Setting up a VLAN part 2



  • no no, i just ask that you got it working. Congrats, hopefully i could help you even a bit



  • ok, just added a 24 port vlan switch and added a 3rd vlan…vlan 200 172.10.10.x

    now that i figured out the tagging/untagging, it was pretty easy to configure the switch.

    i must say, documentation is key with vlans.  i logged into the switch and used the port name and wrote in the vlan it belongs to, but i also have it written down on paper.

    this is what my switch config looks like (this switch doesnt use E for exclude, it uses N, which has been posted already).

    vlan1- U U U U U U U U N N N N N N- 192.168.1.x
    vlan100- N N N N N N N N T U U U N N- 10.10.10.x
    vlan200- N N N N N N N N T N N N U U- 172.10.10.x

    i was able to hit the internet with a PC using a dhcp address from the 172 range and i stopped at 14 ports.

    now that i got the hang of this, linking another VLAN switch should be easy.  i just need to make sure that i tag the ports on the other switch to work with the respective vlans...1, 100, 200



  • That's true until you hit unmanaged switch, then you can use only one vlan on that port of managed switch and that should be untagged



  • @Metu69salemi:

    That's true until you hit unmanaged switch, then you can use only one vlan on that port of managed switch and that should be untagged

    right, if i want to do multiple vlans on other switches they need to be vlan switches.  i follow what you are saying.

    right now one of the untagged ports for vlan1 is plugged into a 16 port netgear switch, that switch can only operate on 1 subnet since it isnt vlan capable, in this case 192.168.1.x.



  • finished adding some block rules to stop traffic between vlans. disabled it one way to test, enabled it again, did some more testing, the rules did exactly what they were suppose to do.

    dns question- i can ping other IPs, but i cant browse by going to \pc-name

    any idea what i need to do to get that working?

    i can access \ip-address w/o any issues, which is why i assume DNS.

    the dhcp server settings for LAN is what i used as a template for vlan100 and 200 and my LAN DNS lookups work fine.



  • where you do have dns setup?

    @tomdlgns:

    right now one of the untagged ports for vlan1 is plugged into a 16 port netgear switch, that switch can only operate on 1 subnet since it isnt vlan capable, in this case 192.168.1.x.

    You can also use another vlan if you require


  • Netgate Administrator

    I assume you are using DNS forwarding on pfSense for your DNS service. That's the default.
    You can have pfSense add any client that sends it's host name to the local DNS table.
    Go to Services: DNS Forwarder: and check 'Register DHCP leases in DNS forwarder'.

    This will only kick in when clients renew their DHCP lease so you may have to force that to test.

    Steve



  • @Metu69salemi:

    where you do have dns setup?

    it is the default setup.  the only thing i did was point to OpenDNS servers for lookups (and removed the first entry of 127.0.0.1).



  • @stephenw10:

    I assume you are using DNS forwarding on pfSense for your DNS service. That's the default.
    You can have pfSense add any client that sends it's host name to the local DNS table.
    Go to Services: DNS Forwarder: and check 'Register DHCP leases in DNS forwarder'.

    This will only kick in when clients renew their DHCP lease so you may have to force that to test.

    Steve

    ok, just did this, i will delete DHCP leases and remote reboot machines and see if that fixes it.

    EDIT- now that i think of it…the device i was trying to access by hostname was statically assigned, this option looks like it is only DHCP related.  that device will never ask for a new address since it is static.


  • Netgate Administrator

    You can add static dhcp IPs with an option on that same page. Or if you have statically assigned the IP on the client itself you can add it manually in the host overrides table at the bottom.

    If I need to have anything static I always use static DHCP rather then IPs coded at the client. It makes this sort of thing far easier. Also if I do have to change the IP ever it's all centrally stored.

    Steve



  • @stephenw10:

    You can add static dhcp IPs with an option on that same page. Or if you have statically assigned the IP on the client itself you can add it manually in the host overrides table at the bottom.

    If I need to have anything static I always use static DHCP rather then IPs coded at the client. It makes this sort of thing far easier. Also if I do have to change the IP ever it's all centrally stored.

    Steve

    makes sense and i am going to look into that, thank you.

    ok, i did that, i added the entry for the static device.

    when i ping it, it resolves to a public internet address not the internal IP…..hmmmm


  • Netgate Administrator

    You may have to clear the local dns cache. Make sure your client is using the DNS forwarder.
    You can try using the Diagnostics: DNS Lookup: tool to check pfSense can resolve it correctly.

    Steve



  • @stephenw10:

    You may have to clear the local dns cache. Make sure your client is using the DNS forwarder.
    You can try using the Diagnostics: DNS Lookup: tool to check pfSense can resolve it correctly.

    Steve

    DNS lookup in pfsense can see the correct name if i type in the ip and it shows the correct ip if i type in the name.

    but it uses 127.0.0.1, then 208.67.222.222, 208.67.220.220, finally 192.168.1.1

    i do want my machines to use openDNS server for external lookups, but obviously not for internal lookups, which is what i think it happening, but i could be wrong.

    local cache cleared and my ipconfig looks like this

    ip- 172.10.10.210
    sub- /24
    gate- 172.10.10.1

    dns- 172.10.10.1


  • Netgate Administrator

    127.0.0.1 is the local machine, which it is checking first. That seems correct. I don't know why it's looking at 192.168.1.1 though, that sounds wrong.
    See my screenshots.

