Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VLAN Question, complete newbie [updated]

    Scheduled Pinned Locked Moved General pfSense Questions
    5 Posts 3 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • cmcdonaldC
      cmcdonald Netgate Developer
      last edited by

      So I'm trying to do some segmentation on my network and implement VLANs.

      I have a managed switch that comes default with every port untagged, VLAN ID 1.

      I thought, in theory, if I simply create a vlan in pfense, assign it to my lan interface (attached to the managed switch), everything should still work. What am I missing here?

      Need help fast? https://www.netgate.com/support

      1 Reply Last reply Reply Quote 0
      • W
        wallabybob
        last edited by

        When you configure a VLAN interface in pfSense you are effectively telling the kernel to give to the VLAN interface every packet arriving on the parent interface with a VLAN tag whose ID matches the VLAN ID configured in the VLAN interface. Hence for the VLAN interface to "work" the switch must provide suitable VLAN tags.

        You said you want to segment your network. Suppose you have two segments and assign them VLAN tags 10 and 20. (Keep away from the "default" VLAN tag.) The switch port connected to pfSense needs to be configured as a "trunk" port, expecting VLAN tags on input and providing VLAN tags on output (so pfSense will see the VLAN tags). It also needs to be configured as a member of VLANs 10 and 20 so it will give traffic on those VLANs to pfSense.

        Then you need to configure (probably as "untagged") the ports connecting to the client systems as  members of the appropriate VLANs.

        If this doesn't address your issue please provide more detail on what you configured, what you expect to happen and what doesn't happen.

        1 Reply Last reply Reply Quote 0
        • N
          NOYB
          last edited by

          Nope.  That won't work.

          pfSense VLAN is tagged and the switch port it is connected to must be configured as tagged member of that VLAN.

          As a fairly simple example consider this:

          Switch ports 1-6: PVID 1, Untagged Member VLAN 1 (typical default)

          Switch port 7: PVID 1, Untagged Member VLAN 1, Tagged Member VLAN 99 - Connected to pfSense
          Switch port 8: PVID 99, UnTagged Member VLAN 99 - Connected to ISP.

          pfSense WAN configured as VLAN ID 99, LAN (default config, no VLAN) - Connected to switch port 7.

          1 Reply Last reply Reply Quote 0
          • cmcdonaldC
            cmcdonald Netgate Developer
            last edited by

            Thank you guys very much! Clearly, I had no idea what I was doing but now my traffic is flowing again. Much appreciated. I'll keep this thread updated if I have any other questions about VLANs

            Just wanted to make sure that my logic is now correct.

            I am lab testing a UniFi AP on a managed switch and working on trunking several vlans to the AP to assign them to different SSIDs.

            Here is my basic config.

            Port 1 is connected to pfSense box.
            Port 2 is connected to AP

            VLAN10 = Management Network
            VLAN20 = Public WIFI
            VLAN30 = Secure WIFI

            VLANID Management    Port1    Port2  …..
            10              x              T        U
            20                              T        T
            30                              T        T

            SSID1 = VLAN20
            SSID2 = VLAN30

            This seems to work just fine. The AP uses the native vlan (is this the correct term?) for port 2 as the management interface for the AP. DHCP is enabled on all three vlans in pfSense and devices connecting to the different wifi networks obtain IPs successfully. It appears all is well. Now, my question pertains to inter-vlan routing. My switch is layer 2, so this will have to be done through my only layer 3 device, my pfsense box. Is this accomplished by firewall rules alone?

            Need help fast? https://www.netgate.com/support

            1 Reply Last reply Reply Quote 0
            • W
              wallabybob
              last edited by

              Provided everything is correctly configured, your inter-VLAN traffic will go to your pfSense box where it will be routed between the VLANs unless blocked on entry to the box by a firewall rule.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.