Hey, folks! I had begun configuring VLANs recently, and I’ve got two managed switches between my firewall and my mini PC. I set up a 10 VLAN on the third octet with a /24 mask, and the idea is that anything on 10 should be able to reach the internet but not VLAN 1, while VLAN 1 should be able to access the internet and VLAN 10 services. I’m not so crazy as to try to start with that configuration though. No ports or anything are exposed yet, so my first test was just going to be full access between networks. I maybe counted my initial configuration as a success too soon, because with the mini PC on the 10 network, I can reach the gateway at 192.168.10.1 but nothing else. I can even access the OPNsense config page at the 10 gateway address. If I ping 192.168.1.1, I get “Network is unreachable”. If I ping www.google.com, I get “Temporary failure in name resolution”, and I also can’t pull up sites like YouTube. And again, this is all with a VLAN rule that I believed to be configured to allow all traffic, as it mimics what’s set up for my default LAN interface. Pinging the mini PC from the 1 VLAN also fails; it just sort of times out with 100% packet loss, so perhaps the default rule is less permissive than I thought, but it does say it allows all.
I’ve been following beginner guides from the Home Network Guy (a name that makes this stuff sound more approachable than how he actually presents it), but even with a video that’s not even 3 years old, pieces of OPNsense have been deprecated and replaced with new components such that I can’t follow along verbatim. For instance, it was an ordeal to get DHCP working now that the one he used has been replaced with Dnsmasque DNS and DHCP, and I can’t even tell you what I changed that eventually got it working, but my first couple of tries did not. In one of those videos I’ve been following, he indicates that the default rule on the LAN interface will allow full access between all networks, but that doesn’t seem to be the case, as the same settings on the other VLAN aren’t allowing them to talk to one another.
Obviously, I don’t intend to leave full access between the networks when it’s time to go live, but this simple smoke test shows that there’s a gap in my understanding if I can’t get what should be the easiest test to work. Does anyone know what I’m missing or what I should do to troubleshoot from here?
Thanks!
Ok, so first of all a TON of things have changed in OPNsense in the last couple updates so you may just want to pull everything you did. It looks like you are using the old firewall rules which while they are going to stick around they are trying to migrate people away from them.
You should be using KEA DHCP as that is the modern and latest and greatest DHCP server that is vLAN aware. Also UnboundDNS is a recursive DNS server and designed for modern networks, with the advantage of being able to use DNS Blocklists to block ads and other “junk.” Just remember that the blocklists live in RAM so if you don’t have much RAM available I wouldn’t recommend using them.
NOTE: If you are using Dnsmasq DNS&DHCP you will have to turn it off before you can enable KEA DHCP and UnboundDNS as it will tie up the ports needed and they will fail to start. You can copy everything over before making the change and if there is an issue you can switch back just by stopping the new ones and enabling the old one.
With that said one of the biggest things is that with a managed switch you will need to trunk the port that OPNsense is plugged in to for the LAN unless you are using multiple ports on your OpnSense install and then those ports will need to be properly tagged and you will need to trunk any ports that are linking switches together you will have to figure that out on your own but I suggest grabbing a copy of your switch’s manual (and if you use a chatbot upload that file to it for help.) Then you can use vLAN tagging for each port that you want to receive an IP address from a particular pool automatically. You can also trunk ports that you want to use for management but set the default the port will use for access so the device can get an ip via DHCP, this really only works well with Linux. If you are using windows you will need to just create firewall rules that allow your device to talk to the other vLAN’s instead.
When you create your firewall rules you have to understand that you can only preform one action per rule. If you want to allow your vLAN 1 network to talk to vLAN 10 that is one rule. To allow vLAN 10 to talk to the internet that is another rule. You can use floating rules to do the work on multiple vLAN’s but that should be limited. If you select more than one network interface a rule will becoming a floating rule and will process before other rules so if you create a rule to block something later on but have the same interface set on a floating rule the block will not work, it’s better to enable piece by piece than to blanket enable and then try to block. With 5 vLAN’s I have 5 floating rules and 34 regular rules plus 40 automatically generated rules (which handle things like allowing DHCP access and basic protections.)
Here is a firewall rule that allows my “Trusted” vLAN to access my “Camera” vLAN as an example. The Categories are not important but make finding what a rule deals with later on a lot easier, they are set under the firewalls - categories. You should also use good descriptions for this reason.
You will also have to explicitly allow access to services like DNS. This is how I am allowing my “Trusted” vLAN to access DNS services on my OPNsense.
This is how I allow my trusted network to access the internet. If you have multiple WAN’s you can choose a specific one or if you have failover configured you would likely select the “group” you created when you setup the failover.
If you need more help let me know. If you have been tinkering with a bunch of stuff you may want to start over, just backup your current configuration and reset everything to defaults. If you can’t figure it out you can reset to defaults and restore your configuration.
Thanks! I appreciate step by step guides with explanations, but as we’ve both covered, the guides I followed have now fallen way out of date. Has OPNsense always moved this fast with ripping out components and paradigms and replacing them with others? Do you have an up to date video guide that you could refer me to so that I get more "how"s and "why"s along with each setting to help understand it better?
Unlike some other settings in OPNsense, there’s nothing like “Legacy” or “Deprecated” to indicate that Dnsmasque is being phased out, and when I see “new Rules”, I suspect that it’s so hot off the presses that it may not be fully working yet. Their replacements are both ready for prime time? Blocking ads by DNS wasn’t a goal I had in mind for this project of mine, but I can’t say I haven’t been tempted to increase scope to cover it.
