirable.

Agreed. Mixing tagged and untagged traffic on the same interface is something many experienced administrators still get wrong.

johnpoz

Would you tag an interface for a single host?

He clearly stated.

ubiquity for example if you create a vlan on a port it automatically remove the basic lan underneath, and I only have vlan traffic on this port , so the laptop that connect to this port traffic ALWAYS get vlan tag

Not how it works btw in unifi.. Which I went over.. But you two would still taq a vlan if you were going to connect a host directly to this port? Sorry but that is not how its done..

I run unifi - and I sure didn't have to set tags on my roku or appletv or playstation, etc ;)

I went over how it works when you set a vlan on switch port, ie the port you put in vlan X would be untagged.. You sure and the hell do not tag to your device. How would you set your play station for example to understand a tag?

I think he is misunderstand when you use a tag, and when you don't.. A port for a single device would almost never be "tagged" you can do it sure - but then the device has to be told about the tag.. Which you can do with something depending on the OS its running, what nic driver is being used, etc. But in 35 years in the biz - before there were vlans, and this not how its done.

Bob.Dig

@johnpoz said in default vlan on default lan -security weakness or misunderstanding:

Which you can do with something depending on the OS its running, what nic driver is being used, etc.

I am not sure if this even works, tried it once, a long time ago. And there is no point doing it, you always can and should do it at the switch.

So yeah, probably big misunderstanding at OPs part.

JKnott

@nirmelamoud said in default vlan on default lan -security weakness or misunderstanding:hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

is that make sense ?

You will only connect to VLAN 5 if the laptop is configured for it. Some laptops can't be.

stephenw10

Yeah exactly. You almost never have a vlan tagged interface connected to a single host. I've done it with a hypervisor that carried VLANs to hosted VMs for example.

But if you did I would probably avoid also assigning the port as untagged. In fact even more so in that case since nothing untagged could ever use it.

JeGr

@stephenw10 said in default vlan on default lan -security weakness or misunderstanding:

Yeah exactly. You almost never have a vlan tagged interface connected to a single host. I've done it with a hypervisor that carried VLANs to hosted VMs for example.

Also at least in Windows-World it's completely non-standard. You'd need software from your NIC manufacturer (at least in quite a few cases) to even set a NIC in windows to a tagged VLAN as no network engineer would set up a client port as tagged.

Also tag+untagged still gets used quite often when e.g. using pass-through of a single NIC with SIP phones. E.g. you plug the patch cable into your phone, then from the phone daisy-chain into your workstation. That allows for a bit of "cleaner" desk-setup in cases and you'd have your client VLAN untagged and the VoIP VLAN tagged on that port. So yes, mostly I'd also recommend to avoid mixing untagged and tagged, but in such cases it can be normal. But Tagging for a desktop or server? Highly unusual.

Cheers

johnpoz

@JeGr said in default vlan on default lan -security weakness or misunderstanding:

Also tag+untagged still gets used quite often when e.g. using pass-through of a single NIC with SIP phones

Great example!!

nirmelamoud

@johnpoz so you agree on how it work, but you think its not a security issue ? I think it is, i agree that certain percentage of admins will not fall in this mis configuration path, but some will, and the point of good security , IMHO , is to help users (admins) not to make that mistake due to lack of experience, knowledge , or you doing it quicky , or what ever reason.

nirmelamoud

@stephenw10 IMO , if you say "if you know what you are doing" than it is a weakness, as it require you to something in order to not open a security holw, and tomorrow when an AI agent will do this configuration , who know what it will decide to do...

nirmelamoud

@johnpoz the point was not to justify or not justify this mix configuration, it was to highlight the associate risks, with the "automatic" vlan assignment in PFsense compared to UDM

chpalmer

@nirmelamoud said in default vlan on default lan -security weakness or misunderstanding:

but you think its not a security issue

It is not a security issue. I worked for a company that had arguably one of the largest private VOIP systems in the world.. our lead administrators used the combination of tagged non-tagged country wide. It was expected and if they did not want non-tagged traffic on an interface they made it so.

The real security issue is someone that does not understand that they need to always verify. Don't be lazy and just take things for granted.

johnpoz

@nirmelamoud I have no idea what your going on about to be honest.. UDM does not tag vlans you set on a port when you put it in a specific vlan.

So no I don't agree with how it works.. A port/interface with a single device on it would be untagged. While you can tag it if you wanted to - if your device supported vlans.. This sure wouldn't be extra "security" by any stretch of the imagination..

If you setup a native IP on pfsense interface it would be untagged - this how any network device I have worked on in 35+ years works.

nirmelamoud

@johnpoz thats not the case I described, what i described was that the default was untag, than the admin decided to make it a vlan (so all devices will get that tag) but forgot / did not know that he/she/it need to delete the lan that was untag (and maybe the firewall rules , routing rules, etc) on it,
also now for some reason if you go in untaged (laptop) instead of getting untagged or tagged as 5, you get tagged as 1 (default vlan) which is crazy IMO as in no place i asked for it, I expected it to come as vlan 5

johnpoz

@nirmelamoud I suggest you actually read how vlans works.. If you add a vlan (tagged) on an interface.. But traffic comes in without the tag, then yes it would be on the untagged native network.. This is 101 for vlanning.. this is called pvid on a switchport (port vlan id)

did not know that he/she/it need to delete the lan that was untag (and maybe the firewall rules , routing rules, etc) on it,

So someone that shouldn't be with 100 ft of networking gear then? And please don't compare a discrete interface on a firewall with how a switch might do things.. Yes most switches, any decent one would not let you put more than 1 untagged vlan on a port - because that is not a valid sort of configuration. You can have multiple tagged vlans on a port, you can have 1 untagged vlan on a port either by itself or with other tagged vlans. But you can not put more than 1 untagged vlan on a port and expect anything to work.

But if you add a vlan (tagged) to an interface in pfsense - why in the world would it remove the untagged native network?

JKnott

@nirmelamoud said in default vlan on default lan -security weakness or misunderstanding:

so you agree on how it work, but you think its not a security issue ?

A few years ago, part of my job involved turning up a fiber circuit. The fiber terminated on a Ciena media converter, which then connected to a Cisco router. The tech at the other end of the phone call asked me if I could use VLANs on my laptop computer, running Windows, and I always answered no, because I couldn't do it. At this time I was a CCNA and had a VLAN on my home network. So, it wasn't a case of not knowing, but hardware that wasn't capable. If you are worried about that, then use a managed switch and only allow what you want.