Multiple VLANs - sometimes 60, 80, ...

[danman]

Hi

I'm new with VLANs on OPNsense.

I created a bunch of VLANS and I'm trying to trunk them to an openwrt AP device - mainly VLAN IDs 50, 55, 60 and 80

It's

Code Select Expand

OPNsense -> TP-LINK TL-SG105E -> OpenWrt
OPNsense:
I've 12 VLANs on port 1 (igc1).
All DHCP set and all interfaces up and running.

Switch:
Should receive 20, 25, 50, 55, 60 and 80.
I've configured port 5 as a VLAN trunk.
The PVID on port 5 is 25 but it gets 60.
It also had 80 some reboots.

OpenWrt:
All set up.
When I connect to wifi I currently connect to VLAN 60 even the VLAN device/ID on that wifi is 55.

So the whole AP idea some kind of works, I can see the device on OPNsense but it's just the wrong VLAN ID.

I'm a bit confused. I'm still trying to figure it out how I can set the main IP for igc1 (switch) which should be 25 and of course that the wifi/AP connects to the right VLAN IDs.

Hope someone has a bit time to help me here. Thanks!

[nero355]

I created a bunch of VLANS and I'm trying to trunk them to an openwrt AP device - mainly VLAN IDs 50, 55, 60 and 80

Can't help you with the TP-Link Switch and OpenWRT Accesspoint part, but in general this is the way to do it :

OPNsense :
- Keep LAN for Management purposes and use it UNTAGGED.
- Pick any of the available NICs for a new Interface and just leave it Enabled but without any IP Address configuration.
- Create a VLAN Interface and assign it to the Interface you just Enabled.
- Any additonal VLAN Interfaces can be added to the same Interface.

To keep things simple I will asume you know how to take care of the DHCP/NAT/Firewall Rules stuff and skip that part.



TP-Link (or any other brand) Switch :
- Port #1
Let's use this port for all your VLANs and connect it to the OPNsense NIC that has all the VLANs assigned.
On the webGUI of the Switch you will configure this port to have all the VLAN numbers you mentioned TAGGED.

- Port #2
Because we want to use the OPNsense Default LAN Network for Management Network purposes we need to have one UNTAGGED Port on the Switch for it.
This port will be the one and let's simply use VLAN 1 for now.
You can change this later on if you wish, but for now I want to keep this as simple as possible for a reason I will mention later on!
Connect the NIC that carries the OPNsense LAN network to this port.

- Port #3
This will be the Port that connects to your OpenWRT Accesspoint and carries ALL VLANs basically.
AFAIK/IIRC the default configuration of any OpenWRT device has VLAN 1 assigned to it's NIC but I am not sure if this was UNTAGGED or TAGGED and I have seen some weird comments about it too.

So I will give you two possible scenarios :

Scenario A :
- Assign ALL VLANs on the Switch Port as TAGGED.

Scenario B :
- Assign VLAN 1 UNTAGGED.
- Assign all your other VLANs as TAGGED.



OpenWRT Accesspoint :
- Connect it to Switch Port #3
- Check the UNTAGGED vs. TAGGED stuff mentioned above and see what works correctly.
- Check if you need to do anything special on the NIC Port about allowing your own additional VLANs.
- Assign each of those VLANs to any SSID your going to create as TAGGED.
There is a chance TAGGED isn't even mentioned and the input field simply says VLAN ID or something like that!



And that should be it : You are done! :)

[danman]

Hi nero355

I'm going to try it out later on today.

I thought I just leave that information here too.

My set up currently is with a OpenWrt router which has also a few VLANs. So the switches are actually all set up and working for openwrt. The plan is to replace the openwrt router with the opnsense router and another openwrt AP device.
So the VLANs from the current openwrt router stays the same and has been already created on the opnsense router with some extra VLANs.

opnsense
On opnsense I deleted LAN entirely because I use Port 3 (igc2) for management of the opnsense device directly. igc0 is WAN and igc3 is currently used as WAN DHCP to the current openwrt router.

- Pick any of the available NICs for a new Interface and just leave it Enabled but without any IP Address configuration.

This is one peace is missing currently. I'm using cg1 only for VLANs. Also when I set up a static IP on the switch to VLAN ID 25 that works but I dont want to add on every single device a static IP.

