Topic '[SOLVED] NETGEAR FS726TP VLANs + PFSENSE' in forum 'Networking' - dslreports.com

Re: Help with VLANs

Tue, 08 Jan 2013 12:14:11 EDT

tomdlgns posted : 'By default you can reach the internet or any other vlan or subnet attached to pfsense from the LAN,'

ok, that might be where i should have stopped. all good, my mistake for giving wrong info.

thank you.

Re: Help with VLANs

Tue, 08 Jan 2013 12:05:35 EDT

clarknova posted :

said by tomdlgns:

what other networks? the vlans?

Any network other than the LAN, including OPTx networks (local vlans included), the internet (WAN), etc.

nothing had to be configured for me to communicate from vlan to vlan or vlan to lan or lan to vlan, etc... and i could get to the internet from any vlan w/o any problems/creating rules.

Not since 1.2.x, and possibly before that. By default you can reach the internet or any other vlan or subnet attached to pfsense from the LAN, but not from the WAN or OPTx interfaces, until you create a rule to permit it.
--
db

Re: Help with VLANs

Tue, 08 Jan 2013 11:58:24 EDT

tomdlgns posted : you lost me

"But the hosts on the other networks will not be able to reach your LAN or the internet until you create a rule on their interface permitting it."

what other networks? the vlans?

all i meant to say was that nothing had to be configured for me to communicate from vlan to vlan or vlan to lan or lan to vlan, etc... and i could get to the internet from any vlan w/o any problems/creating rules.

Re: Help with VLANs

Tue, 08 Jan 2013 11:54:40 EDT

clarknova posted :

said by tomdlgns:

i don't recall setting up any rules for my lan to talk to the 2 vlans i created. by default, i was able to ping across lan to vlan1 and vlan10

That`s right, because the default LAN rule allows you to go anywhere, and the hosts on the other networks will be allowed to respond due to the existing state. But the hosts on the other networks will not be able to reach your LAN or the internet until you create a rule on their interface permitting it.
--
db

Re: Help with VLANs

Tue, 08 Jan 2013 11:18:16 EDT

tomdlgns posted : hmmm, you have more experience with pfsense, so i will assume you are right, but i don't recall setting up any rules for my lan to talk to the 2 vlans i created. by default, i was able to ping across lan to vlan1 and vlan10 (and the other way around). i had to create rules to deny traffic, but i dont recall creating rules to allow the networks to talk to e/o.

Re: Help with VLANs

Tue, 08 Jan 2013 10:59:21 EDT

clarknova posted :

said by tomdlgns:

for the rules, by default pfsense allows any/any communication to all vlans and lans

Not quite. By default, pfsense allows anything in from the LAN, but not from any other interface. You have to explicitly allow from the second LAN (OPT1).

Normally you won't designate a gateway in your pass rules unless you're doing multiWAN. It's not a bad idea to specify the source subnet in your pass rules though, and if you're trying to restrict traffic between vlans, be careful not to allow to destination "any".
--
db

Re: Help with VLANs

Tue, 08 Jan 2013 10:06:04 EDT

tomdlgns posted :

said by zacron:

OK, It's working now for both VLAN's.
Netgear has a crappy interface.

---------------------------------------------------------

Thank you to everyone. :)

Now one final question. The rules for the VLAN's to Route to the Internet.

Sources:
WAN (Depends on the PPPoE Session)

Just need simple Source, Destination and Gateway Rules? Right?

Zacron

for WAN, you can just write in dynamic, since it looks like you don't have a static IP.

for the rules, by default pfsense allows any/any communication to all vlans and lans, you have to create your own restrictions/rules.

Re: Help with VLANs

Mon, 07 Jan 2013 22:44:45 EDT

zacron posted : You just need the following rule for each VLAN:
Allow
Protocol: ANY
Source:
Destination: ANY
--
"Recognize, Realize, and Repent"

Re: Help with VLANs

Mon, 07 Jan 2013 22:32:55 EDT

zacron posted : OK, It's working now for both VLAN's.
Netgear has a crappy interface.

