InterVlan Not Working: PFSense


Not sure if this is the right place to post but. I got our PFSense up and running (7100 1U) with removing the UDM Pro and setting up a PC with the controller software and was able to get all the switches and AP’s informing correctly.

I setup the vlans on unifi as VLan only

On PFSense I setup the vlans on LAGG0

now here I setup the Switches VLan as all ports tagged:

I setup the firewall rule as follows:

I can’t seem to get to any resource on any network from my main LAN? Main Lan is setup the same way except my main lan is setup as:

trying to get to each resource from the main Lan to any resource on any network won’t work? Not sure what I am doing wrong?

Looks right, not sure why it’s not working. I do cover it step by step in this video starting at 6:41


Thanks for replying…Sorry didn’t respond sooner, but was trying to figure out if I did anything wrong but it does not appear to be the case.

Not sure where to go from here? I contacted Netgate on a separate issue a couple of weeks ago since I installed OpenVPN and the appliance would not boot up afterwards. And once they got it up they corrected the issue and every since then, Open VPN does not seem to work at all.

Not sure where to go other than maybe trying to see if I can do a tcpdump but for pfSense, I don’t know how to get to that? That might tell me what is happening to the packets?

I would double check the configurations of the switches, we help a lot of people that start out claiming to have a pfsense issue and it turns out to be a misconfigured switch.

Hello Sir! Much appreciated for your response. So I have checked our Aruba and that seems to be OK. We have the vlans setup and 1 port tagged for each vlan, essentially creating a “trunk” but HPE doesn’t seem to call it that. On the Unifi Switches the controller software seems to have everything setup right. Each VLAN is set as VLAN Only with the ID’s right.
The uplinks are set on the Unifi Switches to ALL VLANS (which I understand would be a trunk).

So, each VLAN can communicate with other devices in the VLAN. I can’t ping any device outside the vlans. Or get to any device such as a printer outside the vlan. When I move the device inside the vlan, I can communicate and see the devices. All VLANs have internet access.

The only blocking is done on pfSense which is to the Firewall port as I included on the pictures above. I did have RFC1918 blocking when I originally setup the rules, but found out I had that wrong as it blocked all internet access too. I removed them and internet access came back.

Came back later and setup OpenVPN, and tried rebooting. PFSense did not come back up. Called Netgate and they said because I was looking for a password on the OpenVPN it was not booting properly. they removed that and it booted up.

I didn’t do much since then until recently, (this past weekend) as we were still running cables. We removed the UDM Pro controller and added the pfSense (7100) onto the network and began setting up the devices and putting each device into the proper VLAN. OpenVPN says a daemon issue, not connected…but wasn’t really concerned about that but each device could communicate within each VLAN. But I couldn’t communicate (intervlan) with any device in another vlan. Still OpenVPN is not working.

Maybe I made some mistake there somewhere along the line.

I could reset everything, but we have static IP’s set and I am not sure if I can backup and restore those or not? I thought with your videos you can restore separate items? Such as the VLANS and the devices with Static IP’s.

Everything in the configuration of pfsense can be backed up and restored, including static IP’s

1 Like

Why not use a SFP+ cable to your switch on one of the SFP ports use a dac or sfp & fibre lc cable. Then use that. Then build each vlan on that interface…

yeah. Before I removed the UDM Pro, I had a DAC cable running to the switches, but now that I removed that and replaced it with the pfSense, I am not sure how to get those 2 SFP ports working through the LAGG.0 on the 7100? I read that those (ix0 and ix1) are not part of the LAGG. so to connect them to act as a trunk port I don’t really know how to do that?

I see they are independent so not really sure how to use them at this point. My experience with assigning them is really limited.

I would use ix1 as your main nic, then assign the vlans to that. Use the Dac cable from that ix1 port to your main port on the switch too.

OK. Let me take a look at that…maybe do some testing with a couple test vlans. Hopefully I can figure out how to assign them to that interface.

maybe that will get it up and running as far as interVlans.

thanks! I’ll write back to show my results.

1 Like

OK… Test results

Pfsense: Added ix0 to two vlans: testvlan1 and testvlan2

Unifi 24 port switch(USW24) : Added same vlans as vlan only. Set sfp+ port for both vlans only. Connected 1 pc to port 23 for testvlan1 and port 22 for testvlan2.

Used a DAC to con ect pfsense to USW24 and pfsense.

10gig connection came up.

No data could pass between the two vlans. Internet connection good.

What do your ACLs look like? Did you try to create an allow any any to see if it would pass traffic?


On pfsense I did do the Any any rule for each vlan. Just like the screenshots above.

Just to confirm, those settings are on all your vlan interfaces, right?

Yes sir. For each interface created I enter rules.

I may just reset the system. I know Mr. Lawrence said above that my setting can be restored. I have been reading to get a better understanding of the backups. So if resetting does not work, then I can restore to at least where I am now.

Strange… I have double checked the switch settings. Went into the CLI for the unifi switch and I don’t see anything. I am basically at a loss.