Setting up a VLAN part 2



  • @stephenw10:

    Yes try my last suggestion. It should work, then again I thought that before!  ::)

    Steve

    ok thanks, will try that

    can you explain why only 1 port is Tagges on vlan100?

    port:        1 2 3 4 5 6 7 8
    vlan1:      E E E E U U U U
    vlan100:    T U U U E E E E

    why isnt vlan100: T T T T E E E E

    i understand why vlan1 is E E E E (those ports are for vlan100) and U U U U on vlan100 are untagged packets for the 192.168.1.x network, correct?


  • Netgate Administrator

    The three different port modes are like this as I understand it, though I don't actually have an HP switch:

    E - Exclude this port from VLANX. I.e. any packets arriving on the port from outside tagged VLANX will be disgarded and any packets inside the switch tagged VLANX will not switched to this port.

    U - Untagged port. I.e. packets in the switch tagged VLANX can be switched to this port and will have tags removed when leaving. Untagged packets arriving on this port will be tagged VLANX upon entering the switch.

    T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
    Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.

    In the switch configuration packets arriving at ports 2, 3 or 4 will be tagged VLAN100 as they enter the switch. They can then be switched to any other port participating in VLAN100 (1-4). If the packet is addressed to the internet somewhere it will be switched to port 1 where it leaves the switch still tagged and arrives at re1 where the pfSense VLAN100 interface is setup to receive it and route it appropriately.

    Returning packets are sent to the switch from pfSense tagged VLAN100. Port 1 allows them to enter the switch and they are switched to the correct port. On leaving the port (2-4) the VLAN tagging removed so that the pakets arrive back at the client untagged and able to received.

    Steve



  • @stephenw10:

    The three different port modes are like this as I understand it, though I don't actually have an HP switch:

    E - Exclude this port from VLANX. I.e. any packets arriving on the port from outside tagged VLANX will be disgarded and any packets inside the switch tagged VLANX will not switched to this port.

    U - Untagged port. I.e. packets in the switch tagged VLANX can be switched to this port and will have tags removed when leaving. Untagged packets arriving on this port will be tagged VLANX upon entering the switch.

    T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
    Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.

    In the switch configuration packets arriving at ports 2, 3 or 4 will be tagged VLAN100 as they enter the switch. They can then be switched to any other port participating in VLAN100 (1-4). If the packet is addressed to the internet somewhere it will be switched to port 1 where it leaves the switch still tagged and arrives at re1 where the pfSense VLAN100 interface is setup to receive it and route it appropriately.

    Returning packets are sent to the switch from pfSense tagged VLAN100. Port 1 allows them to enter the switch and they are switched to the correct port. On leaving the port (2-4) the VLAN tagging removed so that the pakets arrive back at the client untagged and able to received.

    Steve

    i am going to read that over a few times.  at first glance i am pretty confident that your explanation was very good, it makes sense.  i wish you posted that on page 1.

    ;D



  • @stephenw10:

    Yes try my last suggestion. It should work, then again I thought that before!  ::)

    Steve

    so far so good, we are making progress.

    192 PCs are working and my laptop, plugged into port 2 with port 1 going to re1 like you said is giving out a 10.10.10.x ip address.

    however, we are not done yet.

    the pc on the 10.10.10.x network cant hit the internet.

    do i need to write a firewall rule for that?

    EDIT- ok, i decided to add another port, port 4, away from vlan100 and into vlan1 (the default VLAN).

    i marked it as U in vlan 1 and E in vlan100 and saved…no issues, works well. :)

    i finally feel like i am making some progress being able to get this somewhat working and seeing it physically plugged in.

    once i get some more help (fingers crossed) regarding the 10.10.10.x PC not being able to hit the internet, i am going to document this setup so i know what it takes to get it up.


  • Netgate Administrator

    If your PC on the VLAN100 port is receiving DHCP then you're 99% there.  :)

    Yes you need to put a firewall on the VLAN100 interface (OPT1 or whatever you have called it) to allow access to the internet.
    You can use the default rule on LAN as a template but bare in mind that's a very open rule.

