Setting up a VLAN part 2


  • Netgate Administrator

    Here is what I would do:
    Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)

    Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.

    Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.

    Add more VLANs once that's working.

    Steve



  • @stephenw10:

    Here is what I would do:
    Disable trunking/bonding for now, it's just adding a further complication and you can add it back once you figure out VLANs. (what VLANs did you set on the trunk in the switch?)

    Setup the second interface so that you have access to the webgui even if everything on the first interface gets locked out.

    Unassign the first interface so that it's not sending untagged packets. Create a VLAN on it, VLAN100 say, and then try to configure the switch to work with it.

    Add more VLANs once that's working.

    Steve

    everything you mentioned is my problem (tagging/untagging).

    since i get confused, i wont know if i am doing it right.

    not sure how to setup management to be accessible from both vlans?

    also, you can see how the trunk was configured in the pics above.  i dont think there are issues with that, worst case scenario (if i set it up wrong) i wont be able to access my NAS, not critical.


  • Netgate Administrator

    I meant the second interface on the pfSense box so you don't get locked out of pfSense.

    It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
    It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.

    Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.

    Steve



  • @stephenw10:

    I meant the second interface on the pfSense box so you don't get locked out of pfSense.

    It looks like you're doing everything right. At this point you have not been able to see any VLAN activity in any way, at an time, yes?
    It seems likely that your pfSense box is not sending VLAN frames for some reason. Could be a config issue, it could be that your NIC is interfering etc.

    Once you are able to access the pfSense gui via a different interface you can safely play with these settings and not get locked out.

    Steve

    gotcha…yeah, i might just give up on trying to do it with 1 nic/1 cable mainly because i forgot about the compatibility issue, even if it is setup right, i might be using a nic card that isnt compatible.

    thanks for the help to all up to this point.



  • ok, i decided to not try it with 1 NIC….

    i get the second nic setup and assign vlan100 to run on re1.

    i know pfsense sees the NIC because i see it in the GUI.

    my HP sees RE1 because the green LEDs come on and i see it highlight in the hp GUI.

    however, i dont see the link activity LEDs on the NIC turn on.  maybe i have a bad NIC?  i'd have to see if i have another one somewhere.

    anyway....

    how should i be tagging/untagging/excluding ports?

    i tried a few combindations and i still get 169.254 as the IP on my laptop.

    keep in mind, i need to add an additional port to vlan100 on the hp switch because the only port i was using before, port 2 was for testing my laptop, is now being used to connect to the pfsense NIC.

    i decided to use ports 7 and 8 as my vlan100 ports

    ports that should be on vlan 1- 1,2,3/4,5,6 (3/4 is the trunk/bond, but i can easily assign that to a vlan1 via the tag/untagg screen.

    ports that should be on vlan 100- 7,8

    let me take a stab...

    vlan1-    UUUUUUTT
    vlan100- EEEEEEUU



  • yeah, something is wrong with the nic in the pfsense box (re1).

    i bypassed the hp switch and went directly into my laptop and it goes on….off....on....off....on....off

    however, we can still talk about tagging/untagging for when i do find a another NIC.

    edit- found a good/compatible NIC card.  plugged it in, plugged in m laptop and i have green LEDs, re1, back online.

    now for the u/t/e portion.



  • or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface.  might as well try that before bringing in the switch, right?

    EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses.  i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x).  unchecked it, saved, new device instantly got an IP address (192.168.1.x).



  • i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan


  • Netgate Administrator

    @tomdlgns:

    or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface.  might as well try that before bringing in the switch, right?

    Nope.
    Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

    @tomdlgns:

    EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses.  i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x).  unchecked it, saved, new device instantly got an IP address (192.168.1.x).

    No idea what's happening there, that is strange.

    Steve



  • @Metu69salemi:

    i've dropped out what happened, did you setup another nic which is handling two vlans? or did you setup interface only handling one vlan

    yes, i have a second NIC installed with vlan100 and dhcp server is enabled.



  • @stephenw10:

    @tomdlgns:

    or we can start off by trying to get an ip address from 10.10.10.1/24 with my laptop plugged directly into pfsense vlan interface.  might as well try that before bringing in the switch, right?

    Nope.
    Your laptop will not see the vlan tagged packets at all, it's NIC will just discard them. You need the switch to read in the tagged packets, route them to the correct port and remove the tags so that you laptop see standard untagged packets.

