Hey, folks! I had begun configuring VLANs recently, and I’ve got two managed switches between my firewall and my mini PC. I set up a 10 VLAN on the third octet with a /24 mask, and the idea is that anything on 10 should be able to reach the internet but not VLAN 1, while VLAN 1 should be able to access the internet and VLAN 10 services. I’m not so crazy as to try to start with that configuration though. No ports or anything are exposed yet, so my first test was just going to be full access between networks. I maybe counted my initial configuration as a success too soon, because with the mini PC on the 10 network, I can reach the gateway at 192.168.10.1 but nothing else. I can even access the OPNsense config page at the 10 gateway address. If I ping 192.168.1.1, I get “Network is unreachable”. If I ping www.google.com, I get “Temporary failure in name resolution”, and I also can’t pull up sites like YouTube. And again, this is all with a VLAN rule that I believed to be configured to allow all traffic, as it mimics what’s set up for my default LAN interface. Pinging the mini PC from the 1 VLAN also fails; it just sort of times out with 100% packet loss, so perhaps the default rule is less permissive than I thought, but it does say it allows all.
I’ve been following beginner guides from the Home Network Guy (a name that makes this stuff sound more approachable than how he actually presents it), but even with a video that’s not even 3 years old, pieces of OPNsense have been deprecated and replaced with new components such that I can’t follow along verbatim. For instance, it was an ordeal to get DHCP working now that the one he used has been replaced with Dnsmasque DNS and DHCP, and I can’t even tell you what I changed that eventually got it working, but my first couple of tries did not. In one of those videos I’ve been following, he indicates that the default rule on the LAN interface will allow full access between all networks, but that doesn’t seem to be the case, as the same settings on the other VLAN aren’t allowing them to talk to one another.
Obviously, I don’t intend to leave full access between the networks when it’s time to go live, but this simple smoke test shows that there’s a gap in my understanding if I can’t get what should be the easiest test to work. Does anyone know what I’m missing or what I should do to troubleshoot from here?
4, but only 2 are enabled. WAN and LAN. The LAN connection is only split by the managed switches.
Then I really recommend you not to play with vlan and use different eth ports as different segments.
The performance will be significant better this way
Part of the reason it has to be this way is the layout of my apartment. The modem and firewall are in the bedroom, where there is no desk. It then takes a long walk to my living room, where it hits the first switch, and then a short walk from there to my office, where it hits the second switch and all of the computers that need this configuration.
OK, then assuming that you already discarded to run 2 cables and others in this thread provided a very good guide of how to do vlan, I can only recommend to setup some aggregation channels in your opnsense box and some switches to at least mitigated the performance hit.
Not now, of course, first you need yiur setup working