    Steve






  • i know 127 is localhost, but i removed that from the DNS page.

    my DNS forwarders are 208.67.222.222, 208.67.220.220, and 192.168.1.1 (for devices that sometimes grab 3 DNS IPs.

    although, 192.168.1.1 might be wrong and i probably shouldn't keep it in there now that i no longer have a flat network.


  • Netgate Administrator

    @tomdlgns:

    my DNS forwarders are 208.67.222.222, 208.67.220.220, and 192.168.1.1 (for devices that sometimes grab 3 DNS IPs.

    You mean in System: General Setup: DNS Servers: ?

    That should only list external DNS servers that pfSense uses for DNS resolution.

    Steve



  • @stephenw10:

    @tomdlgns:

    my DNS forwarders are 208.67.222.222, 208.67.220.220, and 192.168.1.1 (for devices that sometimes grab 3 DNS IPs.

    You mean in System: General Setup: DNS Servers: ?

    That should only list external DNS servers that pfSense uses for DNS resolution.

    Steve

    ok, no problem, i will remove the 192 entry, if i do that, then only the openDNS servers remain, but those are in spot 1,2 right now so i dont think it will fix my issue, but i will still remove it.

    thanks.


  • Netgate Administrator

    Ok. Well yes it has to first use the local DNS table so 127.0.0.1 should show first as in my screenshot.
    Where exactly did you remove 127.0.0.1 from?

    pfSense will always use the local DNS table first unless you have checked 'Do not use the DNS Forwarder as a DNS server for the firewall' in System: General Setup: DNS Servers:

    Steve



  • @stephenw10:

    Ok. Well yes it has to first use the local DNS table so 127.0.0.1 should show first as in my screenshot.
    Where exactly did you remove 127.0.0.1 from?

    pfSense will always use the local DNS table first unless you have checked 'Do not use the DNS Forwarder as a DNS server for the firewall' in System: General Setup: DNS Servers:

    Steve

    i didnt remove it, i thought i saw an option to uncheck the use of it.


  • Netgate Administrator

    Hmm, that looks fine. Exactly as I have mine set.

    Yet when you use Diagnostics: DNS Lookup: it doesn't use 127.0.0.1?

    Steve



  • ok, i just added 127.0.0.1 as the first entry and bumped down the openDNS servers.



  • @stephenw10:

    Hmm, that looks fine. Exactly as I have mine set.

    Yet when you use Diagnostics: DNS Lookup: it doesn't use 127.0.0.1?

    Steve

    yeah, i think i am going to take it out, if yours doesnt have 127.0.0.1 listed as the first one.



  • this is what my settings are as of this post:

    C:>ping ds2411

    Pinging ds2411.home [192.168.1.254] with 32 bytes of data:
    Reply from 192.168.1.254: bytes=32 time<1ms TTL=64
    Reply from 192.168.1.254: bytes=32 time<1ms TTL=64
    Reply from 192.168.1.254: bytes=32 time<1ms TTL=64
    Reply from 192.168.1.254: bytes=32 time<1ms TTL=64

    Ping statistics for 192.168.1.254:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 0ms, Maximum = 0ms, Average = 0ms

    C:>



  • i think it is a mac thing.  i was trying to ping from my MBP and it was coming back with ds2411 as a public IP address 67.25.xxx.xxx i only x it out because i am not by my MBP and i dont remember the rest of the address.

    good news- the option you told me to check a few posts backs when you brought up DHCP worked for windows computers, i tested two computers that were resolving ds2411 to 67.25…..and they now resolve to the correct internal 192.168.1.254 address.

    bad news- not working for my mbp.  i tried clearing the cache and releasing/renewing ip...nothing, maybe a reboot?  i havent had the mbp for a long time, not an expert with it/settings on it.


  • Netgate Administrator

    Hmm, well I have almost no mac experience so I'm probably no help.
    I would guess that it's using an external dns server some reason. Seems odd though.

    What external address is it resolving to? Your WAN address?

    Steve



  • @stephenw10:

    Hmm, well I have almost no mac experience so I'm probably no help.
    I would guess that it's using an external dns server some reason. Seems odd though.

    What external address is it resolving to? Your WAN address?

    Steve

    no, i have no clue, let me see if putting it in google tells me anything.

    edit- it looks like that IP address belongs to/is an address that openDNS uses/works with for failed lookups.

    it makes sense since i open up a cmd prompt and typed in ping afffaasdf

    it came back with the same 67.215 IP address that i get when i type ping ds2411 from the mac.

    no worries, this isnt related to pfsense or vlans or DNS since all my other machines are working w/o issues.



  • ok, now lets talk about getting two vlan switches to talk.

    right now this is what both switches look like.

