Pfsense VLAN Config only LAN can access internet

Hello, i just follow this video tutorial but im having a problem,
i cant connect to Internet i can only Connect if im connected on VLAN 1
if change port VLAN ID on the Switch eg. VLAN 100 it gives me vlan 100 ip but cant connect to internet.
im using
pfsense 2.4.4-RELEASE
Edgse Switch24port POE

My goal is to separate
LAN = Devices eg. switch, uap-lr, servers.
Vlan100 = offices PC access only internet and servers that it is on LAN network.
Vlan 200 = CCTV
Vlan 300 = Admin PC eg. my laptop that can manage all devices
Vlan 400 = Guest access only internet

Pfsense Config -

Edge Switch Config -

pfsense lan to switch port 22

Suggestion and comments are really appreciated
Thanks

First, why are you use a public IP on the LAN site, 210.10.0.1 and second your rule only allows TCP.

Check your outbound NAT too you may have to add a rule in to allow the other addresses to work.

Im only testing the 210.10.0.1 Public IP,
Sir can you help me on how to work on this

My goal is to separate
LAN = Devices eg. switch, uap-lr, servers.
Vlan 100 = offices PC access only internet and servers that it is on LAN network.
Vlan 200 = CCTV and internet
Vlan 300 = Admin PC eg. my laptop that can manage all devices
Vlan 400 = Guest access only internet

Hi, I’m using Cisco terminology, but this should apply to other switches.

There Are two main operation modes for switch ports. Trunk and Access.
What it really means is this: Trunk uses VLAN tags and Access doesn’t.

When you connect PFSense without VLANs, it should connect to an port in Access mode. Access mode by default it’s associated to VLAN 1 (in Cisco), but you can associate to any VLAN. (all the ports on the same VLAN can access each other) But only one VLAN at one time.

When you associate an Interface to a Vlan on PFSense, it starts using VLAN Tags to identify each frame.
On the switch you should use trunk mode and allow the VLANS you need on that interface. Trunk mode allows to use many VLANs on the same port at the same time. That’s why it needs to be tagged, to differentiate each frame and know which VLAN it belongs.

Check if your Switch supports trunk mode (the name can change depending on you switch brand)

I’m not Cisco expert but.
VLAN 1 on Cisco does not use TAGs, so you cannot connect VLAN 1 on PFSense to a Switchport on trunk Mode with VLAN 1. VLAN 1 is just a name but it’s not tagged as VLAN 1

Assigning interfaces on PFSense directly (native) and via VLANs at the same time is possible but it’s complicated on the switch side.

I think you should not use the native interface (directly) and only use only VLANs. So you need to create an additional VLAN, let’s say 500 and assign your LAN interface to it. For example:

igb1.500 = LAN Devices eg. switch, uap-lr, servers.
igb2.100 = offices PC access only internet and servers that it is on LAN network.
igb2.200 = CCTV
igb2.300 = Admin PC eg. my laptop that can manage all devices
igb2.400 = Guest access only internet

(if you’re using igb2 directly at the same time, that’s probably the problem)

Because you’re using igb2 for everything I’m assuming you’re using igb1 for LAN and igb0 for WAN (or vise versa)

1 Like

I second @LTS_Tom 's suggestion about the IP address. There are million+ addresses of private IP space( 10.x.x.x, 192.168.x.x, and more ) and you chose to use an internet-routed address. Try using 192.168.210.x for the internal net.

Also, I noticed that ports 0/2 and 0/3 have multiple untagged vlans (you’ve left vlan 1 untagged on those ports). Although it shouldn’t cause a problem, it’s a bad idea to have multiple untagged vlans on the same port. It might allow broadcasts on your vlan 1 net to reach clients on vlan 100 (port 2) and vlan 400 (port 3). I recommend removing untagged vlan 1 on those ports. On my switch config, I have one untagged vlan per port and the PVID is set to the untagged vlan.

DId you double-check that you can communicate between clients and the pfsense box (besides getting a dhcp lease)? After that, check that you can create connections between the networks routed through the pfsense box. Those are worthwhile tests.
Fair warning - my vlan experience is limited to Netgear switches.

1 Like

thanks for all suggestions , this is my new set up all vlan can now access internet
Guest VLAN - already ok blocking all network only internet access
Internal VLAN - can access internet but i cant access LAN network i can access switch on
LAN network but server or computer connected on LAN network cannot access .
Admin VLAN - can access Guest VLAN,Internal VLAN,CCTV VLAN, but cant access
server or computer from LAN Network can access Switch on LAN
network.

Guest VLAN Rules


Admin VLAN Rules

Internal VLAN Rules

LAN Rules

EDGE Switch Config

IP Address
VLAN 1 LAN = 10.10.0.1/24
VLAN 100 Internal = 172.16.32.1/24
VLAN 200 CCTV = 172.16.2.0/24
VLAN 300 Admin = 172.16.5.0/24
VLAN 400 Guest = 192.168.1.0/24

Thanks i really appreciated your suggestion and comments.

@LTS_Tom sir any suggestion?

The best way to figure this out is to get your hands dirty with some debugging.

Under logging settings, turn on logging of packets caught by the default deny rule, and enable logging on other deny rules. Create traffic. Look for denied packets in the logs.

If that doesn’t help, then use ‘Packet capture’ under the diagnostics menu. Create traffic and observe packets inbound from the client at the firewall. Assuming that works, set up packet capture on the destination interface and look for packets leaving the firewall (and hopefully returning from the target server).