Multiple VLANs - sometimes 60, 80, ...

[danman]

Hi

I'm new with VLANs on OPNsense.

I created a bunch of VLANS and I'm trying to trunk them to an openwrt AP device - mainly VLAN IDs 50, 55, 60 and 80

It's

Code Select Expand

OPNsense -> TP-LINK TL-SG105E -> OpenWrt
OPNsense:
I've 12 VLANs on port 1 (igc1).
All DHCP set and all interfaces up and running.

Switch:
Should receive 20, 25, 50, 55, 60 and 80.
I've configured port 5 as a VLAN trunk.
The PVID on port 5 is 25 but it gets 60.
It also had 80 some reboots.

OpenWrt:
All set up.
When I connect to wifi I currently connect to VLAN 60 even the VLAN device/ID on that wifi is 55.

So the whole AP idea some kind of works, I can see the device on OPNsense but it's just the wrong VLAN ID.

I'm a bit confused. I'm still trying to figure it out how I can set the main IP for igc1 (switch) which should be 25 and of course that the wifi/AP connects to the right VLAN IDs.

Hope someone has a bit time to help me here. Thanks!

[nero355]

I created a bunch of VLANS and I'm trying to trunk them to an openwrt AP device - mainly VLAN IDs 50, 55, 60 and 80

Can't help you with the TP-Link Switch and OpenWRT Accesspoint part, but in general this is the way to do it :

OPNsense :
- Keep LAN for Management purposes and use it UNTAGGED.
- Pick any of the available NICs for a new Interface and just leave it Enabled but without any IP Address configuration.
- Create a VLAN Interface and assign it to the Interface you just Enabled.
- Any additonal VLAN Interfaces can be added to the same Interface.

To keep things simple I will asume you know how to take care of the DHCP/NAT/Firewall Rules stuff and skip that part.



TP-Link (or any other brand) Switch :
- Port #1
Let's use this port for all your VLANs and connect it to the OPNsense NIC that has all the VLANs assigned.
On the webGUI of the Switch you will configure this port to have all the VLAN numbers you mentioned TAGGED.

- Port #2
Because we want to use the OPNsense Default LAN Network for Management Network purposes we need to have one UNTAGGED Port on the Switch for it.
This port will be the one and let's simply use VLAN 1 for now.
You can change this later on if you wish, but for now I want to keep this as simple as possible for a reason I will mention later on!
Connect the NIC that carries the OPNsense LAN network to this port.

- Port #3
This will be the Port that connects to your OpenWRT Accesspoint and carries ALL VLANs basically.
AFAIK/IIRC the default configuration of any OpenWRT device has VLAN 1 assigned to it's NIC but I am not sure if this was UNTAGGED or TAGGED and I have seen some weird comments about it too.

So I will give you two possible scenarios :

Scenario A :
- Assign ALL VLANs on the Switch Port as TAGGED.

Scenario B :
- Assign VLAN 1 UNTAGGED.
- Assign all your other VLANs as TAGGED.



OpenWRT Accesspoint :
- Connect it to Switch Port #3
- Check the UNTAGGED vs. TAGGED stuff mentioned above and see what works correctly.
- Check if you need to do anything special on the NIC Port about allowing your own additional VLANs.
- Assign each of those VLANs to any SSID your going to create as TAGGED.
There is a chance TAGGED isn't even mentioned and the input field simply says VLAN ID or something like that!



And that should be it : You are done! :)

[danman]

Hi nero355

I'm going to try it out later on today.

I thought I just leave that information here too.

My set up currently is with a OpenWrt router which has also a few VLANs. So the switches are actually all set up and working for openwrt. The plan is to replace the openwrt router with the opnsense router and another openwrt AP device.
So the VLANs from the current openwrt router stays the same and has been already created on the opnsense router with some extra VLANs.

opnsense
On opnsense I deleted LAN entirely because I use Port 3 (igc2) for management of the opnsense device directly. igc0 is WAN and igc3 is currently used as WAN DHCP to the current openwrt router.

