Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Internet Not Working On VLANs

    Scheduled Pinned Locked Moved General pfSense Questions
    23 Posts 4 Posters 7.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mcarr
      last edited by

      Hello, I have set up a firewall for a switch and I set the Lan as 10.7.1.1 and i set VLANs all the way up to 200, so 10.7.2.1 10.7.3.1 etc, with a DHCP range of 2-100. My problem is, that i cannot get internet access through the VLANs, it works fine when I access the internet through LAN.
      My question is.
      Is there a setting somewhere or something that i need to enable for the internet to work?
      Any ideas would be helpful, i need to get these VLANs running ASAP and i dont know what the problem seems to be.
      Thanks in advance.

      1 Reply Last reply Reply Quote 0
      • H
        heper
        last edited by

        can you ping pfsense from the vlan's ?

        do you have firewall rules for each vlan interface ?
        do you have manual NAT configured instead of the auto-nat ? if manual nat then you need to add nat rules

        1 Reply Last reply Reply Quote 0
        • M
          mcarr
          last edited by

          no i cant ping pfsense, and i have auto NAT enabled

          1 Reply Last reply Reply Quote 0
          • jahonixJ
            jahonix
            last edited by

            @heper:

            do you have firewall rules for each vlan interface ?

            You can now have a "floating rule" that is applied to all interfaces.
            For basic filtering this should be sufficient and you don't have to create rules for each (VLAN) interface.

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Work on the first VLAN 10.7.2.1.  Make an untagged port on your switch and plug into it.  You should get DHCP even without any pass rules on the interface.

              If not, doublecheck your VLAN tagged and untagged ports.

              Go to the VLAN interface's Firewall > Rules tab and put a Pass any any any rule there just like the one on LAN.

              You should have internet and be able to ping 10.7.2.1.

              After that, you might be able to save some time using floating rules applied to all the interfaces as suggested above.

              Or you might want to get one interface how you like it and script the creation of the rule config to import into /conf/config.xml

              Another shortcut is to get an interface rule how you like it, then use the Add button on that rule's line.  Change the interface and the source network and save.  The same rule will now be duplicated on that interface.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • M
                mcarr
                last edited by

                any possibility you can post a screenshot, of like what to do for the first VLAN2 for instance. That would help out so much. Thanks

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Create the VLAN in Interfaces > (assign) > VLANs (first image)

                  Create an interface on Interfaces -> (assign) by pressing the Add icon at the bottom right of the interface list.

                  Assign the interface to the VLAN (Second image)

                  Edit the interface, enable it, and set the IP/netmask (eg 10.7.2.1/24) configure your DHCP server.

                  The switchport connected to that interface (em0 in my example) needs to have that VLAN (223 in my example) tagged.  Any interface configured as untagged VLAN 223 will be on the same VLAN as that router interface, get DHCP, and be able to use that interface for DNS, default gateway, etc.

                  vlan.png
                  vlan.png_thumb
                  vlan-assign.png
                  vlan-assign.png_thumb

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • M
                    mcarr
                    last edited by

                    so i did that, for all 200, i assigned them, enabled them, gave each a 24bit subnet mask. i enabled DHCP and made VLANs 2-200 with a range of 2-100 and that was it. thats where im lost now
                    basically i need to know how to get the VLANs connected to the internet, seems like the firewall isnt set up so its blocking everything, but i dont know how to set up the firewall to pass things through, im doing something wrong

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Look at the default rule on LAN.  Duplicate it on one of the VLANs.  Are you sure your switch config is correct? Tagged to pfSense, untagged to your station nodes?

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • M
                        mcarr
                        last edited by

                        im going to post some screen shots as soon as it loads.

                        1 Reply Last reply Reply Quote 0
                        • M
                          mcarr
                          last edited by

                          alright, here they are.
                          untitled and untitled 1 are LAN firewall default settings
                          untitled 2 is what i changed VLAN2 firewall settings to, i put an arrow next to what i changed
                          i saw in an earlier reply about changing everything to any any any, just like LAN is, problem with that, is LAN wasnt default any any any
                          which is my confusion.
                          should i change the lan to any any any and then do my vlans like that, or what should i do?

                          Untitled2.png_thumb
                          Untitled2.png
                          Untitled1.png_thumb
                          Untitled1.png
                          Untitled.png_thumb
                          Untitled.png

                          1 Reply Last reply Reply Quote 0
                          • H
                            heper
                            last edited by

                            are you sure you switch is configured correctly?
                            it looks like a switch issue to me if you have interfaces assigned & allow rules on them ….

                            • all vlans are tagged on the trunkport 'towards" the pfsense?

                            • on the client ports you have the appropriate vlan untagged and have also set the correct PVID ?

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Exactly.  There's really nothing else to do in pfSense.  With that rule you should be able to get DHCP and ping the interface address.  With automatic outbound NAT you should be avle to get at the internet.

                              What kind of switch are you using?  It sounds like it's not configured correctly.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • M
                                mcarr
                                last edited by

                                alright, well ill test this out, see what happens.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mcarr
                                  last edited by

                                  alright guys, new question.
                                  hos should i go about setting up the floating rules for my VLANs?
                                  like i know where to go to do it, im just not 100% sure on if id set it up right.

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    Was the switch config wrong?

                                    What do you want your floating rules to do?

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mcarr
                                      last edited by

                                      the switch ended up working great, turns out it was that i the rules werent set up right for the VLAN
                                      but my boss deleted all but 2 of the VLANs i set up, so now i gotta reset those up.
                                      I was wondering if how to set up the floating rule for any any any?
                                      i really dont want to set up the same rule for 200 VLANs

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        heper
                                        last edited by

                                        don't use floating rules for that …. create an interface group for this purpose.

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          mcarr
                                          last edited by

                                          so the ones that have the rule already set,
                                          should i exclude them from the group
                                          or delete the rules from those and add them to the group,
                                          or does it not really matter?

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mcarr
                                            last edited by

                                            or would the best way be to add new rule based on this rule and just change the interface each time, thus creating the same rule for a new VLAN?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.