    Steve



  • @stephenw10:

    If your PC on the VLAN100 port is receiving DHCP then you're 99% there.  :)

    Yes you need to put a firewall on the VLAN100 interface (OPT1 or whatever you have called it) to allow access to the internet.
    You can use the default rule on LAN as a template but bare in mind that's a very open rule.

    Steve

    thanks.

    how about ping?  my pc grabbed 10.10.10.210, the first ip in the range, but i couldnt ping 10.10.10.0 or .1 do i need to write a rule for that?  i had another PC on vlan100 and i couldnt ping it.

    however, from a 192.168.1.x computer, i was able to ping 10.10.10.210 i was happy to see replies, but i expected to get 0 replies from the start w/o writing rules for that stuff.

    EDIT- FINALLY ONLINE WITH A PC ON THE VLAN…..YESSSSSSSSSSSS

    EDIT- now that the wide open rules are open (* everywhere) i can ping 10.10.10.1.  as i stated in the post below, i believe it is all firewall rules at this point.  obviously i dont want VLANs talking to each other.  some, maybe, but not all.



  • my LAN rule is

    protocol- *
    source- LAN net
    port- *
    destination- *
    port- *
    gate- *
    queue- none

    that is the default rule for LAN.  since there are no rules to deny vlan subnets is that why i can ping?

    now that i made rules for VLAN, i can ping 192 addresses from the 10 network.

    i assume this is all firewall rules at this point?



  • @stephenw10:

    The three different port modes are like this as I understand it, though I don't actually have an HP switch:

    E - Exclude this port from VLANX. I.e. any packets arriving on the port from outside tagged VLANX will be disgarded and any packets inside the switch tagged VLANX will not switched to this port.

    U - Untagged port. I.e. packets in the switch tagged VLANX can be switched to this port and will have tags removed when leaving. Untagged packets arriving on this port will be tagged VLANX upon entering the switch.

    T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
    Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.

    In the switch configuration packets arriving at ports 2, 3 or 4 will be tagged VLAN100 as they enter the switch. They can then be switched to any other port participating in VLAN100 (1-4). If the packet is addressed to the internet somewhere it will be switched to port 1 where it leaves the switch still tagged and arrives at re1 where the pfSense VLAN100 interface is setup to receive it and route it appropriately.

    Returning packets are sent to the switch from pfSense tagged VLAN100. Port 1 allows them to enter the switch and they are switched to the correct port. On leaving the port (2-4) the VLAN tagging removed so that the pakets arrive back at the client untagged and able to received.

    Steve

    i have access to another HP switch (not the one i am using in this thread) and it looks a little more vlan friendly, these are the options and what they mean.

    http://www.hp.com/rnd/device_help/help/hpwnd/webhelp/HPJ4813A/configuration_vlan.htm

    that isnt for the specific switch i have, but the t/u/f/n list has to be the same…

    The modes are:

    Tagged - When a port is tagged, it allows communication among the different VLANs to which it is assigned.
    Untagged - When a port is untagged, it can only be a member on one VLAN.
    No - The port is not a member of that VLAN.
    Forbid - The port is "forbidden" to join that VLAN.

    am i right in assuming that No and Forbid can be used, loosely, if your main goal is to not allow a specific port(s) in a particular vlan?

    i know this is more of an HP specific question, but figure it wouldn't hurt to get the opinion of people who are morre familiar with vlans.


  • Netgate Administrator

    Congratulations!  ;D

    I'm not sure what the difference might be between 'No' and 'Forbid'.  :-\ I'd have to read the manual to try and find out. What switch model is it?

    The ping command uses the IGMP protocol. You can allow it specifically by setting a firewall rule with 'protocol - IGMP' or include it in a rule with 'protocol - *'.

    Yes, it's all firewall rules at this point.  ;)

    It's interesting that this worked and previous things didn't. It seems to confirm the fact that tagged and untagged packets on the same NIC can be a problem.
    Are all your NICs exactly the same?

    Steve



  • @stephenw10:

    Congratulations!  ;D

    I'm not sure what the difference might be between 'No' and 'Forbid'.  :-\ I'd have to read the manual to try and find out. What switch model is it?