---------------------------------------------------------

Thank you to everyone. :)

Now one final question. The rules for the VLAN's to Route to the Internet.

Sources:
WAN (Depends on the PPPoE Session)
NORMAL (192.168.1.0/24)
VLAN 1 (192.168.8.0/24)
VLAN 2 (10.143.3.0/24)

(Reason for different subnet's is because I'd have to manually setup the individual IP Phones and Devices on VLAN2).

Thanks for your help.

Just need simple Source, Destination and Gateway Rules? Right?

Zacron
--
"Recognize, Realize, and Repent"

Re: Help with VLANs

Mon, 07 Jan 2013 21:58:30 EDT

cramer posted : (the thread that just won't end)

This is only complicated because the switch isn't hiding *anything* from you.

PVID: Primary VLAN ID
The PVID defines the VLAN for packets received by the switch without a VLAN tag. ALL ports have a PVID. (every packet moving through the switch belongs to a VLAN -- and only one VLAN.)

Tagged vs. Untagged controls how the packet is presented to the device connected to the port. For any trunk port -- a port assigned to more than one VLAN -- only one VLAN can be untagged; all VLANs can be tagged -- typically, the native VLAN (aka PVID) is left untagged. All ports must be a member of at least one VLAN.

Your switch's primitive UI allows you to setup a throughly broken configuration. (multiple untagged VLANs on a port, even *no* VLAN on a port.)

Re: Help with VLANs

Mon, 07 Jan 2013 21:09:31 EDT

shdesigns posted : Yes, port 26 would be set as tagged in both VLAN's. All others untagged.

PVID would be set to the VLAN 1/2 as needed.

Re: Help with VLANs

Mon, 07 Jan 2013 21:06:43 EDT

zacron posted : Yes but this switch provides a seperate "Tag/Untag" interface for each vlan. So I'd tag only port 26 on both vlans and the other ports, for both vlans would be untagged?

PVID's Set as per needs?

Thanks,
Zacron
--
"Recognize, Realize, and Repent"

Re: Help with VLANs

Mon, 07 Jan 2013 20:57:48 EDT

shdesigns posted : Port 26 set to Tagged The PVID should not really matter, could be 0 if you want access to the untagged NIC on pfsense.

Ports 1-25 set as untagged

Ports 1-4 have PVID 1
Ports 24-25 have PVID of 2
--
Scott Henion

Embedded Systems Consultant,
SHDesigns home - DIY Welder

Re: Help with VLANs

Mon, 07 Jan 2013 19:24:51 EDT

zacron posted : SO then...

Port 26 will be (Tagged for both Vlan1 and vlan2 with the PVID being 1?)

Ports 1 - 4 (Will be tagged under Vlan1 and 5-25 with nothing?)
While
Ports 24-25 (Will be tagged under Vlan2 and 1-23 with nothing?)

Is this correct?

Thanks,

Zacron
--
"Recognize, Realize, and Repent"

Re: Help with VLANs

Mon, 07 Jan 2013 12:35:17 EDT

shdesigns posted : On my Alix box, there is only one LAN port and no PCI slots.

So, I added a USB NIC for the WAN port. Yes, that add processing overhead but it is only a 3.5mbit WAN and works fine.

Re: Help with VLANs

Mon, 07 Jan 2013 12:30:45 EDT

clarknova posted : I run a home-based hobby ISP, so it services business and personal networks. Fortunately pfsense makes it easy to separate what needs to be separated.
--
db

Re: Help with VLANs

Mon, 07 Jan 2013 12:19:26 EDT

tomdlgns posted : i was going to ask if this was for a business environment, but after reading your last reply i know the answer.

then again, why would anyone have 13 vlans in a home setup?

actually, i am sure someone probably does. i had three for testing my setup, but now i only have two. not really needed for what i do, but still nice having a separate network for x reason.