- Pick any of the available NICs for a new Interface and just leave it Enabled but without any IP Address configuration.

This is one peace is missing currently. I'm using cg1 only for VLANs. Also when I set up a static IP on the switch to VLAN ID 25 that works but I dont want to add on every single device a static IP.

To keep things simple I will asume you know how to take care of the DHCP/NAT/Firewall Rules stuff and skip that part.

I've created them all but I also disable sometimes the firewall just to check it out. Not sure if that helps or makes things even worth though.

switch

- Port #1

I use port 5 for that. I could change that.

- Port #2

No need for that.

- Port #3

This is currently on Port 4 and it seems to work so far, more or less. Similar issues with the switch though.

Like I mentioned above, I'll give it a shot later on.
Thank you for the reply! Really appreciate it.

[nero355]

My set up currently is with a OpenWrt router which has also a few VLANs.
So the switches are actually all set up and working for OpenWRT.

OK, but please note that this :

No need for that.

Is a MUST because FreeBSD based stuff doesn't seem to like UNTAGGED and TAGGED traffic combined on the same Switch Port according to a lot of users here on the forum !!

Unless I misunderstood you and this :

opnsense
On opnsense I deleted LAN entirely because I use Port 3 (igc2) for management of the opnsense device directly.

Means you don't want that type of access anywhere else on your network ?

This is one peace is missing currently.

Then that could be the issue...

But then I am curious about how you got any VLAN traffic flowing at all ?!

Also when I set up a static IP on the switch to VLAN ID 25 that works but I dont want to add on every single device a static IP.

I am sure that once you get everything working correctly the DHCP Server will start working for you correctly too :)

I've created them all but I also disable sometimes the firewall just to check it out.
Not sure if that helps or makes things even worth though.

Disabling the Firewall shoudn't be needed at any point so let's agree to never do that again, OK ? ;)

switch

- Port #1

I use port 5 for that. I could change that.

Whatever works for you is fine, but just make sure the TAGGED/UNTAGGED configuration for each Switch Port is correct.

This is currently on Port 4 and it seems to work so far, more or less. Similar issues with the switch though.

Like I mentioned above, I'll give it a shot later on.

Just double check everything and then post the results here and we can try to fix whatever needs fixing...

Thank you for the reply! Really appreciate it.

You are welcome! :)

[danman]

Is a MUST because FreeBSD based stuff doesn't seem to like UNTAGGED and TAGGED traffic combined on the same Switch Port according to a lot of users here on the forum !!

I've on that port only VLANs TAGGED to the switch and also now that - "- Pick any of the available NICs for a new Interface and just leave it Enabled but without any IP Address configuration." but that doesnt change anything. Same issue as before.

Means you don't want that type of access anywhere else on your network ?

I've created a VLAN management for that but I'm not sure if Im going to use it.I might set things differently. But for now, the port 3 is the physical (no VLAN/untagged) access to the opnsense router.

I am sure that once you get everything working correctly the DHCP Server will start working for you correctly too :)

I hope so :D

Disabling the Firewall shoudn't be needed at any point so let's agree to never do that again, OK ? ;)

Haha, yeah its not connected to the Internet. I just want to set things up first. It can be handy to check out any firewall issues. I might reset the switch, might be an issue there.
I watched a video last night that you should suppose to set the VLAN PVID only on untagged ports but how does opnsense know which VLAN to handle the switch with then? And I always changed the PVID to work with OpenWrt and this works fine for years that way.

Whatever works for you is fine, but just make sure the TAGGED/UNTAGGED configuration for each Switch Port is correct.

Yeah, port 5 gets all VLANs (tagged) and some goes to the port 4/openwrt (tagged) and the other 3 ports are untagged.

Just by writing the last sentence I realised I never checked the untagged ports. Which I did now. Port 1 is running on ID 80 which works. Port 2 ID 20 and Port 3 on 50. All ports are working fine and gets the right DHCP/IP range etc. PVID works on that side, that is good.