    The ping command uses the IGMP protocol. You can allow it specifically by setting a firewall rule with 'protocol - IGMP' or include it in a rule with 'protocol - *'.

    Yes, it's all firewall rules at this point.  ;)

    It's interesting that this worked and previous things didn't. It seems to confirm the fact that tagged and untagged packets on the same NIC can be a problem.
    Are all your NICs exactly the same?

    Steve

    mabye i wasnt tagging/untagging properly last time.  there was some back and forth between configuration, i might have been tagging/untagging for the wrong wiring configuration.

    or maybe i was doing it right and the card isnt vlan friendly, not sure.

    the on board NIC on the motherboard is probably different than the two NICs that i have in the PCI slots.  the two NICs in the PCI slots are identical (re1, re2).

    i am not worried about the LAN rules being as open as they are, if anything this is a 'test' lab, but i am going to go and enforce some rules to deny traffic between networks.

    i want to do two things now that i got this far:

    1- figure out why vlan 100 was T U U U E E E E and not T T T T E E E E.  you wrote your your explanation, but i need to read it again.  this goes back to why vlans were confusing me.  i assumed the 4 ports i wanted on vlan100 would be tagged for vlan100, but for some reason it is only the port that talks to the pfsense vlan100 NIC.  the E's make sense in both vlan1 and 100.  Even the Us in vlan 1 make sense.

    2- now that i got the vlan working, i want to test a second vlan on NIC re1 (2 vlans on 1 NIC.).  i am going to create vlan200 and see if i can get that working (but not until i focus more time on 1 to better understand the tagging/untagging.  if i dont get that figured out, there is no point in moving forward.

    the switch with the No/Forbid is a HP ProCurve Switch 2810-24 G.


  • Netgate Administrator

    Ok, reading the relevant manual for that switch:
    http://ftp.hp.com/pub/networking/software/2810-AdvTrafficMgmt-July2007-59914733.pdf

    For static VLANs, which we are using here, No is equivalent to Exclude.
    You would only use 'forbid' when using Dymanic VLANs (see GVRP). This is way beyond my experience is something that you're very unlikely to need.  ;)

    Steve



  • @stephenw10:

    Ok, reading the relevant manual for that switch:
    http://ftp.hp.com/pub/networking/software/2810-AdvTrafficMgmt-July2007-59914733.pdf

    For static VLANs, which we are using here, No is equivalent to Exclude.
    You would only use 'forbid' when using Dymanic VLANs (see GVRP). This is way beyond my experience is something that you're very unlikely to need.  ;)

    Steve

    yeah, i agree, i was going to stick with no.



  • @stephenw10:

    The three different port modes are like this as I understand it, though I don't actually have an HP switch:

    E - Exclude this port from VLANX. I.e. any packets arriving on the port from outside tagged VLANX will be disgarded and any packets inside the switch tagged VLANX will not switched to this port.

    U - Untagged port. I.e. packets in the switch tagged VLANX can be switched to this port and will have tags removed when leaving. Untagged packets arriving on this port will be tagged VLANX upon entering the switch.

    T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
    Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.

    In the switch configuration packets arriving at ports 2, 3 or 4 will be tagged VLAN100 as they enter the switch. They can then be switched to any other port participating in VLAN100 (1-4). If the packet is addressed to the internet somewhere it will be switched to port 1 where it leaves the switch still tagged and arrives at re1 where the pfSense VLAN100 interface is setup to receive it and route it appropriately.

    Returning packets are sent to the switch from pfSense tagged VLAN100. Port 1 allows them to enter the switch and they are switched to the correct port. On leaving the port (2-4) the VLAN tagging removed so that the pakets arrive back at the client untagged and able to received.

    Steve

    ok, if i am understanding this correct, will my next vlan look like this?

    vlan1- E E E E E E U U (re2) ports 7,8 operate on 192.168.1.x

    vlan 100- T U U U E E E E (re1) ports 1,2,3,4 operate on 10.10.10.x

    vlan 200- T E E E U U E E (re1) ports 5,6 operate on 172.10.10.x (new VLAN i will create)

    my only question (assuming i did it right) is…am i right in tagging port 1 in vlan100 and vlan200 since it shares the same cable/nic to pfsense?


