PFsense, ESXi, managed switch and vlans
-
Hello Everyone,
First of all, I know I'm not the first one to ask about this stuff but even after days of searching and testing, I can't get my head around why what I'm trying to accomplish isn't working.
Second of all, I'm really just starting to experience with VLANs but I have been using ESX and pFsense to some extent for a few months now.
Finally, I have what I would consider a (almost) working VLAN setup as I'm able to ping from VLAN 2 (192.168.2.x) to machines on LAN (192.168.1.x) and vice versa. However, I find myself incapable of giving my test machine on lan 2 access to the interwebs. Here's the setup:
-ESXi host with a bunch of VMs. Created a new port group with a VLAN ID 2 in which I put the test VM and pFsense (new NIC)
-Within pFsense, I assigned a new interface to the new NIC (em2) that I named VLAN2, static ipv4 and give it the address of 192.168.2.1 as gateway
-I set up my rules for testing allowing ICMP in/out from 192.168.1.1/24 <> 192.168.2.1/24 on both LAN interface and VLAN2 interfaceResults:
- I can ping from 192.168.1.23 > 192.168.2.1 & 192.168.1.23 > 192.168.2.22
- I can ping from 192.168.2.22 > 192.168.1.23
- I cannot ping from 192.168.2.22 > 192.168.1.1 and as such, have no internet connectivity
The drawing below sums the whole thing up. I'm pretty sure that I also need to properly set up the managed switch but I'm confused with what needs to be trunked, tagged and untagged on there.
What I don't get is why I'm able to talk to 192.168.1.23 from 192.168.2.22 but I can't talk to the DSL router on 192.168.1.1. This puzzles me completely ???
Is my setup wrong? If you need more information please do ask, I'll do my best to give it…
Thanks!
-
Hi drWango,
Can you take screenshots of the following?
- LAN interface settings
- VLAN2 interface settings
- WAN interface settings
- Firewall rules for the above mentioned interfaces
Edit: I see the problem. You cannot have two interfaces that are in the same subnet. Both WAN and LAN are in 192.168.1.0/24, thats not possible. Fix that first, and try again :)
-
Hi vindenesen!
Thanks for the quick reply. Damn I should have seen that, it's quite obvious.
So should I basically put it to something like 192.168.3.1? Is there something else to change like on ESXi when you change the address of an interface? Because I just did but I'm still getting the same result :-[
Edit: Also shouldn't I change the LAN gateway (192.168.1.2) to something else as well then? Or doesn't it matter?
-
You could do that yes. But I wouldn't.
The way I would do it:
- On your WAN interface, add a rule that would allow you to administrate the pfSense firewall with http/https://192.168.1.4. Not so dangerous since WAN isn't actually facing the Internet.
- Drop the VLAN2 interface, not necessary in this setup. I assume you are only using the LAN interface to administrate the firewall.
- Change the LAN-interface to use the "physical interface" that VLAN2 used instead (em2). And then change the IP address of LAN interface to 192.168.2.1.
And remember: Never configure an interface with a gateway, unless it is your WAN interface. (I guess there are exceptions, but not in this case).
-
What exactly are you wanting to accomplish?
You have the same IP range on your wan and lan intefaces of pfsense - 192.168.1.4 and 192.168.1.2 ??
I run pfsense via vm on esxi - and confused at what your trying to accomplish here from that setup.
-
Sorry for the slow reply, it's been a busy few days.
I finally got everything working, let me explain.
What I wanted to accomplish was simply to separate my virtual machines from my physical machines. Physical machines would be on the 192.168.1.1/24 LAN and the virtual ones on the 192.168.2.1/24 LAN. Nothing fancy really, just a way to learn about vlans etc.
First of all, I got confused about the WAN IP address. Until now, my WAN and LAN interfaces were on the same subnet. Don't ask me how it was working, but it was. My provider (Swisscom, in Switzerland) gave us a cable modem/router in which I could configure an IP passthrough so that one of my devices on the Network would get the public IP on it's interface.
No matter how I tried it, my WAN interface in pFsense would get the public IP but eventually switch back to a local IP (192.168.1.x) after like 30 minutes, completely breaking routing, obviously.
After some extensive searching, I had to make this modification in the interface.inc file of pFsense, adding the line in bold:
$dhclientconf .= <<<eod<br>interface "{$wanif}" {
send dhcp-class-identifier "100008,0001,,pfSense dhclient 2.1";
timeout 60;
retry 1;
select-timeout 0;
initial-interval 1</eod<br>After doing this, I am now getting a proper internet IP and it hasn't switched back to anything local. Access to the internet from the 2.1/24 LAN isn't an issue any longer.
