Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense & Netgear Smart Switch - VLAN Problems

    Scheduled Pinned Locked Moved
    General pfSense Questions
    3
    16
    6.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kars85
      last edited by

      @bennyc:

      I see you created the vlan, and configured the opt1.
      2 questions:

      • Did you assign opt1 correctly? (pse show me screenshot of interfaces -> (assign) )

      • Other than that, in the switch you only seem to have configured 1 interface (23) as vlan 10 member, and it's untagged?

      Not trying to be rude (open question here); what are you trying to accomplish? One interface on pfSense with multiple vlans, or just some vlans on your switch and equally as much physical connections on your pfSense?

      Hi Benny,

      Here's the assignment screeny showing i've assigned it to my physical LAN em0 interface.

      In terms of what my end game is with this, my employer has provided me with a Cisco CVO router that maintains a direct VPN connection to work for my Cisco IP Phone and laptop.  It is plugged into port 23 of my Netgear smart switch and the only port i need vlan tagging on.  I ultimately want the Cisco CVO appliance to be on a isolated network from the rest of my home network, yet connect in/outbound on my WAN interface.

      If I blow away the configurations I screenshotted above, it works great, as it has for months since using the CVO appliance.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Don't you need the pfSense connected port (trunk) to be assigned as tagged for VLAN10 in the switch?

        Steve

        1 Reply Last reply Reply Quote 1
        • K
          kars85
          last edited by

          @stephenw10:

          Don't you need the pfSense connected port (trunk) to be assigned as tagged for VLAN10 in the switch?

          Steve

          I'll try that.  Below are the screenshots of how VLAN 1 (mgmt) is, and has remained since day 1.  Is it OK that on VLAN1 that every port is untagged?

          Here is how I have VLAN10 setup, based on how I think you suggested. Unfortunately, no luck still :(

          1 Reply Last reply Reply Quote 0
          • K
            kars85
            last edited by

            EDIT:

            It looks like setting the port the pfSense router is plugged into the switch as to Trunk let it get a .10.x DHCP IP!

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              If you're still not seeing full success you may want to alter your firewall rule on OPT1 to include UDP (or all protocols) so that DNS can function.

              Steve

              1 Reply Last reply Reply Quote 0
              • B
                bennyc
                last edited by

                OK, getting the setup now (I think  ;))
                You took off well (approach). To directly answer your question on vlan1: yes, it is ok to have all members untagged.
                This means vlan1 will be your native vlan (the vlan without tagging (a dot1q field inserted))

                Port 23, where the cisco router is plugged in, should only belong untagged to vlan 10. (you should remove it from vlan1. Traffic entering this port (ingress) will be marked with the tag so it belongs to vlan 10, traffic leaving this port (egress) will get the tag removed (because your router doesn't need/understand the tag))

                Port 16, connected to em0, should be configured as untagged member for vlan1, and tagged member for vlan10 (already the case). Basicly what you have done by doing so, is creating a dot1q trunk on which traffic from vlan1 will go in and out un-altered, and traffic from vlan10 will be marked with that tag.

                For the config from pfSense, I could recommend you to open the proto(col) in the rules to IPv4 TCP/UDP, and allow all (*) for now. Most likely the cisco is configured for ipsec, and that requires upd (as does dhcp, what Steve already mentioned)
                Once everything is working, you can narrow down the rules if needed…

                Hope this helps...

                4x XG-7100 (2xHA), 1x SG-4860, 1x SG-2100
                1x PC Engines APU2C4, 1x PC Engines APU1C4

                1 Reply Last reply Reply Quote 1
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Good call, I forgot about removing port 23 from the default VLAN.

                  You probably want to allow only the required protocols if your purpose is to islate the Cisco device. Once you have it working you may want to tighten the firewall rules further to restrict the IPs that can connect to it.
                  DHCP requests are always allowed into an interface that is running a DHCP server but DNS is not.

                  Steve

                  Edit: typo

                  1 Reply Last reply Reply Quote 0
                  • K
                    kars85
                    last edited by

                    @bennyc:

                    OK, getting the setup now (I think  ;))
                    You took off well (approach). To directly answer your question on vlan1: yes, it is ok to have all members untagged.
                    This means vlan1 will be your native vlan (the vlan without tagging (a dot1q field inserted))

                    Port 23, where the cisco router is plugged in, should only belong untagged to vlan 10. (you should remove it from vlan1. Traffic entering this port (ingress) will be marked with the tag so it belongs to vlan 10, traffic leaving this port (egress) will get the tag removed (because your router doesn't need/understand the tag))

                    Port 16, connected to em0, should be configured as untagged member for vlan1, and tagged member for vlan10 (already the case). Basicly what you have done by doing so, is creating a dot1q trunk on which traffic from vlan1 will go in and out un-altered, and traffic from vlan10 will be marked with that tag.