  • Netgate Administrator

    Yes looks good.  :)
    In this setup you will have only one port available for 192.168.1.X clients since the other is linked back to re2. This means you can still access the switch GUI on that subnet though.

    Steve



  • @stephenw10:

    Yes looks good.  :)
    In this setup you will have only one port available for 192.168.1.X clients since the other is linked back to re2. This means you can still access the switch GUI on that subnet though.

    Steve

    ok good, i think i am picking up on vlans.

    actually, that one port plugs into a 16 port netgear switch, so anything on that switch is also 192 and will also be able to hit pfsense since it is on the 192.168.1.x subnet.

    EDIT- so for every additional vlan i create, port 1 will always be tagged, assuming the vlan connects back to the same NIC in pfsense?  i only bring it up because the other hp switch i have access to has 24 ports, so i can create more vlans and assign them to re1.  and if i did that, port 1 in every vlan would always be tagged, right?…..that is what i gathered after reading this:

    T - Tagged port. Packets tagged VLANX inside the switch can be switched to this port and leave the switch still tagged. Packets arriving at the switch tagged VLANX are allowed to enter.
    Confusingly this this port type is also referred to as a trunk port because it can be a member of many vlans carrying all traffic to your router.


  • Netgate Administrator

    @tomdlgns:

    ok good, i think i am picking up on vlans.

    Yep.  ;)

    @tomdlgns:

    actually, that one port plugs into a 16 port netgear switch, so anything on that switch is also 192 and will also be able to hit pfsense since it is on the 192.168.1.x subnet.

    Not a problem then.

    @tomdlgns:

    EDIT- so for every additional vlan i create, port 1 will always be tagged, assuming the vlan connects back to the same NIC in pfsense?  i only bring it up because the other hp switch i have access to has 24 ports, so i can create more vlans and assign them to re1.  and if i did that, port 1 in every vlan would always be tagged, right?

    Yes you always need to add the pfSense connection as a tagged port in order to allow VLAN tagged packets to make it back pfSense where it can be received by the VLAN interface.

    Assuming port1 is connected to re1, and that re1 has VLAN interfaces setup on it (as it is currently) then yes you would add this as tagged to every VLAN. (except VLAN1!)

    Once you have a good grip on this you can try something interesting like connecting your second switch to the first one. Then it's possible to send VLANs between the switches using tagged ports on the connecting cable. But one step at a time!  ;)

    Steve



  • @stephenw10:

    @tomdlgns:

    ok good, i think i am picking up on vlans.

    Yep.  ;)

    @tomdlgns:

    actually, that one port plugs into a 16 port netgear switch, so anything on that switch is also 192 and will also be able to hit pfsense since it is on the 192.168.1.x subnet.

    Not a problem then.

    @tomdlgns:

    EDIT- so for every additional vlan i create, port 1 will always be tagged, assuming the vlan connects back to the same NIC in pfsense?  i only bring it up because the other hp switch i have access to has 24 ports, so i can create more vlans and assign them to re1.  and if i did that, port 1 in every vlan would always be tagged, right?

    Yes you always need to add the pfSense connection as a tagged port in order to allow VLAN tagged packets to make it back pfSense where it can be received by the VLAN interface.

    Assuming port1 is connected to re1, and that re1 has VLAN interfaces setup on it (as it is currently) then yes you would add this as tagged to every VLAN. (except VLAN1!)

    Once you have a good grip on this you can try something interesting like connecting your second switch to the first one. Then it's possible to send VLANs between the switches using tagged ports on the connecting cable. But one step at a time!  ;)

    Steve

    Assuming port1 is connected to re1, and that re1 has VLAN interfaces setup on it (as it is currently) then yes you would add this as tagged to every VLAN. (except VLAN1!)

    correct, vlan1 is untouched from what i have above.

