OPNSense VLAN and Unifi Switch/AP

[Want2Lean91]

I've followed the below guides to try and setup a guest network (isolated from my internal network) using OPNSense as my DHCP server (my internal network uses a window DHCP server) and my Unifi switches/APs to broadcast the guest network:

https://potatoforinter.net/345/unifi-guest-network-with-pfsense/

https://homenetworkguy.com/how-to/configure-vlans-opnsense/

The issue I'm facing is that when I join my iPhone to the guest network it never acquires an IP address. If I manually assign an IP address to my phone, disable cellular data, and try to load a website nothing happens.

Any ideas where I'm going wrong?

Let me know if there's any screenshots needed; I'd be happy to provide them.

Thanks!

[Demusman]

Yeah, no one is gonna be able to help you without knowing what you did. Just because you say "I followed the guide..." doesn't mean you did it right.
Post pics.

[danderson]

Agreed with comment above, more info needed. This could be a relay issue on L3 or FW rules on the VLAN or both, unknown where/what without more info.

I have a similar setup with Unifi Switches and APs and it works perfect, just using opnsense for DHCP instead of another device.

[va176thunderbolt]

I've done this many times. Feel free. to reach out to me if you need help.

[FullyBorked]

A mistake I made waaay early on with unify is I didn't set my trunk port that goes to my firewall to "all" so that it'll trunk all your vlans.  Secondly go into the live log on the firewall and filter by interface and see if maybe the traffic is getting filtered, maybe you forgot a dhcp rule?

Sent from my Pixel 6 Pro using Tapatalk

[Want2Lean91]

Yeah, no one is gonna be able to help you without knowing what you did. Just because you say "I followed the guide..." doesn't mean you did it right.
Post pics.

Sure thing, and sorry about that! What pics would you like?

Here's the FW rules for that VLAN

[Want2Lean91]

Agreed with comment above, more info needed. This could be a relay issue on L3 or FW rules on the VLAN or both, unknown where/what without more info.

I have a similar setup with Unifi Switches and APs and it works perfect, just using opnsense for DHCP instead of another device.

Fair response - I posed my FW rules below. If there's any other screenshots you'd like please let me know :-)

Thank you!

[Want2Lean91]

I've done this many times. Feel free. to reach out to me if you need help.

I just might.

Sorry to any and all for slow responses; I'm doing this while juggling a newborn. :-)

[Want2Lean91]

A mistake I made waaay early on with unify is I didn't set my trunk port that goes to my firewall to "all" so that it'll trunk all your vlans. 

Is there a guide on how to do that?

[Want2Lean91]

Sorry all - somehow I did not have notifications turned on for replies. I've since fixed that and should be more responsive in the future.

Thanks again.

[scrensen]

Enable logging for those VLAN fw rules and check the live log (filter on the vlan interface if you like) while connecting your mobile to the guest wifi network. Perhaps it will show you the issue already.

If you don't find anything obvious there, then I would run a tcpdump on the opnsense box to see if the DHCP traffic even reaches it. If not then there must be a config issue on either your switches or AP's.

In that case I would check if the switchport where the AP is connected to allows the guest VLAN to pass through

[Demusman]

Agreed with comment above, more info needed. This could be a relay issue on L3 or FW rules on the VLAN or both, unknown where/what without more info.

I have a similar setup with Unifi Switches and APs and it works perfect, just using opnsense for DHCP instead of another device.

Fair response - I posed my FW rules below. If there's any other screenshots you'd like please let me know :-)

Thank you!

I forget if DNS is an automatically created rule but I don't think it is, so blocking "this firewall" will block DNS.
Add a rule to allow DNS above that rule.

Make sure your switchports are set correctly. The port connected to your router will need to be tagged with the vlan id of the guest network.
Then the port your AP is plugged into needs to be tagged with the same vlan ID also.

[Want2Lean91]

I did manually add two DNS servers to the DHCPv4 pool for the guest network




How do I check the switchports? I **think** unifi passes all VLAN information to all ports - I briefly checked this but couldn't find anywhere to set it.

I can create the DNS rule, however, wouldn't me not obtaining an IP address from the pool be a larger issue?

Thanks!

[Want2Lean91]

From what I can see it looks like the port on my switch that OPNSense is plugged in to is passing all VLAN traffic:

[Demusman]

Yes, DHCP is the issue, I was just pointing out that you still won't have internet with the rules as they were.

What about the port the AP is plugged into?