Messages

I can see mDNS requests sent via Wireshark (e.g. triggered by VLC), but I cannot see any answer although there should be multiple devices responding.
Should I see answers using filter "udp port 5353"?

Since both requester and responder are on the same switch, I guess this means that the switch somehow blocks the requests or replies?

For multicast on a single LAN the OPNsense is not needed at all, that's what mDNS was designed for imho...

You are right. I obviously misunderstood how mDNS works. The devices should take care of exchanging information by themselves, using broadcast, right?
Any advice how I get started analyzing broadcast issues in my network? (I am aware that this is outside OPNsense now...or can OPNsense help me trace the issue?)

As mentioned, I don't need a proxy between interfaces. I need mDNS to work within one interface. So I didn't see how the linked post could help me...?

How do I enable multicast DNS within my local network?
I have not found anything about mDns in the unbound DNS documentation. There is documentation about a multicast dns proxy, but all my devices are in the same VLAN, so that should not be necessary.
I already use unbound DNS with DHCP leases registered.

My symptoms are that Android and Kodi devices have issues discovering other devices in my local network, where a port scanner app can clearly show the device to be accessible. A vendor pointed me to mDNS as requirement for discovery of their sound equipment.

I don't really see where OPNsense comes into play.

Which is why I posted to the "General" section.
Anyway, I gave the Wifi AP a static IP address in the OPNsense DHCP configuration, and now I can ping my wireless devices. At least for the moment...

Thank you for your input!

The firewall is the DHCP server for both. DHCP is disabled on the Wifi AP, and the IP addresses used are consistent with the DHCP settings on the firewall.
I am pinging by IP address.
I have set up the Wifi-AP from scratch, and have not configured any NAT rules.

I have since found that I can ping the phone from a different wired PC (Windows 10). But even disabling the Windows Firewall on the original PC doesn't change anything.

Further suggestions on what to try?

EDIT: Small update: Now I cannot reach my phone from PC 1 even if I am connected to the same Wifi. I thought I had a workaround there...

I was testing a network connection issue, and wanted to temporarily remove a device from static IP mapping (DHCPv4).
1) The device was connected and had the static IP address
2) I removed the static mapping on firewall
3) I did "ipconfig release" and "ipconfig renew" on device
4) Firewall DHCP leases shows new IP address in list, but device shows old IP address
5) Rebooted device - still has old IP address
6) Restart all services on Firewall using console - finally, the device gets the new IP address

Is this a known issue with the DHCPv4 service?

EDIT: It works the other way round. If I assign a static IP address and do "ipconfig release" and "ipconfig renew", I immediately get the statically assigned address.

I have a wireless (Phone) and a wired device (PC) in the same VLAN.
Since they get correct IP addresses in the same subnet, I conclude that
a) they can both reach the Firewall
b) they are connected via the same interface (and thus to the same VLAN)

From the firewall I can ping both devices.

However, the PC cannot ping the phone ("destination host cannot be reached")
If I connect the PC via wireless as well, I can ping the phone.

How can I analyze this issue?

I set up a configuration with a guest LAN/WIFI using a separate interface with a VLAN id. My switch has dedicated guest ports (untagged with pvid=guest vlan id), and I have a Wifi AP which has a separate SSID for the guest vlan.

In the firewall, I defined an alias for "all local IP addresses", and made a firewall rule:

• Pass from "Guest net" to "! Local IPs"

From my understanding, that would allow guests to access any IP address outside my home network. They still can see each other because the switch doesn't block traffic (it never gets to the firewall for rule checking), but I can live with that.

What is curious: On the wired guest network, I had internet connection. On the guest Wifi I did not. Then I added a rule

• Pass from "guest net" to "this firewall"

Suddenly, my guest wifi has internet access.

Can you make any sense of it?
Can I at least partially restrict the rule (e.g. only opening certain ports)?

If I connect the default LAN interface to a VLAN-capable switch, will the LAN interface tag packets with (default) VLAN id 1, or send untagged packets?
In reverse, will LAN interface drop packets tagged with VLAN id 1 or accept them?

Although I don't really understand the reasoning, I have seen a couple of example setups where the uplink port of the switch (leading to the router/firewall) is added to all VLANs, but left untagged. The setup seems to work this way.

I have a very simple VLAN setup

• VLAN 1 (internal)
• VLAN 2 (guest)

Code Select Expand


Firewall---1+2---Smart Switch---1+2---Wifi AP
                 |  |  |  |
                 1  1  1  1
                 |  |  |  |
                 PC


On the OPNsense firewall

• I created the VLANs 1 and 2
• I checked that the Firewall port connecting to the smart switch was assigned to LAN interface, but not to one of the VLANs (I assume that means it is trunk).

On the smart switch,

• I set all ports intended for PCs etc. to "Member of VLAN 1 only" and "Untagged", with PVID set to 1
• I set the ports for Firewall and (VLAN-capable WIFI AP) to "Member of VLANs 1 and 2" and "Tagged" with PVID set to 2 (force "guest" in case a non-VLAN device is connected by mistake)

As soon as I completed this setup, I could neither reach the smart switch web interface, nor the firewall (via smart switch).
I can still connect to the firewall if I connect it directly to the PC.
For the smart switch, I probably have to do a factory reset.

Can you tell me what I did wrong?

This question is obsolete and no longer needs to be answered.

Thank you all for your valuable input! I certainly learned a lot in this thread (and doing research because of points you raised).

I've never heard anything positive when it comes to WIFI-Repeater.
I would rather go for 2xAP configured via dedicated controller.

We're talking about extending the Wifi range by about 6m (maybe less if the new AP is better, and better positioned). If this is not a case for a repeater, I don't know what is.

Trouble is, existing cabling limits my positioning options for the second AP. So what's better: An ideally positioned repeater, or a non-optimally positioned AP?

Is an AP with a "controller" mode the same as having a separate controller and two APs?

I think I'll start with a single AP and see what I can do by positioning, then I'll add stuff when and if needed.