Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multi-LAN - untagged + tagged on same interface

    Scheduled Pinned Locked Moved Routing and Multi WAN
    4 Posts 2 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      moikerz
      last edited by

      I've heard people mention untagged+tagged data on same interface is not a good idea. But never any reasons / examples as to why. Also, most of these posts saying it's not a good idea were from before v2.1 was out. I'm on the latest, 2.2.5.

      Basic interfaces and network set up as attached.

      Should I be expecting any problems with this?
      pfsense_interfaces.jpg
      pfsense_interfaces.jpg_thumb
      network_basics.jpg
      network_basics.jpg_thumb

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        The problem is every switch does it differently - some can't do it at all. Some attach special meaning to VLAN 1, some don't. It's not really a problem with pfSense/FreeBSD itself.

        You should definitely change the default VLAN to something other than 1. Sometimes you can change this switch-wide, sometimes you have to do it port-by-port.

        Quick question: why not just tag it and leave the untagged interface unassigned?

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • M
          moikerz
          last edited by

          Thanks for the fast reply. Glad it's not a problem with pfSense itself.

          I have a web-smart DLink switch system (shudder). It does the job ok - I just need to figure out how DLink's interpretation of tagging and PVIDs work. I do know the switch has management VLAN disabled (which is fine for now).

          This is only a small network, ~80 devices.

          The switch port connecting to pfSense is untagged, PVID 1. I guess I should just be able to change all PVIDs from 1 to 2 (for example), tag the switch port as a VLAN 2 member, and create a VLAN2 interface on pfSense. Then unconfigure the default LAN interface on pfSense. Sound about right?

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Create a tagged switchport with VLANs 2 and 9
            Create VLAN 2 on igb0
            Reassign LAN to VLAN 2 on igb0
            When you hit Apply you will lose access if working from LAN
            Patch pfSense into the tagged port.

            You can, of course, just change pfSense then change the existing port to tagged.  Just know that when you change pfSense to tagged and Apply, it will not be able to reach LAN until on a tagged switch port and you could lose access to the webgui.

            Or access the web interface via another network to make the changes.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.