Cannot Connect To Network Switch From LAN

Started by run('Jimbo');, October 26, 2024, 03:58:27 PM

Previous topic - Next topic
Sorry, I don't understand what you mean?

I have 4 vlans on igb1 working well...

Thanks
Jimbo.

    OPNsense 24.7.7
------------------------

Quote from: run('Jimbo'); on October 26, 2024, 03:58:27 PM
...
Interface LAN        (igb0); 10.34.1.0/24
Interface SWITCH  (igb1); 10.34.2.0/24 -> NETGEAR MANAGED SWITCH static 10.34.1.50
...

Maybe it's a terminology issue (it could be on my side too), but when I read the above, I only see 1 network/subnet per physical interface.
You had mentioned VLANs earlier in this thread, but not how they were configured (and nobody asked because it seemed irrelevant since we were only dealing with native networks).
You probably have your reasons for creating that 2nd network. I'll leave it at that...

AFAIK, VLANs have no access to the underlying native network by default.
In fact, by default, they don't seem to have access to anything.

Quote from: run('Jimbo'); on October 26, 2024, 08:10:18 PM
I want to separate my vlans and switch from igb0 because it's allow all by default. If I move over to igb1 I can block all on igb1 and ony allow what is needed on the vlan interfaces...

LAN should have access to all regardless???

Thanks
Jimbo.

    OPNsense 24.7.7
------------------------

Yes, I saw this. I guess my initial statement about VLANs should not have been about existence but relevance.

I merely wanted to make sure you understood that the physical isolation (LAN vs SWITCH) is orthogonal to the isolation you want from your VLANs, regardless of their parent interface.
By default, LAN gets a ANY to ANY rule (you can change it, override it...).
SWITCH got nothing by default. You may have given it access to the Internet but apparently not LAN (devices off the switch in the SWITCH native subnet can't reach LAN).
VLANs (regardless of parent interface) get nothing by default either. You decide what to allow, independently of the parent interface.
At least that's my experience...