    @tomdlgns:

    EDIT- strange issue…when i enabled the dhcp server for the vlan (while not being able to grab an IP address with my laptop plugged in directly) it seems that my 192.168.1.x dhcp server (seperate interface) cant hand out any new IP addresses.  i had trouble grabbing an IP with a new device and the only change had been the vlan dhcp server (10.10.10.x).  unchecked it, saved, new device instantly got an IP address (192.168.1.x).

    No idea what's happening there, that is strange.

    Steve

    ok, makes sense.

    since i was just plugged into my laptop that could be why it wasnt working, i understand that i need to bring the switch in.  i just assumed since the laptop was connected directly to the second nic with vlan100 assigned to it in pfsense, that i would have no need for a switch.  however, it makes perfect sense that i need the vlan switch.

    with all that said, i'd like to get the vlan tagging correct now with two nics

    vlan1 on the hp switch should be ports

    1,2,3,4,5,6

    vlan 100 on the hp switch should be ports

    7,8

    vlan1-    U U U U U U T T
    vlan100- E E E E E E U U

    is that close?

    edit-

    ports 1-6 would be 192.168.1.x network

    ports 7/8 would be 10.10.10.x network
    port 7 is patch cable to vlan100 nic (second NIC) on pfsense box
    port 8 is patch cable to a wifi router with DHCP disabled (pfsense will do that) or a direct laptop.


  • Netgate Administrator

    VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

    Configure the switch:

    
    port:        1 2 3 4 5 6 7 8 
    vlan1:       U U U U U U E E
    vlan100:     T E E E E E U U
    
    

    Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

    Steve



  • @stephenw10:

    VLAN1 is probably going to stop working here because hopefully you will stop sending any untagged packets to the switch from pfSense.

    Configure the switch:

    
    port:        1 2 3 4 5 6 7 8 
    vlan1:       U U U U U U E E
    vlan100:     T E E E E E U U
    
    

    Unassign re1 from LAN to stop is sending untagged packets. This will lock you out of the pfSense box if you haven't got access from re2.

    Steve

    vlan 1 is going to stop working?  what does that mean?  i would still like all 192. computers to work.

    by tagging port 1 in vlan100 is that what 'unassing re1 from LAN to stop sending untagged packets' is?

    i will wait for a reply before i set it up that way.



  • create a new vlan say 10 or something else than 1 or 100
    Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
    so your network would be
    nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
    vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
    vlan100 (on same nic as vlan10): this would be same as currently

    then add current configs to switch
    vlan10:  T U U U U U E E
    vlan100: T E E E E E U U
    remember to connect port 1 to pfsense



  • @Metu69salemi:

    create a new vlan say 10 or something else than 1 or 100
    Use only your current lan interface as management interface and both two vlan's to the same nic where you have vlan currently.
    so your network would be
    nic(lan): 192.168.1.1 /24 for management, you could also use something else subnet area
    vlan10 (on another nic): this would be your current lan, so whatever you like to use, but notice, that this vlan and above management subnet wouldn't work if they have same subnets
    vlan100 (on same nic as vlan10): this would be same as currently

    then add current configs to switch
    vlan10:   T U U U U U E E
    vlan100: T E E E E E U U
    remember to connect port 1 to pfsense

    ok, what does vlan1 look like in the hp switch?

    i think you just confused me more.



  • in this topology it doesn't exist
    It is only "console" access to the firewall



  • @Metu69salemi:

    in this topology it doesn't exist
    It is only "console" access to the firewall

    let me rephrase.

    that is ok if it is there and i dont use it, but i will have it in my switch.  after reading the post, it seems as if my switch needs to look like this

    vlan1
    vlan10
    vlan100

    maybe we should start with pfsense, do i have that configured properly?

    re0- WAN
    re1- vlan100 (10.10.10.1) dhcp enabled
    re2- LAN (192.168.1.1) dhcp enabled

    –------------------
    pfsense LAN goes into HP port 1 (vlan?) 192.168.1.x


    pfsense vlan100 goes into HP port 7 (vlan100 on hp switch) 10.10.10.x and port 8 needs to be on vlan100 as well.

    EDIT-

    does the pfsense NIC even need to be a VLAN?  if i am using a seperate NIC, shouldnt i be able to assign it to 10.10.10.x and deal with VLANs in the HP switch to segregate 10 traffic vs 192 traffic?



  • did you guys give up on me?

