I have built a bunch of systems. This is not seen before.
Netgate 6100
UniFi Pro Max 24 PoE
Unifi Pro 16 PoE
Cable modem to WAN
LAN out to switches
Some VLANs
Some UniFi Lite 6 APs.
Three WiFi networks. One on Default network and two on VLAN Networks.
No restricting firewall rules for now.
All was fine until I accidently tagged the uplink to the modem with a VLAN. Took awhile to find and corrected it. After that, I could again connect to the WiFi networks but couldn’t stream any data. Tried factory resetting everything and returning the router to a known good config. (Including making a simple setup by connecting the LAN to the 16 PoE switch and a single AP.) Same result.
Speed test shows “You are connected to the internet” but the test either works once and not again or not at all on WiFi on default network and WiFi networkd on VLAns.
PCs connnected to the network connect with no issues at all incl when connecting to a VLAN by tagging the PC’s port.
I unchecked “Allow DNS server list to be overridden by DHCP/PPP” and everything worked on WiFi again But I’m thinking that’s unrelated.
I’m probably going to book a service call bc I don’t like problems that fix themselves. (Esp bc this is in FL and I’m usually in Canada.) If any LTS people think they have some thoughts, I’m happy to book a call.
Obviously all other intel appreciated.
PS ChatGPT siad to specifically tag the AP ports with the VLANs. I’ve never had to do that before. Just leave the NATIVE VLAN / Network on Default and Allow ALL on VLAN Management. Always worked fine but ChatGPT says it’s a new thing. Anyone else heard that?
I would start by drawing out everything, at least just to have a block diagram. Which device is connected to what and on what port?
If your wired devices are able to use the VLANs, and you only experience issues on Wifi devices, I would check the ports one by one.
Is the port tagged with all necessary VLANs?
Is the port set to the correct native VLAN?
Are you using any settings on your Unifi controller or the specific port? (Allow all, or restrict to one VLAN)
One example: You have an AP connected to the switch port. The native VLAN is VLAN1 (where the Unifi devices are communicate with each other), VLAN 2 is IOT, VLAN3 is guest.
The port has to be tagged with VLAN2, VLAN3.
BTW, what is your Unifi controller? Is it a self-hosted one?
To make things simple, I factory reset the 16 port switch and an AP and connected the LAN out to that switch. No tagging on any ports but I’ve always had wifi setups with VLANs work fine with the native port ID set to default and VLAN tagging set to all. This is on many installations. In any case, the same thing happened with a WiFi network on the default network and one on a VLAN network. I did try tagging the port with the wifi VLANs but same thing. Tried a bunch of things that I’ve lost track of. It worked after I unchecked the DNS setting via the ISP in the general settings. But that may have been coincidental.
That’s a puzzler, especially since your wired VLAN traffic is fine and you’ve used similar setups before. The fact that DNS override fixed it (even temporarily) makes me wonder if WiFi clients were getting a DNS that wasn’t responding properly, maybe something cached after the VLAN tagging mishap. It could also be worth checking if mDNS or client isolation settings are doing something unexpected in the UniFi controller. Seems like the kind of thing where everything “should” work, but one small misstep lingers after a config change.
Redoing the DNS setup seemed to help. Here’s what ChatGPT has to say about Pfsense DNS:
Here’s a clear and reliable DNS setup recommendation for pfSense, optimized for security, reliability, and central control:
⸻
Recommended DNS Setup in pfSense (General + Enforced Use)
Enable and Configure Unbound (DNS Resolver)
• Go to Services > DNS Resolver
• Enable the DNS Resolver
• Check:
• Enable DNS Resolver
• Listen Port: 53
• Network Interfaces: LAN (or All if unsure)
• Outgoing Network Interfaces: WAN(s)
• DNS Query Forwarding: Unchecked (unless you want to forward to external DNS only)
Set Up System DNS Servers (Optional, for fallback)
• Go to System > General Setup
• Under DNS Servers, add reliable external servers like:
• 1.1.1.1 (Cloudflare)
• 8.8.8.8 (Google)
• Leave “Allow DNS server list to be overridden by DHCP/PPP on WAN” unchecked to prevent your ISP from overwriting these.
Prevent DNS Leaks (Force LAN Clients to Use pfSense for DNS)
Go to Firewall > Rules > LAN and do the following:
a. Pass Rule (to pfSense only)
• Action: Pass
• Interface: LAN
• Protocol: TCP/UDP
• Source: LAN net
• Destination: This Firewall (LAN address)
• Port: 53
• Description: Allow DNS to pfSense
b. Block Rule (to any other DNS servers)
• Action: Block
• Protocol: TCP/UDP
• Source: LAN net
• Destination: any
• Port: 53
• Description: Block DNS bypass
Move the pass rule above the block rule. This ensures clients can only use pfSense for DNS and cannot bypass it using external DNS (e.g. Google or Cloudflare directly).
⸻
Optional Add-ons
• DNS over TLS or DNSSEC in Unbound for additional privacy (optional but advanced)
• Host Overrides if you want local DNS names for specific IPs (e.g. NAS or printer)
Recommended DNS Setup in pfSense (General + Enforced Use)
DNS Query Forwarding: Unchecked (unless you want to forward to external DNS only)
Optional Add-ons
Make sure the pass rule is above the block rule.