Messages

I did adjust the tunables as per the opnsense documentation. I'll try disabling DHCP on the VLAN within the bridge and see if that improves my problem. I think it's also probably time to buy a switch and stop messing with this bridge too!

Thank you pmhausen, your answer has helped me a lot. I didn't know you couldn't have a VLAN on a port that is part of a bridge. I carried out your instructions almost exactly except that i put my IOT VLAN into my LAN bridge and kept my trusted VLAN outside the bridge since i only have 4 trusted devices (two laptops and two phones) so it's easier to seperate them out rather than all the individual IoT devices.

Do i still have to enable DHCP on the VLAN contained within the bridge or is this handled by the bridge? Also if i have an allow all rule for my trusted VLAN, can it connect via telnet and ssh to devices in the other VLAN? I tried telnet from my laptop and it said connection refused despite being able to ping the destination device

I only have one access point and want to divide the devices connected into two subnets

Ok that makes sense. Thanks for your prompt reply

I have an opnsense router with quad NIC with 3 of the ports setup with a LAN bridge and the 4th being WAN. Tonight, i tried creating two VLANs with tags 10 & 20, with the parent set as the one of the bridged ports (igc0). I created firewall rules for the two VLAN interfaces to allow all traffic and also enabled DHCP on both interfaces. Then i went to my access point which is plugged into to igc0 and assigned VLAN tags 10 & 20 to the 5ghz and 2.4Ghz SSIDs. Upon doing this, i immediately lost all network access through wifi and couldn't ping anything. Actually, my wifi connected laptop stopped being assigned an IP adress and had to self assign.

Any reason why this would happen, considering i only had a single allow all rule assigned to the interface? i feel like it might be related to the fact that i have a LAN bridge set up linking 3 ports on my router (in place of a switch)

Hi, I run opnsense on a mini PC along with home assistant on a raspberry pi running some IoT devices. I plan to move the home assistant and all IoT devices to a separate vlan from my laptop and phone for security purposes.

I'm a networking newbie so wanted to ask, will this break any of my automations or functionality? I assumed it wouldn't matter as long as home assistant and the IoT devices are on the same VLAN. I also assume I'll have to put in a rule to allow me to access the web GUI for home assistant as well (perhaps only allowing port 8123). Any other rules I might need to setup?

I was also thinking I could seperate the VLANs and initially allow all traffic but measure traffic crossing the VLAN boundary to see what rules I might need to apply. How would I go about logging the traffic between the VLANs like this?

Thanks

Wish I read this before I picked an eap670 up on the way home today!
Are there any issues if I don't wish to use IPv6? Also this is probably a stupid question but can I place different ssids on different VLANs and preserve these tags thru a smart switch? I've always thought that smart switches only allowed one tag per port

I was looking to buy the tp-link eap670 as an access point for my home. Will I need a seperate controller? Any issues using this AP with opnsense?

Thanks in advance

Hi
I have setup opnsense to route all LAN traffic through a VPN tunnel using PIA and wireguard (as per script made by Fingerless Gloves) but apparently there may still be DNS leaks if using a local DNS server. I use the unbound DNS server on opnsense, how can I route this through the tunnel to avoid DNS leaks. Or is there another easier way to avoid leaks?

Fixed it, it turns out that it was a bad ethernet cable. Thanks for all the help

It sounds like either the adaptors or other hardware is limiting. Please check the LAN interface is getting set to the correct speed ie. "1000baseT <full-duplex>" or whatever is right for your hardware, but that is above 100. It sounds like it might be syncing at 100.

You are 100% correct! it is 100baseT in my LAN interface overview. I think this is some kind of issue with my aliexpress Topton PC since it has the newer i226 intel NIC. Anyone know of a workaround?

I don't think the hardware is the issue since it's a n5105 celeron and the CPU is only  at about 30% usage when I check the dashboard. I have only 4gb ram but even this is at about 50% usage at maximum. I have disabled all intrusion prevention (zenarmot and suricata) but still get the same 95MBps rate even when just running iperf between my Mac directly connected to the opnsense box with a cat6 ethernet cable. The fact that all network speed tests hover around 85 to 95Mbps make me think something is setting a speed limit in opnsense.

Has anyone experienced something similar?

Not sure if this is the right forum to post this but i have just set up a mini pc running opnsense and ran iperf using a cat 6 cable connected from the LAN port of the mini PC directly into my macbook (through an ethernet to usb C adaptor) and it gave me speeds around 95Mbits/sec. I tried using macbook connected to 5ghz wifi from access point connected via cat 6 ethernet (to eliminate the USB-c adaptor as the cause of the problem) and still got the same speeds. Running speedtest on my laptop using Ookla also gives 95Mbits/sec using either wifi or ethernet cat6 cable direct to opnsense router. Yet speedtest directly from opnsense is 250Mbits/sec (the speed that i'm paying for). Any ideas why this might happen? I'm thoroughly confused

Thanks

The communication on the same VLAN is not regulated by the firewall, because they are in the same network, there is no routing, UNLESS the switch or APs provide client isolation, That is a feature you will usually find only when the insfrastructure also supports VLANs.

The systematic approach is to categorize devices and put them in separate VLANs and regulate communications between the categories, not between individual clients.

This makes perfect sense. If I end up getting some unifi access points, I assume I need to make a few different SSIDs (for trusted and non trusted) and assign different vlan tags go these different SSIDs using the unifi software and then the same tags on opnsense. Is this correct?

Also until I purchase the new access points and switches, is there an option to make a firewall rule blocking all communication from my non trusted devices to my trusted devices? I only have two laptops and two phones so couldn't I just make aliases for the trusted IPs and non trusted IPs and only allow one way communication from trusted to non trusted? What are the disadvantages of this versus VLANs? Thanks again for the help

Given enough free ports on the OPNsense device you can build a port based VLAN with a bridge interface.

This idea appeals to me since I have a quad NIC and am currently only using two ports (lan and wan). Does this mean I need separate access points for the IOT and trusted networks though?

Thanks