To keep things simple I will asume you know how to take care of the DHCP/NAT/Firewall Rules stuff and skip that part.

I've created them all but I also disable sometimes the firewall just to check it out. Not sure if that helps or makes things even worth though.

switch

- Port #1

I use port 5 for that. I could change that.

- Port #2

No need for that.

- Port #3

This is currently on Port 4 and it seems to work so far, more or less. Similar issues with the switch though.

Like I mentioned above, I'll give it a shot later on.
Thank you for the reply! Really appreciate it.

[nero355]

My set up currently is with a OpenWrt router which has also a few VLANs.
So the switches are actually all set up and working for OpenWRT.

OK, but please note that this :

No need for that.

Is a MUST because FreeBSD based stuff doesn't seem to like UNTAGGED and TAGGED traffic combined on the same Switch Port according to a lot of users here on the forum !!

Unless I misunderstood you and this :

opnsense
On opnsense I deleted LAN entirely because I use Port 3 (igc2) for management of the opnsense device directly.

Means you don't want that type of access anywhere else on your network ?

This is one peace is missing currently.

Then that could be the issue...

But then I am curious about how you got any VLAN traffic flowing at all ?!

Also when I set up a static IP on the switch to VLAN ID 25 that works but I dont want to add on every single device a static IP.

I am sure that once you get everything working correctly the DHCP Server will start working for you correctly too :)

I've created them all but I also disable sometimes the firewall just to check it out.
Not sure if that helps or makes things even worth though.

Disabling the Firewall shoudn't be needed at any point so let's agree to never do that again, OK ? ;)

switch

- Port #1

I use port 5 for that. I could change that.

Whatever works for you is fine, but just make sure the TAGGED/UNTAGGED configuration for each Switch Port is correct.

This is currently on Port 4 and it seems to work so far, more or less. Similar issues with the switch though.

Like I mentioned above, I'll give it a shot later on.

Just double check everything and then post the results here and we can try to fix whatever needs fixing...

Thank you for the reply! Really appreciate it.

You are welcome! :)

[danman]

Is a MUST because FreeBSD based stuff doesn't seem to like UNTAGGED and TAGGED traffic combined on the same Switch Port according to a lot of users here on the forum !!

I've on that port only VLANs TAGGED to the switch and also now that - "- Pick any of the available NICs for a new Interface and just leave it Enabled but without any IP Address configuration." but that doesnt change anything. Same issue as before.

Means you don't want that type of access anywhere else on your network ?

I've created a VLAN management for that but I'm not sure if Im going to use it.I might set things differently. But for now, the port 3 is the physical (no VLAN/untagged) access to the opnsense router.

I am sure that once you get everything working correctly the DHCP Server will start working for you correctly too :)

I hope so :D

Disabling the Firewall shoudn't be needed at any point so let's agree to never do that again, OK ? ;)

Haha, yeah its not connected to the Internet. I just want to set things up first. It can be handy to check out any firewall issues. I might reset the switch, might be an issue there.
I watched a video last night that you should suppose to set the VLAN PVID only on untagged ports but how does opnsense know which VLAN to handle the switch with then? And I always changed the PVID to work with OpenWrt and this works fine for years that way.

Whatever works for you is fine, but just make sure the TAGGED/UNTAGGED configuration for each Switch Port is correct.

Yeah, port 5 gets all VLANs (tagged) and some goes to the port 4/openwrt (tagged) and the other 3 ports are untagged.

Just by writing the last sentence I realised I never checked the untagged ports. Which I did now. Port 1 is running on ID 80 which works. Port 2 ID 20 and Port 3 on 50. All ports are working fine and gets the right DHCP/IP range etc. PVID works on that side, that is good.

So that basically means to me, that I probably should set up on opnsense igc1 port with the right IP range (25)? I'm trying to set the switch on VLAN ID 25 same for the openwrt but it always gets 80 and sometimes 60. If I set a static ip for the switch that would work too but as I mentioned there are coming a few more devices with TAGGED ports and I dont wanna play that game.

Just wondering why openwrt doesnt have the issues with PVID and opnsense has it or I can't find the set up for it or whatever.

So if I can't use PVID 25 for Port 4 & 5 to tell OPNsense in which DHCP/IP range it should put those devices how can I change it on opnsense side and not setting up static IPs?