Re: Help with VLANs

Mon, 07 Jan 2013 12:04:34 EDT

clarknova posted :

said by tomdlgns:

do you run a separate NIC for WAN and LAN?

No. I used to, but then I upgraded to a board with only a single NIC, and I didn't have another NIC to add to it at the time. I will probably add one, but I've been running this way for a while.

Even with separate WAN and LAN NICs I would still have vlans on both NICs, because I'm doing 8-line MLPPP, so I have 8 modems vlanned into the WAN.
--
db

Re: Help with VLANs

Mon, 07 Jan 2013 11:37:14 EDT

tomdlgns posted : if i add more vlans i am going to try to do them on the same NIC for practice (in setup) and to see how well it works.

however, do you run a separate NIC for WAN and LAN? i have a virtual box setup and i can install pfsense on that and test it in a virtual environment with 1 NIC for everything.

Re: Help with VLANs

Mon, 07 Jan 2013 11:19:51 EDT

clarknova posted : I run 13 vlans on a pfsense with a single physical NIC. It's not best practise from a security standpoint, but technically it does the job.

One advantage of running multiple NICs is that it appears (from my limited observations), that each NIC will use a different CPU core. Thus, if you have a multi-core CPU in your pfsense installation, you can get better maximum routing throughput by utilizing more than one real NIC.
--
db

Re: Help with VLANs

Mon, 07 Jan 2013 10:14:36 EDT

zacron posted : Thank you for the information. I'll give that a shot and see what happens.
--
"Recognize, Realize, and Repent"

Re: Help with VLANs

Mon, 07 Jan 2013 09:32:37 EDT

tomdlgns posted :

said by clarknova:

See here for a similar example using a Netgear switch: »forum.pfsense.org/index.php/topi···sg148389

nice link, clarknova. i knew pfsense could be installed in a virtual environment, but i still assume you had to have two NICs available for pfsense.

in my setup, pfsense runs on an old computer with 3 NICs and i never had to try to get it to run as described in that link (which does make sense). i will have to keep that in mind.

Re: Help with VLANs

Mon, 07 Jan 2013 03:09:42 EDT

clarknova posted : On the switch, use 802.1Q vlans. Port 26 will be tagged ("T") for both vlans. The other switch ports will be untagged ("U") for the desired vlan, with the pvid set to match.

On pfsense you will create the same two vlans and create an interface for each on the parent NIC that will be plugged into port 26 on the switch.

See here for a similar example using a Netgear switch: »forum.pfsense.org/index.php/topi···sg148389

Note one important difference there is that the OP was using a single NIC for WAN and LAN, while you're using a separate NIC for WAN and LANs. The switch setup details should do you some good though.
--
db

Re: Help with VLANs

Sun, 06 Jan 2013 12:16:15 EDT

tomdlgns posted : OP, i was in your shoes when i first started getting into VLANs and i was using pfsense, as well.

i am not an expert, but i will try my best to help. i got some help on the forums and i like to help out when i can.

my pfsense box:

nic1- WAN

nic2- LAN (vlan1/default VLAN) 192.168.1.0 /24 (dhcp server set in pfsense)

nic3- LAN (vlan10) 10.0.10.0 /24 (dhcp server set in pfsense)

---------------------------------

hp switch

vlan1 is tagged as:

E,E,U,U,U,U,U,U

vlan10 is tagged as:

T,T,E,E,E,E,E,E

that means, anything i plug into ports 1,2 is on vlan10 and is on the 10.0.10.0 /24 network.

anything plugged into ports 3-8 is on vlan1, or default vlan, and is on the 192.168.1.0 /24 network.

Re: Help with VLANs

Sat, 05 Jan 2013 13:53:32 EDT

Jahntassa posted : You need to create VLAN IDs via that screen that match the VLAN IDs you're creating in pfSense. Then on Port 26, make sure each one of those VLANs is set to tagged. Voila, trunked port.