    ;D


  • Netgate Administrator

    Sorry I was out on an all night 120 mile cycle ride Saturday night. Yesterday was pretty much a write off!  :)

    I think we could easily loose sight of the big picture here.
    The aim of this exercise is to learn about VLANs. The configuration we are hoping to end up with is:
    pfSense using two interfaces, WAN on re0 and VLANs on re1.
    The HP switch configured to split the VLANs between some it's ports. Such that some ports are pfSenses LAN interface and some are pfSenses other interface.

    Although you have LAN setup on re2 at the moment that's only temporary while we configure VLANs on re1.

    Setup another VLAN as  Metu69salemi suggested.

    You should only have one cable between pfSense (re1) and the trunk port on the switch (port1).

    Steve



  • @stephenw10:

    Sorry I was out on an all night 120 mile cycle ride Saturday night. Yesterday was pretty much a write off!  :)

    I think we could easily loose sight of the big picture here.
    The aim of this exercise is to learn about VLANs. The configuration we are hoping to end up with is:
    pfSense using two interfaces, WAN on re0 and VLANs on re1.
    The HP switch configured to split the VLANs between some it's ports. Such that some ports are pfSenses LAN interface and some are pfSenses other interface.

    Although you have LAN setup on re2 at the moment that's only temporary while we configure VLANs on re1.

    Setup another VLAN as  Metu69salemi suggested.

    You should only have one cable between pfSense (re1) and the trunk port on the switch (port1).

    Steve

    hmmm, now i am confused, it is official.

    i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

    wasnt the recommendation to use 3 NICS?

    re0- WAN
    re1- VLANs (originally not in play)
    re2- LAN (for 192.168.1.x network)

    that would mean two connections from pfsense to my switch

    re1- for VLANs (or 10.10.10.x network)
    re0- for the regular 192.168.1.x network

    unless i missed something, that is how i thought it was going to end up.

    thanks.

    (btw, i dont blame you for taking the day off, the weekends are there to enjoy and relax, sounds like you did both)  :)



  • i have access to another switch i can use, but it isnt in the mix yet, just want some feedback…

    it is an HP switch, but a little more advanced/better GUI than the one i am using.

    in this switch, the vlan has 4 options:

    no
    tagged
    untagged
    forbid

    i assume forbid= exclude

    or is it

    no=exclude

    part of the confusion is that:

    -i have never had to use vlans, but i want to learn
    -every piece of device i have logged into with vlan capabilities has a different 'look' to it.



  • Please see attached file
    you could also allow from the switch to use another management ip from another vlan or setup another management vlan




  • @Metu69salemi:

    Please see attached file
    you could also allow from the switch to use another management ip from another vlan or setup another management vlan

    what is console? 1 PC i have connected to pfsense just to login to it to make changes?

    also, wiring it up isnt a problem.

    if i wire it i need to be able to build out the vlans for it to function properly.

    i need guidance on that portion.  i guess i need to go to the HP forums and ask them what the proper way to tag/untag is?  that is my issue here (i think pfsense is setup properly).

    thanks.



  • Console means, that you sit next to that machine, but in this case it's only needed if you have locked you self out from another vlan



  • @Metu69salemi:

    Console means, that you sit next to that machine, but in this case it's only needed if you have locked you self out from another vlan

    the HP switch has a management port section where i can dedicate 1 of the ports as a managed port.

    i dont think that will be an issue unless i screw up the tagging/untagging/exclude, which is where i am stuck.


  • Netgate Administrator

    @tomdlgns:

    hmmm, now i am confused, it is official.

    i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

    wasnt the recommendation to use 3 NICS?

    re0- WAN
    re1- VLANs (originally not in play)
    re2- LAN (for 192.168.1.x network)

    Originally you wanted to use just two interfaces on the pfSense machine so that is what we are attempting to achieve. We only recommended you setup re2 so that you didn't get locked out of pfSense if you configured VLANs incorrectly. You have assigned LAN to it but we didn't expect you to. It could be any OPT interface.

    @tomdlgns:

    that would mean two connections from pfsense to my switch

    re1- for VLANs (or 10.10.10.x network)
    re0- for the regular 192.168.1.x network

    unless i missed something, that is how i thought it was going to end up.

    Whilst you could have both interfaces connected to the switch it would be far more complex to setup and MUCH more likely to cause problems.

    Technically you don't need use VLANs at all, you want two subnets and you have two interfaces.