So that basically means to me, that I probably should set up on opnsense igc1 port with the right IP range (25)? I'm trying to set the switch on VLAN ID 25 same for the openwrt but it always gets 80 and sometimes 60. If I set a static ip for the switch that would work too but as I mentioned there are coming a few more devices with TAGGED ports and I dont wanna play that game.

Just wondering why openwrt doesnt have the issues with PVID and opnsense has it or I can't find the set up for it or whatever.

So if I can't use PVID 25 for Port 4 & 5 to tell OPNsense in which DHCP/IP range it should put those devices how can I change it on opnsense side and not setting up static IPs?

[viragomann]

Switch:
Should receive 20, 25, 50, 55, 60 and 80.
I've configured port 5 as a VLAN trunk.
The PVID on port 5 is 25 but it gets 60.
It also had 80 some reboots.

If port 5 is a trunk, connected directly to OPNsense, it must not have a PVID defined.
This would tag any incoming packet with VLAN ID 5, which makes no sense for a trunk port.

PVID is typically used to connect non-VLAN-aware devices to a VLAN.

[danman]

1. By default, the PVID of all ports is 1.
2. 802.1Q VLAN PVID will be restored to 1 when 802.1Q VLAN is disabled.

This would tag any incoming packet with VLAN ID 5, which makes no sense for a trunk port.

Not sure why it would be 5 but it doesn't matter.

I need to somehow tell the switch to connect to the specific VLAN ID 25 which would mean, whenever I use a device to trunk VLANs I'll need to set a static IP  for that particular device as well.
Because I've a few devices/VMs I would like to avoid that :D

[viragomann]

Not sure why it would be 5 but it doesn't matter.

Sorry, it's 25.
But, this doesn't make things even better.

I need to somehow tell the switch to connect to the specific VLAN ID 25

What??
On a trunk port you can only connected VLANs. All incoming packets have to be tagged already. Configuring a PVID on this port will lead into tagging also packets, which belong to other VLANs.
If you want to connect devices to VLAN 25 you will have to use a different switch port, where you can configure the PVID.

[danman]

I was just editing my post...

Edit:
I think I probably miss something here.  I just try to understand that:
OPNsense

• all VLANs are running on Port 1 (igc1)
• IP set
• DHCP set

switch on port 5

• all tagged, nothing untagged on port 5
• PVID doesn't matter
• for now only static IP works

openwrt AP

• all tagged from switch port 4 to WAN port
• VLANs created
• WiFi 2.4 for VLAN ID 80 and wifi 5 for VLAN 50 (but it connects to ID 60/80 or whatever)

I just hooked the switch and the openwrt AP device onto my current set up with the main openwrt router. VLAN configs are the exact same for the AP and switch like I try to use with the opnsense router.
That works very good. Thats not helpful :D

EDIT END

If you want to connect devices to VLAN 25 you will have to use a different switch port, where you can configure the PVID.

Yeah, that works too. The issue is here how can I tell opnsense that the switch I use to trunk the VLANs to to put this switch in IP range 25 (VLAN ID 25) without static IP and without PVID?

I don't understand why the openwrt AP doesnt connect to right VLAN ID either. It doesnt makes sense. I've to check that again. Something doesnt work here right :D but actually I checked it already but obviously there is something weird going on.

[viragomann]

openwrt AP

• all tagged from switch port 4 to WAN port
• VLANs created
• WiFi 2.4 for VLAN ID 80 and wifi 5 for VLAN 50 (but it connects to ID 60/80 or whatever)

So you have configured the switch port 4 as trunk with VLAN 50 and 80?

I don't understand why the openwrt AP doesnt connect to right VLAN ID either.

The OpenWRT itself or connected wifi clients?

If you want to connect devices to VLAN 25 you will have to use a different switch port, where you can configure the PVID.

The issue is here how can I tell opnsense that the switch I use to trunk the VLANs to to put this switch in IP range 25 (VLAN ID 25) without static IP and without PVID?

So you want to connect the switch to VLAN 25? Why not static IP configuration?
If you want to assign an IP via DHCP you will have to configure the at least the VLAN on the switch. But I don't know if the TP-Link switch even supports this.