Not getting DHCP leases from VLAN

Alrighty. YAVPP: Yet another vlan problem person… I’ve followed “How To Setup VLANS With pfsense & UniFI. Also how to build for firewall rules for VLANS in pfsese” pretty much click-for-click (as close as version and setup differences allow for, anyway) and I can’t get a DHCP lease on any of my tagged ports.

My setup:

  • Config that I’ve had for some time and is known as good:

    • LAN interface is bridge0
    • bridge0 contains em0 and em1
      • em0 connects to a UniFi US-48
      • em1 connects to a UniFi AP-AC-Lite
    • US-48 connects by SFP+ to UniFi US-16-XG
  • New VLAN config where I’m not getting DHCP leases:

    • Created “storage” VLAN11 - parent interface is bridge0 [LAN]
    • added “storage”
    • enabled “storage”
    • Set static ip of on “storage”
    • assigned “storage” “vlan11 on bridge0 (storage)”
    • created an “any/any” all protocol IPV4+6 firewall rule for “storage”
    • Enabled DHCP on interface “storage” with range of to 254
    • In the “Networks” section of the UniFi management interface, I created “StorageVLAN” with vlan tag 11
    • on the US-16-XG I set the switch profile on SFP+ port 2 to “StorageVLAN”
    • On the computer connected to SFP+ port 2, I disabled and re-enabled the NIC.
  • Troubleshooting steps includes various combos of the following:

    • I’ve disabled all firewall rules that I created that weren’t some kind of “any/any” rule.
    • Destroyed my VLAN11 setup and re-created it
    • Set my VLAN parent as em0
    • In UniFi management, created and used a new “Switch Ports” profile making my VLAN the “Native Network” for port SFP+ 2
    • Added my vlan as a member of bridge0
    • Fully updated pfsense, destroyed and re-created vlan11 as vlan50.
    • Verified the the switch port connected to pfsense is set to ‘all’ and the SFP+ port between switches are also set to ‘all’

I have not tested bridging ports and then adding VLANS, might be some special config in there you are missing.

You’re the thrid person to independently add to what I’ve been suspecting for a while now: the software/os level that handles the bridge doesn’t support vlans. My plan is to make em0 my LAN and see if things go better for me.

Not sure what I’ll do with em1 though. DMZ, I guess.

Alrighty. Finally got around to switching my LAN interface from bridge0 to em0 and now my VLANs are magically working. It was pointed out to me that the FreeBSD bridging docs DO indicate that VLANs on bridges are supported, I guess whatever (not so) secret (open-source) sauce pfsense is using doesn’t account for this scenario.

did you end up getting VLANs working across both em0 and em1?

No, I never did get it working right. I threw in the towel and picked up a USG Pro since the rest of my network stack was already in the UniFi ecosystem and I wanted to spend my my tech efforts in other areas.