My switches are both GS305E Netgear switches, and the word “trunk” doesn’t show up anywhere in the manual. What I do have are VLAN 10 ports tagged when they face the firewall or another managed switch; and untagged when they face the end device; as per Home Network Guy. That was what got me far enough along that I was able to ping the gateway. Before that, my pings went completely unanswered.
Unfortunately, most of my networking experiments end up sectioned off to the weekend, because I try to minimize any damage I might do to my home network during the work week (I work from home) and disruption for my wife trying to enjoy the internet herself. All that to say that I might be back here again asking for help, but it will be on a hell of a lag. You definitely gave me some homework to do, too.
No. I didn’t use any video’s to set mine up and wouldn’t even know where to find one that is up to date.
Dnsmasq isn’t being deprecated that I know of but when you begin doing more advanced functions some tools work better than others. The “New” rules are fully functional and I suspect the old ones will slowly be removed in later releases. They are revamping some stuff, ISC DHCP used to be the go to but that is being passed out by the creators. https://www.isc.org/kea/ and OPNsense is cleaning up things so it all works with the rest api and is higher performance.
Trunking is when a port can deal with all setup vLAN’s not sure about your switches as they are pretty basic looking. I’m using a pair of Dell PowerConnect 5548’s and a Quanta LB6M which are much more complex. But basically think of a vLAN as a branch of a tree and the Trunk is the base that connects to everything.
I don’t see myself needing more advanced functions, and at this point I’d be happy to get the basic ones working, haha.
I understand the concept of a trunk port, but I don’t know how to translate that into some other terminology that my manual uses instead, or if there’s some other paradigm. To the best of my knowledge, it’s the difference between a tagged port and an untagged port, which I think I have configured correctly. I must be at least in the ballpark if I can hit the gateway and nothing else.
It’s not just about the advanced functions. Many of the older more basic tools are single threaded which will potentially limit the performance. As you figure things out you will want to do more and you may find the current tools more of a limiting factor. But the choice is yours, I have 2 48port gigabit switches and WiFi SSID’s that connect to specific vLAN’s through tagging. I started with some dumb switches and added my 10Gbps backbone switch which I used as a dumb switch for years so I could connect my desktop and server over a faster connection.
In my equipment an untagged port is what a port is where the vLAN is stripped away. A tagged port has the vLAN tag passed to the device. If you can set multiple vlan tags on the same port that port becomes a trunked port. You may also be able to set a vlan as untagged on that port, if a device is plugged into that port it will by default be on the untagged vLAN. If the device is able to handle vLAN tagging it can live on the vLAN’s you set up as well.
It took me a bit to figure it all out and get it working. I spent about 20 hours configuring things before I started making the switch from a single net to multiple vLAN’s. I spent another 8 hours making the change and 5 or 6 more tweaking things.
I watched and rewatched tutorial videos, traced my cables and ports, and configured the port settings until I was able to ping the gateway on this VLAN. That’s as far as I’ve gotten. Over the course of today, since posting this thread, I’ve rechecked those settings a handful of times, and they still appear to be correct as far as I know. If I delete the extremely permissive firewall rule that I set up for the VLAN, I lose the ability to ping the gateway, which seemingly validates the rest of my setup and leads me to believe that this is a configuration issue in OPNsense rather than the configuration of my switches…but I don’t know what I don’t know, and I’m still learning this stuff.
I understand that you’re recommending what you think is best based on your experience, but as I’ve been trying to learn self hosting with a semi-simple goal in mind, the extra complexity that folks keep recommending around just about every facet, because their needs or desires are greater than mine once they’re more seasoned than me, does make it all more difficult to take in during the learning process. Maybe I’ll want to go more advanced some day, but for now, the goal is to host fewer than a dozen services off of two different devices that live under my office desk and consume under 100W between them. I want VLANs for this as a means of separation in case the security of my exposed services is compromised, but with this smoke test, I want to prove that I understand the basics of doing so, so it’s currently feeling defeating that I don’t. I don’t want to sound like I’m not appreciative of any help you can offer, but I do still believe that simpler is better for me at this point.
My firewall mini PC has four ports, but only two of them are active; LAN and WAN. I got that much working without much fuss and replaced my ISP’s provided router. There were two dumb switches between the firewall and the office, but once that was working, I replaced them with managed switches; when they’re not yet configured, they’re indistinguishable from dumb switches. I’ve been over my OPNsense configuration a dozen times in this thread by now, but let’s just say this new VLAN is set to be as permissible as I know how to make it, coming very close to my default LAN interface settings as far as rules go. They ought to be identical. The two smart switches are set up such that port 5 is “in” and 1 is “out”. Living room 5 connects to the firewall. Living room 1 connects to the office switch’s port 5. Office switch 1 connects to the end point mini PC. Living room ports 1-5 are untagged for VLAN 1; ports 1 and 5 are tagged for VLAN 10. Office ports 2-5 are untagged for VLAN 1; for VLAN 10, 1 is untagged and 5 is tagged, and port 1 has a PVID of 10.
I spelled all of that out in hopes that I did something stupid that I don’t know how to spot but maybe you do. Every device on VLAN 1 is working as it should with internet access. The one device on VLAN 10 only has access to the gateway and nothing else, despite the most permissive “allow everything” rule I could set up.