    Once you have a good grip on this you can try something interesting like connecting your second switch to the first one. Then it's possible to send VLANs between the switches using tagged ports on the connecting cable. But one step at a time!  ;)

    this is exactly the next thing i was going to try once i got vlan200 setup.  i wont even ask my question until i can successfully get vlan200 up and online.

    thanks for the help.



  • so you finally had it?



  • @Metu69salemi:

    so you finally had it?

    i finally got it, yes.

    Edit- or are you asking if i have had enough of vlans?  ???



  • no no, i just ask that you got it working. Congrats, hopefully i could help you even a bit



  • ok, just added a 24 port vlan switch and added a 3rd vlan…vlan 200 172.10.10.x

    now that i figured out the tagging/untagging, it was pretty easy to configure the switch.

    i must say, documentation is key with vlans.  i logged into the switch and used the port name and wrote in the vlan it belongs to, but i also have it written down on paper.

    this is what my switch config looks like (this switch doesnt use E for exclude, it uses N, which has been posted already).

    vlan1- U U U U U U U U N N N N N N- 192.168.1.x
    vlan100- N N N N N N N N T U U U N N- 10.10.10.x
    vlan200- N N N N N N N N T N N N U U- 172.10.10.x

    i was able to hit the internet with a PC using a dhcp address from the 172 range and i stopped at 14 ports.

    now that i got the hang of this, linking another VLAN switch should be easy.  i just need to make sure that i tag the ports on the other switch to work with the respective vlans...1, 100, 200



  • That's true until you hit unmanaged switch, then you can use only one vlan on that port of managed switch and that should be untagged



  • @Metu69salemi:

    That's true until you hit unmanaged switch, then you can use only one vlan on that port of managed switch and that should be untagged

    right, if i want to do multiple vlans on other switches they need to be vlan switches.  i follow what you are saying.

    right now one of the untagged ports for vlan1 is plugged into a 16 port netgear switch, that switch can only operate on 1 subnet since it isnt vlan capable, in this case 192.168.1.x.



  • finished adding some block rules to stop traffic between vlans. disabled it one way to test, enabled it again, did some more testing, the rules did exactly what they were suppose to do.

    dns question- i can ping other IPs, but i cant browse by going to \pc-name

    any idea what i need to do to get that working?

    i can access \ip-address w/o any issues, which is why i assume DNS.

    the dhcp server settings for LAN is what i used as a template for vlan100 and 200 and my LAN DNS lookups work fine.



  • where you do have dns setup?

    @tomdlgns:

    right now one of the untagged ports for vlan1 is plugged into a 16 port netgear switch, that switch can only operate on 1 subnet since it isnt vlan capable, in this case 192.168.1.x.

    You can also use another vlan if you require


  • Netgate Administrator

    I assume you are using DNS forwarding on pfSense for your DNS service. That's the default.
    You can have pfSense add any client that sends it's host name to the local DNS table.
    Go to Services: DNS Forwarder: and check 'Register DHCP leases in DNS forwarder'.

    This will only kick in when clients renew their DHCP lease so you may have to force that to test.

    Steve



  • @Metu69salemi:

    where you do have dns setup?

    it is the default setup.  the only thing i did was point to OpenDNS servers for lookups (and removed the first entry of 127.0.0.1).



  • @stephenw10:

    I assume you are using DNS forwarding on pfSense for your DNS service. That's the default.
    You can have pfSense add any client that sends it's host name to the local DNS table.
    Go to Services: DNS Forwarder: and check 'Register DHCP leases in DNS forwarder'.

    This will only kick in when clients renew their DHCP lease so you may have to force that to test.

    Steve

    ok, just did this, i will delete DHCP leases and remote reboot machines and see if that fixes it.

    EDIT- now that i think of it…the device i was trying to access by hostname was statically assigned, this option looks like it is only DHCP related.  that device will never ask for a new address since it is static.


  • Netgate Administrator

    You can add static dhcp IPs with an option on that same page. Or if you have statically assigned the IP on the client itself you can add it manually in the host overrides table at the bottom.