    Let me layout what I expect the final configuration to be.

    WAN - re0
    LAN - VLAN10 - re1      192.168.1.X
    OPT1 - VLAN100 - re1  10.10.10.X
    OPT2 - re2                  192.168.2.X

    I hope that makes some sort of sense!

    Steve



  • @stephenw10:

    @tomdlgns:

    hmmm, now i am confused, it is official.

    i thought that doing everything from one interface was part of the reason i wasnt able to verify if i had everythign configured properly?

    wasnt the recommendation to use 3 NICS?

    re0- WAN
    re1- VLANs (originally not in play)
    re2- LAN (for 192.168.1.x network)

    Originally you wanted to use just two interfaces on the pfSense machine so that is what we are attempting to achieve. We only recommended you setup re2 so that you didn't get locked out of pfSense if you configured VLANs incorrectly. You have assigned LAN to it but we didn't expect you to. It could be any OPT interface.

    @tomdlgns:

    that would mean two connections from pfsense to my switch

    re1- for VLANs (or 10.10.10.x network)
    re0- for the regular 192.168.1.x network

    unless i missed something, that is how i thought it was going to end up.

    Whilst you could have both interfaces connected to the switch it would be far more complex to setup and MUCH more likely to cause problems.

    Technically you don't need use VLANs at all, you want two subnets and you have two interfaces.

    Let me layout what I expect the final configuration to be.

    WAN - re0
    LAN - VLAN10 - re1       192.168.1.X
    OPT1 - VLAN100 - re1   10.10.10.X
    OPT2 - re2                   192.168.2.X

    I hope that makes some sort of sense!

    Steve

    this gets better and better

    where is 192.168.2.x coming from? and now another NIC?

    -i'd like to setup a VLAN so i can work/test with it
    -i can easily setup a second NIC/subnet using another switch, but that wont incorporate a VLAN, so i dont want to go that route.

    what i planned on was this:

    re0-WAN
    re1- VLAN100 10.10.10.x
    re2- my regular lan 192.168.1.x

    what i wanted to do was then use my hp switch to work with the pfsense box

    ports 1-4 would run the 192.168.1.x network and ports 5-8 would be tagged ports on vlan 100.  i assumed that doing it this way would allow anything plugged into ports 5-8 would work on the vlan100 network.

    later on, if i introduced a second vlan, vlan200 i THOUGHT i would be able to untag ports 7.8 and tag those in vlan 200 to work on another subnet.

    apparently i am wrong in how vlans work, but i thought that was the entire point of VLANS… separate networks on the same physical switch.

    edit-

    are you guys saying that i cant have anything on the default lan tagged with vlan 100 traffic?

    do i need to do something like this

    default vlan- EEEEEEEE (this would need a 'console PC' so i could login to pfsense on 192.168.1.1 and make changes)
    vlan10- TTTTUUUU (ports 1-4 tagged for vlan10)
    vlan100-UUUUTTTT (ports 5-8 tagged for vlan100)

    or am i still way off?


  • Netgate Administrator

    @tomdlgns:

    this gets better and better

    :D

    @tomdlgns:

    where is 192.168.2.x coming from? and now another NIC?

    192.168.2.X is just a subnet I invented to be the extra interface used for admin access.
    There are still only 3 NICs but there are two VLANs on re1.

    @tomdlgns:

    -i'd like to setup a VLAN so i can work/test with it
    what i planned on was this:

    re0-WAN
    re1- VLAN100 10.10.10.x
    re2- my regular lan 192.168.1.x

    Ok, we can aim for this. This will use three NICs at the end where as originally you wanted to use just two.

    @tomdlgns:

    what i wanted to do was then use my hp switch to work with the pfsense box

    ports 1-4 would run the 192.168.1.x network and ports 5-8 would be tagged ports on vlan 100.  i assumed that doing it this way would allow anything plugged into ports 5-8 would work on the vlan100 network.

    later on, if i introduced a second vlan, vlan200 i THOUGHT i would be able to untag ports 7.8 and tag those in vlan 200 to work on another subnet.

    Yes that's what we will do except that you will need 2 of the ports on your switch to connect to the pfSense box so you will only have 6 left for connecting clients (or other switches).

    @tomdlgns:

    apparently i am wrong in how vlans work, but i thought that was the entire point of VLANS… separate networks on the same physical switch.

    You are right, that's exactly what they're for.