    8 port-

    1- E E E U U U U U
    100- T U E E E E E E
    200- T E U E E E E E

    24 port-

    1- U U U U U U U U E E E E E E U U U U U U U U U U
    100- E E E E E E E E T U U U E E E E E E E E E E E E
    200- E E E E E E E E T E E E U U E E E E E E E E E E

    i know i have to link the respective vlan ports to each vlan switch, but do the packets stay labeled as i have them above? or do i need to switch a few things around when linking from switch to switch?


  • Netgate Administrator

    When you link from switch to switch you can send all the VLANs along a trunk connection, the same as you do to pfSense.
    So you have one cable connected between the switches. The port that that cable is connected to is set as 'tagged' in each VLAN you want to send along it at both ends.

    I'm not sure how you have your 24-port switch connected so I can't give you an exact switch config.

    Steve



  • @stephenw10:

    When you link from switch to switch you can send all the VLANs along a trunk connection, the same as you do to pfSense.
    So you have one cable connected between the switches. The port that that cable is connected to is set as 'tagged' in each VLAN you want to send along it at both ends.

    I'm not sure how you have your 24-port switch connected so I can't give you an exact switch config.

    Steve

    the 24 port switch is connected to the 8 port switch as follows:

    port 4 on HP-switch8 goes to port 8 on HP-switch24.

    however, i dont think the proper tags are in place.

    EDIT-
    both tags are marked as U and it looks like they both need to be changed to T, correct?



  • ok, marked port 4 in the 8 port switch from U to T

    and marked port 8 in the 24 port switch from U to T

    everything seems to be operating as it should.



  • Like i tried to say several times, if no vlan support on switch/client use untagged.
    If vlan support exists then use tagging


  • Netgate Administrator

    In your diagram above port 4 on Switch8 and port 8 on Switch24 are marked E for both VLANs.
    Did you change them to U subsequently?
    They should be T as you said.

    Steve



  • @stephenw10:

    In your diagram above port 4 on Switch8 and port 8 on Switch24 are marked E for both VLANs.
    Did you change them to U subsequently?
    They should be T as you said.

    Steve

    i am working with vlan 1, i see them as Us in my post above, but yes, i did change them to T before you replied.

    8 port-

    vlan1- E E E U U U U U

    24 port-

    vlan1- U U U U U U U U E E E E E E U U U U U U U U U U

    current config of vlan1 on both switches is as follows:

    8 port-

    vlan1- E E E T U U U U

    24 port-

    vlan1- U U U U U U U T E E E E E E U U U U U U U U U U



  • @Metu69salemi:

    Like i tried to say several times, if no vlan support on switch/client use untagged.
    If vlan support exists then use tagging

    these are both vlan switches.



  • @stephenw10:

    In your diagram above port 4 on Switch8 and port 8 on Switch24 are marked E for both VLANs.
    Did you change them to U subsequently?
    They should be T as you said.

    Steve

    did i mess up or did you miss something?

    your post is correct in that the ports were marked as E, but not on the same vlan that i was referring to.

    thanks.


  • Netgate Administrator

    No I didn't realise you were refering to VLAN1.

    This is where is gets confusing. VLAN1, the default VLAN, is usually only ever tagged within the switch. Although you can send it tagged between switches you could equally send it untagged with no difference in the logical network layout.

    Anyway I think you have it correct.

    Steve



  • @stephenw10:

    No I didn't realise you were refering to VLAN1.

    This is where is gets confusing. VLAN1, the default VLAN, is usually only ever tagged within the switch. Although you can send it tagged between switches you could equally send it untagged with no difference in the logical network layout.

    Anyway I think you have it correct.

    Steve

    ok, well now that we are on the same page, see if you can help me out with this…

    both my vlan switches are on the 192 network.

    8 port- 192.168.1.20
    24 port- 192.168.1.9

    for now, there are 0 rules in play to block vlans

    here is the issue.

    i get a laptop and join it to the 172 or 10 network, w/o any issues, i can ping 192.168.1.20 and 192.168.1.9...replies come back for both.

    i can web into the .20 8 port switch but i cant web into the .9 port switch.

    do you know why that is?

    everything is tagged as i typed it in my most recent tagged/untagged port above.

    not sure why i can ping and web into .20 but i can only ping .9 and not web into it.

    the .9 switch is more advanced, i wonder if there is some sort of option i am missing?  i am almost certain in the 24 port, .9, switch each vlan can have its own gateway address and i know i set the gateway for vlan1 at 192.168.1.1, but i dont know that would cause me to not be able to web into it, locally.

    thanks.


  • Netgate Administrator

    Hmmm.
    The 24 port switch is significantly more complex.
    It may have a setting that limits web GUI access to clients from it's own subnet. Since you are trying to access it routed via pfSense it would block that connection. This is relatively common.

    Steve



  • @stephenw10:

    Hmmm.
    The 24 port switch is significantly more complex.
    It may have a setting that limits web GUI access to clients from it's own subnet. Since you are trying to access it routed via pfSense it would block that connection. This is relatively common.

    Steve

    ok good, that makes me feel a little better about not being able to connect to it.

    thanks for your help.


Log in to reply