Creating VLANs with Dnsmasq DHCP

[malebron]

Using OPNsense 26.7.7 on bare metal with a Unify managed switch (USW Pro SG8) and several Unify APs. My very basic flat network has worked well for years.

I finally decided to add VLANs for Guest and IOT. Before starting I upgraded everything to the most recent releases, including migrating from ISC DHCP to Dnsmasq DHCP as recommended. Everything went smoothly.

I followed the steps in several videos as carefully as possible, but they were based on older software versions with different UIs.

Everything looks right as far as I can tell, but when I try to connect via WiFi to the IOT SSID connection fails with "cannot get IP address". I assume the problem is in the DHCP setup somewhere, but I can't find it. (Everything else is working as before)

Observations
In the videos using ISC DHCP there is a simple checkbox to activate DHCP for each VLAN. I can't find anything equivalent for Dnsmasq. It seems you just set the range and enable for all interfaces under Dnsmasq-General.

One video showed the VLANs listed under Interfaces on the dashboard. I only see the physical interfaces listed (LAN and WAN).

Any help in troubleshooting this would be appreciated. It's very basic setup so I'm probably missing something obvious.

Thank you!

[nero355]

Sounds like you have not created any VLAN Interfaces and assigned them to one of your unused NICs ?

Please post what you have done so far step-by-step and what is working or not exactly ;)

[malebron]

Thanks nero355

VLANs are assigned to my LAN port (10Gb) which is uplinked to my switch.

They show listed under the interfaces tab and under Interfaces: Devices: VLAN

Correct DHCP ranges are shown on interfaces: Assignments

Under Services: Dndmasq DNS and DHCP: General the VLANS are listed under Devices ("All" is selected)

QUESTION:
For a VLAN tag 20 with range X.X.20.2-X.X.20.254 I'm assuming the DHCP server IP I specify on the switch is X.X.20.1  ?

Thx

[nero355]

VLANs are assigned to my LAN port (10Gb) which is uplinked to my switch.

- Is the Port on the Switch configured as TAGGED ?
- How did you configure the Port where the Accesspoint is connected ?
- How did you configure the Accesspoint ?
- Do you have more than 1 Switch ?
- Did you copy the Default Allow Any to Any Firewall Rule from the Default LAN network to the VLAN Interface network ?

For a VLAN tag 20 with range X.X.20.2-X.X.20.254 I'm assuming the DHCP server IP I specify on the switch is X.X.20.1  ?

That is one of the correct options and in this case the most used one :)

But I assume you don't do it on the Switch and configure on your OPNsense instead ?!

[malebron]

Urgh. I should watch more episodes of the IT Crowd ("Turn it off and on again")!

I simply rebooted OPNsense (suggestion from AI) and my VLANs now show up on the dashboard and I can connect to my IOT network via WiFi (although without internet). I can see that it assigned an IP address in the correct range.

I configured the firewall rules to be wide open for testing, so I don't understand why it can't see the internet. More troubleshooting...

Thanks for taking the time to help.

 

[BoNetTech]

Hi malebron, glad the VLANs are up now.

When a device gets an address in the right range but has no internet, it helps to find out where it stops. I have not seen your setup, so these are things to check and not a sure answer.

First test from a device on the IOT network: can it reach a public address by number, for example one of the well known public DNS servers, and can it reach a website by name? Please tell us which of the two works.

If the number works but the name does not, the problem is DNS. Check what DNS server the device received. It is usually the firewall address on that VLAN. Then check that the DNS service on the firewall really listens on that VLAN and allows requests from it. If you run another DNS service next to Dnsmasq, check that one as well.

If neither works, look at the outbound NAT. In automatic mode new networks are added by themselves, but in hybrid or manual mode the IOT network may be missing and needs its own rule. Also check the device received the firewall address on that VLAN as gateway, and that no floating rule or alias blocks the traffic before your open rule.

Please also tell us which outbound NAT mode you use and what address, gateway and DNS the device got. That will make it easy to see where it stops.

Sergio