How to do an inter-vlan routing with L3 switch and pfSense



  • Dear all,

    I searched for a similar topic, but I didn't find a clear instructions on how to combine L3 Switch with pfSense box.

    I have a 3COM 4500g layer3 switch with routing features which I want to use and a pfSense 2.2 (amd64) which I'm going to use as a firewall directly connected to my ISP.  I need to create several Vlans and all of them need internet access.

    vlan1 172.16.10.0/24, pfsense addr 172.16.10.1, switch addr 172.16.10.2
    valn3 192.168.3.0/24, switch addr 192.168.3.2
    vlan9 192.168.9.0/24, switch addr 192.168.9.2

    So far I created the vlans on the switch and created a corresponding ipv4 interfaces for the switch and configured an access ports for the hosts.

    So my questions are:
    1. Do I have to configure a trunk between the sw and the pfsense?
    2. Do I need to assign the vlans and assign IP addresses for these vlans on the pfSense? If so which interface will be the default gateway - the one of the switch or the pfsense?
    3. What kind of Firewall rules do I have to create on the pfsense box, so all vlans have internet access?
    4. Will I be able to route to all Vlans when connected via VPN connection (IPsec or PPTP)?
    5. Do I have to create a manual NAT outbound rule on the pfSense for each vlan?

    Thank you in advance.


  • LAYER 8 Netgate

    @bucefal:

    Dear all,

    I searched for a similar topic, but I didn't find a clear instructions on how to combine L3 Switch with pfSense box.

    I have a 3COM 4500g layer3 switch with routing features which I want to use and a pfSense 2.2 (amd64) which I'm going to use as a firewall directly connected to my ISP.  I need to create several Vlans and all of them need internet access.

    vlan1 172.16.10.0/24, pfsense addr 172.16.10.1, switch addr 172.16.10.2
    valn3 192.168.3.0/24, switch addr 192.168.3.2
    vlan9 192.168.9.0/24, switch addr 192.168.9.2

    So far I created the vlans on the switch and created a corresponding ipv4 interfaces for the switch and configured an access ports for the hosts.

    So my questions are:
    1. Do I have to configure a trunk between the sw and the pfsense?

    I would.  Create a transit network interface on pfSense, say 172.31.242.1/29. Create a new VLAN on pfSense and the switch. Tag the VLAN on a trunk between the switch and pfSense (It could be untagged but just tag it now so you can simply add another VLAN in the future if you want.) Create a ve on the switch, say 172.31.242.4/29. Set default gateway on switch to 172.31.242.1. Create gateway on pfSense for 172.31.242.4. Create static routes for all your VLANs on pfSense pointing them at the switch gateway.

    2. Do I need to assign the vlans and assign IP addresses for these vlans on the pfSense? If so which interface will be the default gateway - the one of the switch or the pfsense?

    Not if you are using the switch as a layer 3 router.

    3. What kind of Firewall rules do I have to create on the pfsense box, so all vlans have internet access?

    The pass rules on the transit interface (172.31.242.1/29) have to pass all traffic from all networks.

    4. Will I be able to route to all Vlans when connected via VPN connection (IPsec or PPTP)?

    Should be as simple as adding them as local networks.

    5. Do I have to create a manual NAT outbound rule on the pfSense for each vlan?

    I believe 2.2 is pretty good at picking up the static routes in auto outbound mode, but just switch to manual and add rules for:

    10.0.0.0/8
    172.16.0.0/12
    192.168.0.0/16

    If those are going out WAN you want them to NAT, so just NAT them all.  Put anything more specific than those on NAT rules above them.


Log in to reply