    Here is the switch config I would expect to work for your current setup:

    
    port:        1 2 3 4 5 6 7 8 
    vlan1:       E E E E U U U U
    vlan100:     T U U U E E E E
    
    

    In which port 1 is connected to re1 and port 8 is connected to re2.
    This will give you 10.10.10.x on ports 2-4 and 192.168.1.X on ports 5-7.

    Are all your NICs identical?

    Steve



  • @stephenw10:

    @tomdlgns:

    this gets better and better

    :D

    @tomdlgns:

    where is 192.168.2.x coming from? and now another NIC?

    192.168.2.X is just a subnet I invented to be the extra interface used for admin access.
    There are still only 3 NICs but there are two VLANs on re1.

    @tomdlgns:

    -i'd like to setup a VLAN so i can work/test with it
    what i planned on was this:

    re0-WAN
    re1- VLAN100 10.10.10.x
    re2- my regular lan 192.168.1.x

    Ok, we can aim for this. This will use three NICs at the end where as originally you wanted to use just two.

    @tomdlgns:

    what i wanted to do was then use my hp switch to work with the pfsense box

    ports 1-4 would run the 192.168.1.x network and ports 5-8 would be tagged ports on vlan 100.  i assumed that doing it this way would allow anything plugged into ports 5-8 would work on the vlan100 network.

    later on, if i introduced a second vlan, vlan200 i THOUGHT i would be able to untag ports 7.8 and tag those in vlan 200 to work on another subnet.

    Yes that's what we will do except that you will need 2 of the ports on your switch to connect to the pfSense box so you will only have 6 left for connecting clients (or other switches).

    @tomdlgns:

    apparently i am wrong in how vlans work, but i thought that was the entire point of VLANS… separate networks on the same physical switch.

    You are right, that's exactly what they're for.

    Here is the switch config I would expect to work for your current setup:

    
    port:        1 2 3 4 5 6 7 8 
    vlan1:       E E E E U U U U
    vlan100:     T U U U E E E E
    
    

    In which port 1 is connected to re1 and port 8 is connected to re2.
    This will give you 10.10.10.x on ports 2-4 and 192.168.1.X on ports 5-7.

    Are all your NICs identical?

    Steve

    thanks steve.  i didnt realize, until after i posted, that you were using the same nic for the other vlan, my bad on that.

    i have 3 nics now and i wanted to only use 2 until it was brought up that carrying multiple vlan traffic over 1 wire/nic might not work if the nic isnt vlan compatible, that is when the second LAN NIC (3rd NIC if you count WAN) was introduced.

    i realize i will only have 6 ports to use for devices, but what i was getting at was that 1-4 was for 1 subnet and 5-8 was for another subnet (or did i mess up again)? 1 and 5 would be used for the respective NICs on pfsense.

    my main goal is to

    -incorporate a vlan
    -not lock myself out of anything

    i want to keep my existing 192.168.1.x network as is (for the other devices on it) and i want to be able to manage pfsense from any 192.168.1.x computer

    knowing all of that, do you still suggest i connect/configure my network with what your last posted stated?

    i dont mind a little redesign, but i want to make sure we are talking about the same stuff when i begin to implement this


  • Netgate Administrator

    Yes try my last suggestion. It should work, then again I thought that before!  ::)

    Steve



  • @stephenw10:

    Yes try my last suggestion. It should work, then again I thought that before!  ::)

    Steve

    ok thanks, will try that

    can you explain why only 1 port is Tagges on vlan100?

    port:        1 2 3 4 5 6 7 8
    vlan1:      E E E E U U U U
    vlan100:    T U U U E E E E

    why isnt vlan100: T T T T E E E E

    i understand why vlan1 is E E E E (those ports are for vlan100) and U U U U on vlan100 are untagged packets for the 192.168.1.x network, correct?


  • Netgate Administrator

    The three different port modes are like this as I understand it, though I don't actually have an HP switch:

    E - Exclude this port from VLANX. I.e. any packets arriving on the port from outside tagged VLANX will be disgarded and any packets inside the switch tagged VLANX will not switched to this port.

    U - Untagged port. I.e. packets in the switch tagged VLANX can be switched to this port and will have tags removed when leaving. Untagged packets arriving on this port will be tagged VLANX upon entering the switch.

    T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
    Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.

