Thanks for all your excellent videos @LTS_Tom! I’ve watched SO many, and yet I can’t quite crack this nut. Searched the boards here and on ixSystems too.
It occurred to me that I could use the extra ports in my FreeNAS box to physically separate the iSCSI service from the rest of the services, and my first pass was to just assign the next free address to the iSCSI service. FreeNAS runs on igb0 at 192.168.1.91, so I added the second port (igb1) on 192.168.1.92. Worked like a champ. Was able to reconnect the iSCSI Initiator no problem, BUT in practice I was seeing traffic on both interfaces in FreeNAS (Tx on igb0 nearly mirrored Rx on igb1). Should not have seen anything on igb0 in theory because I was not doing anything else… BUT apparently this is a big no-no as explained pretty thoroughly here on ixSystems:
So, I moved igb1 to 192.168.91.91 (just to make it easy to spot with the obvious 91s) and figured I would have pfSense route the traffic between. Multiple benefits here (maybe): 1) avoiding the problem Tom mentioned about having iSCSI and SMB traffic bring down the interface with a “no ping reply” timeout from the watchdog (it’s true - I’ve lived it). 2) isolating my FreeNAS box from the Internet. 3) Increasing performance by having a separate gigabit link?
Cannot get it to work. Referenced the “How To Setup VLANS With pfsense & UniFI. Also how to build for firewall rules for VLANS in pfsese [sic]” video as a guide, and added a VLAN 91 on pfSense LAN Interface (called it iSCSI) and then made firewall rules to route “any” from iSCSI net to LAN net and the reverse. I have Block private and Bogons turned off. Still can’t ping from x.x.1.x to x.x.91.x. Totally stuck.
Big question: Is this the best way to do this from a FreeNAS iSCSI standpoint, and if so, what might I be doing wrong?