Using a managed switch on 1 interface for add'l subnets. (Newbie alert!)

[aaronouthier]

While I am a veteran with computers, and with general networking, I have very little experience with VLANs.

I have a NetGate 4200 Router (pfSense+) with a WAN, LAN, and both OPT ports in use. However, behind OPT2, I have a router running OpenWRT. I want the 5 RJ45 ports on 1 VLAN for my HomeLab servers, the 2.4 GHz radio on VLAN2, and the 5 GHz radio on VLAN3, and firewalled from each other.

I still need to troubleshoot the OpenWRT side, but I'll do that elsewhere. For now, I want to be sure the pfSense side is correct.

Relevant settings pictured below:

On OpenWRT, I have 2 Dummy VLANs assigned (3rd photo), and each WiFi interface is joined to one of the two. VLAN 1 is for the Ethernet.

I have the firewall and DHCP configured, but no communication to the OpenWRT box or any devices behind it unless I set the Admin interface to "igc0 - opt2", and even then, that only works for devices on VLAN1 in OpenWRT.

[Gertjan]

@aaronouthier

Never ever touched VLANs, but 'a voice' tells me that you shouldn't use a VLAN with ID '1'.

[JKnott]

@Gertjan

I have a guest WiFi configured on VLAN3. However, you're right about VLAN1.

[Bob.Dig]

@Gertjan said in Using a managed switch on 1 interface for add'l subnets. (Newbie alert!):

you shouldn't use a VLAN with ID '1'

This. And I am not sure if "CPU" is a thing in OpenWRT. But better ask there.

[aaronouthier]

Right! I'm not sure why no VLAN1, but that is the default that ships with OpenWRT. Normally, there are 2 VLANs, 1 is LAN and has 4 Wired ports, plus the WLAN interfaces, the original VLAN2 was for the WAN port. I dissolved VLAN2, and joined them together, as I don't need NAT there.

I am aware this is not the OpenWRT forum. I provided the screenshot only for reference. I just want to make sure I have the settings correct on the pfSense side.

I'm not at all certain, but I suspect my issue has to do with VLAN tagging.

[Bob.Dig]

@aaronouthier Technically you could use VALN1 in this situation. Not optimal but if you don't have much other gear, I think it is ok.
I still would use a hard-coded IP-address on the OpenWRT. All in all your problems are not with pfSense but with OpenWRT.

Edit: This is FreshTomato, not OpenWRT.
But VLAN1 is still the LAN from this Device. pfSense is a Client on VLAN1. The other VLANs are passed through from pfSense though, this is what you wanted.