Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Subnet/VLANs with managed and unmanaged switches

    Scheduled Pinned Locked Moved Routing and Multi WAN
    29 Posts 6 Posters 20.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GruensFroeschliG
      GruensFroeschli
      last edited by

      I may try again with VLAN1 on the interface. I was curious about a earlier comment about not having interfaces directly assigned.

      Should the LAN interface be assigned anything or can just all the VLANs be attached to interface re0? and LAN have nothing?

      That goes into the same as

      It's not like that it wont work, it's just "bad" design.
      "bad" as in mixing tagged and untagged traffic on the same wire.

      You "should" not assign an interface on which VLANs are running.
      Like i said: It will work. It's just not good network design.

      Either Have LAN as VLAN too,
      or have another interface as LAN

      We do what we must, because we can.

      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

      1 Reply Last reply Reply Quote 0
      • Z
        zarathustra
        last edited by

        @GruensFroeschli:

        Either Have LAN as VLAN too,
        or have another interface as LAN

        By LAN you mean the the LAN itself and not the pfSense LAN interface?

        I can go with an additional NIC until we fully switch over but I'm still curious.

        I haven't looked into CARP yet. It seems that I would have a CARP ip for each VLAN and WAN and then use that as the default gateway for clients?

        I'm almost there. :) Really can't wait to start using pfSense.

        1 Reply Last reply Reply Quote 0
        • GruensFroeschliG
          GruensFroeschli
          last edited by

          Lets refer to the physical interface as re0.
          I mean: asign the logical LAN-interface either as VLAN on re0, or add another NIC (re1) and assign the LAN-interface directly to re1.

          CARP is not what you are looking for.
          CARP is used for redundant hardware. (Failover on hardware-fail)
          Or to create Virtual IPs to/from which you NAT stuff.

          Each VLAN is a seperate logical interface on pfSense.
          Meaning each interface will have its own IP.

          We do what we must, because we can.

          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

          1 Reply Last reply Reply Quote 0
          • Z
            zarathustra
            last edited by

            Lets refer to the physical interface as re0.
            I mean: asign the logical LAN-interface either as VLAN on re0, or add another NIC (re1) and assign the LAN-interface directly to re1.

            That's the plan. Should be able to get around to it later today or tomorrow.

            @GruensFroeschli:

            CARP is not what you are looking for.
            CARP is used for redundant hardware. (Failover on hardware-fail)
            Or to create Virtual IPs to/from which you NAT stuff.

            I would create a Virtual CARP IP on each VLAN interface and then use that as the default route for each VLAN? The idea would be to avoid routing to any real IPs yes?

            1 Reply Last reply Reply Quote 0
            • GruensFroeschliG
              GruensFroeschli
              last edited by

              I would create a Virtual CARP IP on each VLAN interface and then use that as the default route for each VLAN? The idea would be to avoid routing to any real IPs yes?

              I dont follow.
              What is the point of having a router if you dont want to route?

              We do what we must, because we can.

              Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

              1 Reply Last reply Reply Quote 0
              • Z
                zarathustra
                last edited by

                @GruensFroeschli:

                I would create a Virtual CARP IP on each VLAN interface and then use that as the default route for each VLAN? The idea would be to avoid routing to any real IPs yes?

                I dont follow.
                What is the point of having a router if you dont want to route?

                It's just that I haven't read the docs yet. For failover to another router, I would want the default gateway interface on each network to move between routers? So if 192.168.[VLAN].1 was the default route for each network, how would this failover to the 2nd router? By using CARP IPs attached to each VLAN interface?

                1 Reply Last reply Reply Quote 0
                • Z
                  zarathustra
                  last edited by

                  @GruensFroeschli:

                  You "should" not assign an interface on which VLANs are running.

                  You mean for each VLAN, there should be no interface assignments? The following worked before:

                  re0
                  LAN
                    VLAN100 - IP 192.168.100.254

                  I could ping 100.254 from a different port on the switch. Now I have the following which doesn't work. Same switch setup:

                  sk0 - assigned to 0.254 LAN

                  se0
                    interfaces assigned to all VLANs with IPs of 192.168.x.254

                  se0 is trunked. sk0 is reachable of course but se0 (192.168.100.254) is not. My client is on another port with the gateway set to 100.254. Firewall rules are set to allow everything. The interface status does show IN and OUT packets. Maybe it's the switch? The switch setup is the same as when it did with with LAN assigned to VLAN100.

                  1 Reply Last reply Reply Quote 0
                  • Z
                    zarathustra
                    last edited by

                    @GruensFroeschli:

                    You "should" not assign an interface on which VLANs are running.

                    Maybe you mean if multiple VLANs are assigned to a NIC and have IP addresses, that same NIC should not be assigned to WAN or LAN?

                    The interface assignments are:

                    WAN rl0
                    LAN sk0

                    All OPT interfaces are assigned to a VLAN on re0:

                    OPT1 - VLAN 1 on re0
                    OPT2 - VLAN 2 on re0
                    OPT3 - VLAN 3 on re0

                    WAN and LAN are separate NICs. I got it working. But. All access to WAN works. With LAN (thru sk0), I can only ping or telnet to any of the listening ports. Web/SSH, all traffic shows passing thru the firewall but doesn't come back. Firewall states show:

                    192.168.100.81:58487 -> 192.168.0.x:22  CLOSING:CLOSED 
                    tcp 192.168.100.81:58574 -> 192.168.0.x:22 SYN_SENT:CLOSED

                    1 Reply Last reply Reply Quote 0
                    • GruensFroeschliG
                      GruensFroeschli
                      last edited by

                      @g:

                      Maybe you mean if multiple VLANs are assigned to a NIC and have IP addresses, that same NIC should not be assigned to WAN or LAN?

                      I mean about that.
                      Only WAN and LAN can be VLAN too.

                      Simple: Dont assign a real interfaces if you have VLANs running on them.

                      On my WRAP this would look like this:

                      availlable interfaces: sis0, sis1, sis2

                      LAN:  VLAN 1001 on sis0
                      WAN:  sis2
                      OPT1: VLAN 1101 on sis0
                      OPT2: VLAN 1201 on sis0
                      OPT3: VLAN 1301 on sis0
                      OPT4: VLAN 1401 on sis0
                      OPT5: sis1

                      As you can see: i dont mix normal assignments and VLAN assignments on the NICs.
                      But still LAN can be a VLAN, even WAN could be a VLAN.

                      WAN and LAN are separate NICs. I got it working. But. All access to WAN works. With LAN (thru sk0), I can only ping or telnet to any of the listening ports. Web/SSH, all traffic shows passing thru the firewall but doesn't come back.

                      What exatly do you mean with "all traffic shows passing thru the firewall but doesn't come back."
                      Where does this traffic go to? Does the destination know the route back to you?
                      Did you create rules on all interfaces that allow traffic? (per default everything on a new interface is blocked)

                      We do what we must, because we can.

                      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.