    In the switch configuration packets arriving at ports 2, 3 or 4 will be tagged VLAN100 as they enter the switch. They can then be switched to any other port participating in VLAN100 (1-4). If the packet is addressed to the internet somewhere it will be switched to port 1 where it leaves the switch still tagged and arrives at re1 where the pfSense VLAN100 interface is setup to receive it and route it appropriately.

    Returning packets are sent to the switch from pfSense tagged VLAN100. Port 1 allows them to enter the switch and they are switched to the correct port. On leaving the port (2-4) the VLAN tagging removed so that the pakets arrive back at the client untagged and able to received.

    Steve



  • @stephenw10:

    The three different port modes are like this as I understand it, though I don't actually have an HP switch:

    E - Exclude this port from VLANX. I.e. any packets arriving on the port from outside tagged VLANX will be disgarded and any packets inside the switch tagged VLANX will not switched to this port.

    U - Untagged port. I.e. packets in the switch tagged VLANX can be switched to this port and will have tags removed when leaving. Untagged packets arriving on this port will be tagged VLANX upon entering the switch.

    T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
    Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.

    In the switch configuration packets arriving at ports 2, 3 or 4 will be tagged VLAN100 as they enter the switch. They can then be switched to any other port participating in VLAN100 (1-4). If the packet is addressed to the internet somewhere it will be switched to port 1 where it leaves the switch still tagged and arrives at re1 where the pfSense VLAN100 interface is setup to receive it and route it appropriately.

    Returning packets are sent to the switch from pfSense tagged VLAN100. Port 1 allows them to enter the switch and they are switched to the correct port. On leaving the port (2-4) the VLAN tagging removed so that the pakets arrive back at the client untagged and able to received.

    Steve

    i am going to read that over a few times.  at first glance i am pretty confident that your explanation was very good, it makes sense.  i wish you posted that on page 1.

    ;D



  • @stephenw10:

    Yes try my last suggestion. It should work, then again I thought that before!  ::)

    Steve

    so far so good, we are making progress.

    192 PCs are working and my laptop, plugged into port 2 with port 1 going to re1 like you said is giving out a 10.10.10.x ip address.

    however, we are not done yet.

    the pc on the 10.10.10.x network cant hit the internet.

    do i need to write a firewall rule for that?

    EDIT- ok, i decided to add another port, port 4, away from vlan100 and into vlan1 (the default VLAN).

    i marked it as U in vlan 1 and E in vlan100 and saved…no issues, works well. :)

    i finally feel like i am making some progress being able to get this somewhat working and seeing it physically plugged in.

    once i get some more help (fingers crossed) regarding the 10.10.10.x PC not being able to hit the internet, i am going to document this setup so i know what it takes to get it up.


  • Netgate Administrator

    If your PC on the VLAN100 port is receiving DHCP then you're 99% there.  :)

    Yes you need to put a firewall on the VLAN100 interface (OPT1 or whatever you have called it) to allow access to the internet.
    You can use the default rule on LAN as a template but bare in mind that's a very open rule.

    Steve



  • @stephenw10:

    If your PC on the VLAN100 port is receiving DHCP then you're 99% there.  :)

    Yes you need to put a firewall on the VLAN100 interface (OPT1 or whatever you have called it) to allow access to the internet.
    You can use the default rule on LAN as a template but bare in mind that's a very open rule.

    Steve

    thanks.

    how about ping?  my pc grabbed 10.10.10.210, the first ip in the range, but i couldnt ping 10.10.10.0 or .1 do i need to write a rule for that?  i had another PC on vlan100 and i couldnt ping it.

    however, from a 192.168.1.x computer, i was able to ping 10.10.10.210 i was happy to see replies, but i expected to get 0 replies from the start w/o writing rules for that stuff.

    EDIT- FINALLY ONLINE WITH A PC ON THE VLAN…..YESSSSSSSSSSSS

    EDIT- now that the wide open rules are open (* everywhere) i can ping 10.10.10.1.  as i stated in the post below, i believe it is all firewall rules at this point.  obviously i dont want VLANs talking to each other.  some, maybe, but not all.



  • my LAN rule is

    protocol- *
    source- LAN net
    port- *
    destination- *
    port- *
    gate- *
    queue- none

    that is the default rule for LAN.  since there are no rules to deny vlan subnets is that why i can ping?

    now that i made rules for VLAN, i can ping 192 addresses from the 10 network.

    i assume this is all firewall rules at this point?