                    For the config from pfSense, I could recommend you to open the proto(col) in the rules to IPv4 TCP/UDP, and allow all (*) for now. Most likely the cisco is configured for ipsec, and that requires upd (as does dhcp, what Steve already mentioned)
                    Once everything is working, you can narrow down the rules if needed…

                    Hope this helps...

                    Thanks for the tips.  I still have port 23 untagged on VLAN1, so I'll remove that here in a little bit and just leave the VLAN membership as untagged on VLAN10.  You are spot on on the Cisco CVO router running ipsec, I think (see below).  When I was in the system logs looking at the firewall, it was dropping several UDP connection attempts.

                    @stephenw10:

                    Good call, I forgot about removing port 23 from the default VLAN.

                    You probably want to allow only the required protocols if your purpose is to islate the Cisco device. Once you have it working you may want to tighten the firewall rules further to restrict the IPs that can connect to it.
                    DHCP requests are always allowed into an interface that is running a DHCP server but DNS is not.

                    Stevee

                    The network admin gave me the ports as TCP 50, TCP 51, UDP 500, UDP 4500 and optionally IPSec over UDP/TCP - udp port 1000 and tcp port 10000.  However, the system logs > firewall was showing ports in the range of 55xxx as being dropped, so will have to do some digging on that front.

                    Thanks, you two, for following up with me.

                    1 Reply Last reply Reply Quote 0
                    • K
                      kars85
                      last edited by

                      I must have something in the firewall rules not configured correctly.  My Cisco 7965 VoIP phone keeps trying to register, an indicator that the Cisco CVO router can't talk inbound or outbound (more likely, see below).  But, I plugged in one of my laptops into the VLAN10 switch port directly, got a correctly assigned DHCP lease, but no Internet connectivity.

                      Can anyone help with what pass/block firewall rules I need so the Cisco CVO router can't see anything on my private 192.168.1.x LAN, only its own 192.168.10.x LAN, but can also have free reign in/out on the em1 WAN interface?

                      EDIT:

                      Also tried adding a pass rule from the WAN subnet to my VLAN10 subnet, but still can't ping google.com or browse Internet from the test laptop I have plugged in.  However, DNS seems to be working as nslookup google.com give non-authoritative IPs back.

                      EDIT #2:

                      I changed the default LAN rule from LAN net to * and instead * to *, but still no go.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Do you still have outbound NAT set to automatic? That's the default setting so it will be unless you've changed it.

                        You can't ping because your firewall rule on OPT1 only allows TCP/UDP and ping uses ICMP.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • K
                          kars85
                          last edited by

                          @stephenw10:

                          Do you still have outbound NAT set to automatic? That's the default setting so it will be unless you've changed it.

                          You can't ping because your firewall rule on OPT1 only allows TCP/UDP and ping uses ICMP.

                          Steve

                          Yep - AON is enabled.

                          I'm giving the advice here a try: https://forum.pfsense.org/index.php?topic=78533.msg428398#msg428398 to see if that gets me anywhere.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            I have a similar setup on home box to isolate the guest wifi interface. You will need to do that if you want to isolate the Cisco VoIP device. However your existing 'allow any' rule should give you internet access on that interface especially on a laptop connected to it.

                            Check the firewall logs. Do you have more than one gateway listed in System: Routing:

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • K
                              kars85
                              last edited by

                              @stephenw10:

                              I have a similar setup on home box to isolate the guest wifi interface. You will need to do that if you want to isolate the Cisco VoIP device. However your existing 'allow any' rule should give you internet access on that interface especially on a laptop connected to it.

                              Check the firewall logs. Do you have more than one gateway listed in System: Routing:

                              Steve

                              Hi Steve,

                              I think I finally got the correct firewall rules in place.  At least, the laptop I had plugged into that VLAN10 port could not ping any devices on 192.168.1.x, but could browse the Internet.

                              I've got a higher precedence rule blocking everything on my 192.168.1.x subnet, with an allow all TCP/UDP under it.  Does this look alright for a long term solution for what I want to accomplish? I can still ping the 192.168.10.x devices from my 192.168.1.x network, but I guess that's alright.

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Yes, that should work.
                                You may want to lock it down further. For example devices on OPT1 will have access to the webgui (though it's password protected) and any other services running on the pfSense box.

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post