Then on your switch, if you aren't using VLAN sensitive gear, you need to go to each VLAN ID via the drop-down, set the ports you want on that network to Untagged. Then, go to the PVID list, and set the PVID for those ports to that same VLAN ID.

The Netgear does sort of have the options that shdesigns is referring to, but it does it on a VLAN by VLAN basis. If you have a port set as Untagged for one VLAN, and 'Not Member' for every other VLAN, it will only pay attention to untagged traffic, and ignore any VLAN tags coming into it. Similarly, it will not send any VLAN tags.

If you have a port that is Untagged for one network (with matching PVID), and set another VLAN to be tagged, it will send both the tagged and untagged packets, as well as accept both. This would be useful if you have a VOIP phone with a computer on the passthrough port. The VOIP could be on its separate VLAN, while the computer is on its own network.

Re: Help with VLANs

Fri, 04 Jan 2013 21:33:32 EDT

shdesigns posted : Port 26 would be set to tagged, all others untagged.

Ports 1- 4 would have PVID set to 1
Port 24 would have PVID set to 2.

Port 26 is set to "tagged". That passes the VLAN info to the pfsense box.

The PVID adds a tag to the incoming ports so it gets put in the proper VLAN.

Data coming in ports 1-4 have PVID of 1 added to the packet. If they go out again though 1-4, the tag is removed (ports are set as untagged.) If they go out port 26, this tag is left on so the pfsense box can decode it.

Similar for port 24.

The pfsense box would be sending tagged packets. Port 26 would see that and put the packets in the appropriate VLAN.

What is not clear is incoming packets. Your switch seems to have just "tagged" or "untagged" for each ports. Other switches have this separate as options in a list:

Rx:
1. accept tagged packets only
2. accept untagged packets only
3. accept both

Tx:
1 send tagged
2. send untagged

I have a pfsense box using an Alix board. It only has 1 ethernet port so I use VLANs the same as you are (except I have about a dozen ports in each VLAN.)
--
Scott Henion

Embedded Systems Consultant,
SHDesigns home - DIY Welder

Re: Help with VLANs

Fri, 04 Jan 2013 20:21:13 EDT

zacron posted : Here they are lol.

I still can't get my head around it. lol.
--
"Recognize, Realize, and Repent"

Re: Help with VLANs

Fri, 04 Jan 2013 20:17:24 EDT

HELLFIRE posted : "Set up port 26 as a trunk" would be the answer. Exactly HOW is the million dollar question.
Does the device's manual happen to specify anything zacron .

As a dumb thought, what's clicking on "IEEE 802.1Q VLAN" bring up?

Regards

Re: Help with VLANs

Fri, 04 Jan 2013 20:03:56 EDT

zacron posted : I am trying to create two separate vlans which all use PORT26 which is the router's lan port.

The VLAN is setup on the PFSENSE box with Routes and DHCP.

It's just that I don't know how i should setup the tagging and untagging and VID's for the ports.

26 should have both VLAN's as it's the "Trunk"..

Do I make sense?

Thanks,

Z
--
"Recognize, Realize, and Repent"

Re: Help with VLANs

Fri, 04 Jan 2013 20:00:44 EDT

shdesigns posted : What are you trying to accomplish?

Port 26 is a member of both VLANs.

How the ports are configured for tagging, the default ID and what they are connected to also has to be considered.
--
Scott Henion

Embedded Systems Consultant,
SHDesigns home - DIY Welder

[SOLVED] NETGEAR FS726TP VLANs + PFSENSE

Fri, 04 Jan 2013 19:16:08 EDT

zacron posted : Hello,

I am attempting to setup a NETGEAR FS726TP with PFSENSE.

I have the following SETUP.

[INTERNET] - [PFSENSE] - [NETGEAR (Port 26)]
[PORT 1-4 (VLAN 1)]
[PORT 24 (VLAN 2)]

How do I setup the VLANs so that, 26 takes both vlans?

I don't understand why it's not working properly.

I have the following setup in the NETGEAR. (See Screenshot)
--
"Recognize, Realize, and Repent"