  • @stephenw10:

    The three different port modes are like this as I understand it, though I don't actually have an HP switch:

    E - Exclude this port from VLANX. I.e. any packets arriving on the port from outside tagged VLANX will be disgarded and any packets inside the switch tagged VLANX will not switched to this port.

    U - Untagged port. I.e. packets in the switch tagged VLANX can be switched to this port and will have tags removed when leaving. Untagged packets arriving on this port will be tagged VLANX upon entering the switch.

    T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
    Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.

    In the switch configuration packets arriving at ports 2, 3 or 4 will be tagged VLAN100 as they enter the switch. They can then be switched to any other port participating in VLAN100 (1-4). If the packet is addressed to the internet somewhere it will be switched to port 1 where it leaves the switch still tagged and arrives at re1 where the pfSense VLAN100 interface is setup to receive it and route it appropriately.

    Returning packets are sent to the switch from pfSense tagged VLAN100. Port 1 allows them to enter the switch and they are switched to the correct port. On leaving the port (2-4) the VLAN tagging removed so that the pakets arrive back at the client untagged and able to received.

    Steve

    i have access to another HP switch (not the one i am using in this thread) and it looks a little more vlan friendly, these are the options and what they mean.

    http://www.hp.com/rnd/device_help/help/hpwnd/webhelp/HPJ4813A/configuration_vlan.htm

    that isnt for the specific switch i have, but the t/u/f/n list has to be the same…

    The modes are:

    Tagged - When a port is tagged, it allows communication among the different VLANs to which it is assigned.
    Untagged - When a port is untagged, it can only be a member on one VLAN.
    No - The port is not a member of that VLAN.
    Forbid - The port is "forbidden" to join that VLAN.

    am i right in assuming that No and Forbid can be used, loosely, if your main goal is to not allow a specific port(s) in a particular vlan?

    i know this is more of an HP specific question, but figure it wouldn't hurt to get the opinion of people who are morre familiar with vlans.


  • Netgate Administrator

    Congratulations!  ;D

    I'm not sure what the difference might be between 'No' and 'Forbid'.  :-\ I'd have to read the manual to try and find out. What switch model is it?

    The ping command uses the IGMP protocol. You can allow it specifically by setting a firewall rule with 'protocol - IGMP' or include it in a rule with 'protocol - *'.

    Yes, it's all firewall rules at this point.  ;)

    It's interesting that this worked and previous things didn't. It seems to confirm the fact that tagged and untagged packets on the same NIC can be a problem.
    Are all your NICs exactly the same?

    Steve



  • @stephenw10:

    Congratulations!  ;D

    I'm not sure what the difference might be between 'No' and 'Forbid'.  :-\ I'd have to read the manual to try and find out. What switch model is it?

    The ping command uses the IGMP protocol. You can allow it specifically by setting a firewall rule with 'protocol - IGMP' or include it in a rule with 'protocol - *'.

    Yes, it's all firewall rules at this point.  ;)

    It's interesting that this worked and previous things didn't. It seems to confirm the fact that tagged and untagged packets on the same NIC can be a problem.
    Are all your NICs exactly the same?

    Steve

    mabye i wasnt tagging/untagging properly last time.  there was some back and forth between configuration, i might have been tagging/untagging for the wrong wiring configuration.

    or maybe i was doing it right and the card isnt vlan friendly, not sure.

    the on board NIC on the motherboard is probably different than the two NICs that i have in the PCI slots.  the two NICs in the PCI slots are identical (re1, re2).

    i am not worried about the LAN rules being as open as they are, if anything this is a 'test' lab, but i am going to go and enforce some rules to deny traffic between networks.

    i want to do two things now that i got this far:

    1- figure out why vlan 100 was T U U U E E E E and not T T T T E E E E.  you wrote your your explanation, but i need to read it again.  this goes back to why vlans were confusing me.  i assumed the 4 ports i wanted on vlan100 would be tagged for vlan100, but for some reason it is only the port that talks to the pfsense vlan100 NIC.  the E's make sense in both vlan1 and 100.  Even the Us in vlan 1 make sense.

    2- now that i got the vlan working, i want to test a second vlan on NIC re1 (2 vlans on 1 NIC.).  i am going to create vlan200 and see if i can get that working (but not until i focus more time on 1 to better understand the tagging/untagging.  if i dont get that figured out, there is no point in moving forward.

    the switch with the No/Forbid is a HP ProCurve Switch 2810-24 G.


Log in to reply