Odd Issue / Potential Defect

[jbhorner]

I added a new VLAN today and went through the usual processes. (Add VLAN with assigned parent, add interface, enable interface and assign static IPv4 address, add DHCPv4 configuration, enable.) I could not get any device on my switch to come up if it was on a tagged port for that VLAN, despite numerous switch configuration changes. (I usually blame the switch--but not for any specific reason; the port configured was the same as other ports albeit with a different tag.) I also walked through the process again on OPNsense with no success.

Rebooting the switch didn't make a difference. What did make a difference was rebooting OPNsense. When it came back up, the device worked. I replicated that port across others on my switch and they worked fine after the OPNsense reboot as well. This seems odd to me.

To me, it's a defect. Despite some of the other silly things OPNsense does (why does every VLAN "device" have to start with VLAN0, as an example), this one really makes me scratch my head. Certainly a lesson learned. I do not recall this behavior in the past, however.

Is this known behavior, and if so, is it normal for this platform?

Cheers!
    Joel

[pasha-19]

A simple question; did you provide firewall rules (or check for their existence) to allow access to the VLan's devices?

[jbhorner]

Hi, I replicated the firewall rules (with interface changes) from another working interface. (With the obvious changes to reflect the interface to which the rules were on.) The rules added were specific to Internet access and DNS.

With that said, I'm unaware of any rules needed on an interface to merely allow devices to obtain an DHCP address. Even if I assigned a static address on the device, it didn't work. From the time I rebooted OPNsense and the time it came back up, I made no changes to rules, interfaces, DHCP, etc. It just started working. It would seem that if it was a rule problem it would have been the same before and after the reboot absent changes.

[pasha-19]

A request for DHCP starts with a transmission where the Source IP is 0.0.0.0 Source port 68 Destination IP 255.255.255.255.Destination Port 67.  When I used a TP-Link Router for DHCP there was a response Source IP Switch's vlan interface address  Source port 67 Destination IP the offered IP address Destination Port 68.  When I used a Dell N2024 router the response was different   Source IP Switch's vlan interface address  Source port 67 Destination IP was 255.255.255.255 Destination Port 68.

I suggest checking the firewall log for blocked transactions.  I believe OpnSense DHCP on the router followed the TP-Link response pattern.  By the way there are two paris of these transactions to complete the process.  As I understand it the first pair get the offered address back to the requester.  The second pair confirms acceptance of the offer.