    If I need to have anything static I always use static DHCP rather then IPs coded at the client. It makes this sort of thing far easier. Also if I do have to change the IP ever it's all centrally stored.

    Steve



  • @stephenw10:

    You can add static dhcp IPs with an option on that same page. Or if you have statically assigned the IP on the client itself you can add it manually in the host overrides table at the bottom.

    If I need to have anything static I always use static DHCP rather then IPs coded at the client. It makes this sort of thing far easier. Also if I do have to change the IP ever it's all centrally stored.

    Steve

    makes sense and i am going to look into that, thank you.

    ok, i did that, i added the entry for the static device.

    when i ping it, it resolves to a public internet address not the internal IP…..hmmmm


  • Netgate Administrator

    You may have to clear the local dns cache. Make sure your client is using the DNS forwarder.
    You can try using the Diagnostics: DNS Lookup: tool to check pfSense can resolve it correctly.

    Steve



  • @stephenw10:

    You may have to clear the local dns cache. Make sure your client is using the DNS forwarder.
    You can try using the Diagnostics: DNS Lookup: tool to check pfSense can resolve it correctly.

    Steve

    DNS lookup in pfsense can see the correct name if i type in the ip and it shows the correct ip if i type in the name.

    but it uses 127.0.0.1, then 208.67.222.222, 208.67.220.220, finally 192.168.1.1

    i do want my machines to use openDNS server for external lookups, but obviously not for internal lookups, which is what i think it happening, but i could be wrong.

    local cache cleared and my ipconfig looks like this

    ip- 172.10.10.210
    sub- /24
    gate- 172.10.10.1

    dns- 172.10.10.1


  • Netgate Administrator

    127.0.0.1 is the local machine, which it is checking first. That seems correct. I don't know why it's looking at 192.168.1.1 though, that sounds wrong.
    See my screenshots.

    Steve






  • i know 127 is localhost, but i removed that from the DNS page.

    my DNS forwarders are 208.67.222.222, 208.67.220.220, and 192.168.1.1 (for devices that sometimes grab 3 DNS IPs.

    although, 192.168.1.1 might be wrong and i probably shouldn't keep it in there now that i no longer have a flat network.


  • Netgate Administrator

    @tomdlgns:

    my DNS forwarders are 208.67.222.222, 208.67.220.220, and 192.168.1.1 (for devices that sometimes grab 3 DNS IPs.

    You mean in System: General Setup: DNS Servers: ?

    That should only list external DNS servers that pfSense uses for DNS resolution.

    Steve



  • @stephenw10:

    @tomdlgns:

    my DNS forwarders are 208.67.222.222, 208.67.220.220, and 192.168.1.1 (for devices that sometimes grab 3 DNS IPs.

    You mean in System: General Setup: DNS Servers: ?

    That should only list external DNS servers that pfSense uses for DNS resolution.

    Steve

    ok, no problem, i will remove the 192 entry, if i do that, then only the openDNS servers remain, but those are in spot 1,2 right now so i dont think it will fix my issue, but i will still remove it.

    thanks.


  • Netgate Administrator

    Ok. Well yes it has to first use the local DNS table so 127.0.0.1 should show first as in my screenshot.
    Where exactly did you remove 127.0.0.1 from?

    pfSense will always use the local DNS table first unless you have checked 'Do not use the DNS Forwarder as a DNS server for the firewall' in System: General Setup: DNS Servers:

    Steve



  • @stephenw10:

    Ok. Well yes it has to first use the local DNS table so 127.0.0.1 should show first as in my screenshot.
    Where exactly did you remove 127.0.0.1 from?

    pfSense will always use the local DNS table first unless you have checked 'Do not use the DNS Forwarder as a DNS server for the firewall' in System: General Setup: DNS Servers:

    Steve

    i didnt remove it, i thought i saw an option to uncheck the use of it.


  • Netgate Administrator

    Hmm, that looks fine. Exactly as I have mine set.

    Yet when you use Diagnostics: DNS Lookup: it doesn't use 127.0.0.1?

    Steve



  • ok, i just added 127.0.0.1 as the first entry and bumped down the openDNS servers.


Log in to reply