• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Help with VLANs and pfSense

J

jay3712

n00b
Joined
Sep 28, 2012
Messages
7
Hello,
I am hoping someone could assist me with a new setup I am attempting at home with VLANs, pfSense and Unifi APs.

Setup includes pfSense box with 4 nics:
WAN - re0 - DHCP from ISP
LAN - re1 - 10.0.0.1 (plugged into port 20 on Dell switch)
VLAN10 - em1 - 10.0.10.1 (port 22 on Dell Switch)
VLAN20 - em0 - 10.0.20.1 (port 24 on Dell Switch)

Dell PowerConnect 2724 switch - 10.0.0.2 - all devices plug into this switch. Have not changed any tagged/untagged settings.

Two Unifi APs that will broadcast two wireless networks, one for VLAN10 and one for VLAN20.

Devices on VLAN10 and VLAN20 need to be separated, but both have access to internet. All devices except switch and pfsense will be either VLAN10 or VLAN20.

I create static mapping in pfsense for the MAC of the desktop that I want to have static ip of 10.0.10.31, but the computer only ever gets a dhcp address in the 10.0.0.x (LAN) range. Then I turned off DHCP server on LAN and now cannot get any IP at all.

LAN Interfaces:
6SUf3.png


Static mapping:
rgSZ7.png


vZyNl.png


Any help on this?

Thanks in advance.
Jason
 
pfSense needs the VLANS coming in on an 802.1Q Trunk- I'm not sure the 2724 supports this 100%, the closest I think you'll get is setting your VLANs as tagged on the 2724.
I don't like using Dell's 27xx or 28xx series switches because they seem backwards to me. If you want a good, inexpensive switch to learn on, look at the PowerConnect 33xx, 34xx, or 35xx (all 100Mb with 4 GbE) or a PowerConnect 5224, 53xx, or 54xx (all GbE). Sometimes they are cheaper as 48-port versions.
On these and most Enterprise class switches, you set your VLANs, set your port to trunk mode, then add VLANs.
I wouldn't mess with putting VLANs on separate physical interfaces until you get a better handle on what is going on.
 
the switch will do vlans just fine,

Highlights
24-port Gigabit Ethernet switch with high-performance server connectivity
Offers a switching capacity of up to 48 Gbps and a Forwarding Rate of up to 35.6 Mbps
IEEE 802.1Q port based tagging up to 64 VLANs
Provides switch access password protection (read-only and read-write access)
Supports Virtual Cable Diagnotics by Marvell™ to provide advanced troubleshooting capabilities
2 SFP fiber combo ports provide support for 1000BASE-SX and 1000BASE-LX transceivers
Includes 1-Year NBD Advanced Exchange Service

Id use one single port on the switch port 25 or 25 then set up your mode on that port, then make your vlans etc etc..
 
Thank you Rocket and dash for your replies. I think I have it figured out now... did some more reading and the config is working for me now. I'm not sure if this is what is actually referred to as trunking but it is working at the moment.

The vlan ports from pfsense are plugged in to port 22 and 24 on the switch. Port 22 and 24 on the switch are Tagged members of their vlans (10 and 20, respectively) and PVID for both are 4095, frame type admit tag only.

The wired client ports on the switch are untagged vlan members with PVID of their vlan (10 or 20).

The Unifi APs are on ports 5 and 7 and are untagged vlan1 and tagged vlan10 and vlan20. PVID is 1. Wireless devices are getting correct ips from pfSense DHCP on the appropriate vlan.

Jason
 
Jay- I'm retty sure your setup is not proof the VLANS are working correctly, as the networks are separated by physical interface cards as well.
If you are content with having your setup working as-is, stop now. If you are trying to get VLANs working correctly, try moving VLAN 20 to Port 22 and setting it as tagged, then seeing if it works. You will also need to switch VLAN20 to em1.
 
I'm not sure if you are running pfsense in a vm (I am), but I setup my host with 802.1q vlans on a quad banded gig-e interface & then created bridges to give to pass to the pfsense guest. Works great & I don't have to worry about the pfsense implementation.
 
There is absolutely no need to setup vlans on pfsense at all with the way you are working it. Just port based untagged vlans on the switch.

You'd only need to add VLANs in pfsense if you wanted to trunk more than one interface out of one physical port.
 
RocketTech said:
Jay- I'm retty sure your setup is not proof the VLANS are working correctly, as the networks are separated by physical interface cards as well.
If you are content with having your setup working as-is, stop now. If you are trying to get VLANs working correctly, try moving VLAN 20 to Port 22 and setting it as tagged, then seeing if it works. You will also need to switch VLAN20 to em1.
Click to expand...

Thanks Rocket, it appears you are correct. I tried this and now I cannot connect to VLAN20 and get a dhcp address. Both VLANs are assigned to interface em1 plugged into 22 on the switch which is tagged members of both VLANs. Any other thoughts on this? It is doing what I need it to do but it makes me want to go back and do it right.

EDIT: actually it appears to be working after a reboot with both vlans on the same port on pfsense and on the switch.

Robstar said:
I'm not sure if you are running pfsense in a vm (I am), but I setup my host with 802.1q vlans on a quad banded gig-e interface & then created bridges to give to pass to the pfsense guest. Works great & I don't have to worry about the pfsense implementation.
Click to expand...

Hi Rob, nope, not running this in a VM. I had an old Supermicro Atom 330 board that is dedicated for the task. I take my ESXi box down from time to time to add drives or hardware and didn't want my internet connection going with it for the other machines. The ESXi box is running unRAID, WHS2011 and Win7 at the moment.

bmh.01 said:
There is absolutely no need to setup vlans on pfsense at all with the way you are working it. Just port based untagged vlans on the switch.

You'd only need to add VLANs in pfsense if you wanted to trunk more than one interface out of one physical port.
Click to expand...

It appears that my VLANs might not be set up properly anyway, but I may just keep it as is since it appears to be doing what I need it to do for the moment.
 
Last edited:
Jay- Props to you for experimenting and keeping us updated. VLANs can be a little tricky to wrap your head around, but the knowledge is worth it.
I like running pfSense with all interfaces on VLANs as I can essentially remote-patch. If I need a new network, I just add a VLAN on the correct interface and I'm off. With a decent switch, pfSense essentially gives you Layer3 capabilities.
 
bmh.01 said:
There is absolutely no need to setup vlans on pfsense at all with the way you are working it. Just port based untagged vlans on the switch.

You'd only need to add VLANs in pfsense if you wanted to trunk more than one interface out of one physical port.
Click to expand...

I concur.
 
You must log in or register to reply here.
Back
Top