2

I finally managed to setup my pfSense connected over WAN interface to a ISP router, which in turn is DMZing to pfSense. I added VLANs for different tasks following this tutorial, where DHCP on each VLAN is enabled, DNS is being forwarded. Exactly like the tutorial said.

This is my setup in line:

Internet --- ISP Router --- pfSense --- HP2920 switch --- Desktop/Laptop

Then I added the same VLANs (same ID and name) to the HP 2920 switch. For example, VLAN with ID 10 with untagged ports 5-24 for computers. Then there is a default VLAN_DEFAULT with ID 1 on the switch with untagged ports 1-4,25-48. The pfSense box is connected to port 48.

See my config here:

ISP router

IP 192.168.1.1
Subnet 255.255.255.0
DMZ forward to pfsense LAN IP 192.168.1.254

pfSense

WAN 192.168.1.254/24
LAN 192.168.2.1/24
VLAN ID 10 - 192.168.10.1/24 Servers
VLAN ID 20 -  192.168.20.1/24 Computers
VLAN ID 30 -  192.168.30.1/24 VOIP
VLAN ID 40 -  192.168.40.1/24 Cameras
VLAN ID 50 -  192.168.50.1/24 WirelessStaff
VLAN ID 60 -  192.168.60.1/24 WirelessGuests

This is what show ip route gives me:

                            IP Route Entries

Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
------------------ --------------- ---- --------- ---------- ---------- -----
0.0.0.0/0          192.168.2.1     1    static               250        1
127.0.0.0/8        reject               static               0          0
127.0.0.1/32       lo0                  connected            1          0
192.168.2.0/24     DEFAULT_VLAN    1    connected            1          0

When I connect my laptop to port 1 for example, the default VLAN, I have Internet and can ping all VLANs. When I connect my laptop to port 5 however, I get an "unidentified network" with "no Internet" on my laptop.

Can anybody tell me what I am missing? I am glad for ANY tip.

EDIT

This is my configuration report from the switch right now. (i changed port 5 to port 25 for computers vlan, cause i used the other ports for other things)

; J9728A Configuration Editor; Created on release #WB.16.04.0008
; Ver #...

hostname "somehost"
module 1 type j9728a
ip default-gateway 192.168.2.1
ip route 0.0.0.0 0.0.0.0 192.168.2.1
interface 48
name "pfsense"
exit
snmp-server community "public" unrestricted
snmp-server contact "tech@some-email.com"
oobm
ip address dhcp-bootp
exit
vlan 1
name "DEFAULT_VLAN"
no untagged 25
untagged 1-24,26-48
ip address 192.168.2.3 255.255.255.0
exit
vlan 10
name "Servers"
no ip address
exit
vlan 20
name "Computers"
untagged 25
ip address 192.168.20.1 255.255.255.0
exit
vlan 30
name "VOIP"
no ip address
exit
vlan 40
name "Cameras"
no ip address
exit
vlan 50
name "WirelessStaff"
no ip address
exit
vlan 60
name "WirelessGuests"
no ip address
exit
spanning-tree

and the result of show ip route:

Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
------------------ --------------- ---- --------- ---------- ---------- -----
0.0.0.0/0          192.168.2.1     1    static               1          1
127.0.0.0/8        reject               static               0          0
127.0.0.1/32       lo0                  connected            1          0
192.168.2.0/24     DEFAULT_VLAN    1    connected            1          0
192.168.20.0/24    Computers       20   connected            1          0

while the last line is only shown if my laptop is plugged into port 25...

  • I don't see any trunk config on your switch. Could that be the reason? – maxim Sep 6 '17 at 14:18
  • @maxim Trunking would only be necessary if the switch were connected to another device by a single link that needed to handle multiple VLANs. – Twisty Impersonator Sep 6 '17 at 16:19
1

You're missing a router.

Nodes connected to the various VLANs are necessarily in separate IP subnets. For example, a host connected to switch port 5 finds itself in VLAN 20, which is supposed to be subnetwork 192.168.20.0/24. That VLAN needs a router (let's say at 192.168.20.1) that knows how to route traffic to your pfSense's LAN interface at IP 192.168.2.1.

According to HP's feature list for your 2920 switch, it can be configured to act as a router. A sample partial, untested configuration might look like this:

ip route 0.0.0.0 0.0.0.0 192.168.2.1
ip routing
vlan 1
  ip address 192.168.2.3 255.255.255.0
  untagged 48
  exit
vlan 20
  ip address 192.168.20.1 255.255.255.0
  untagged 5
 exit

This:

  1. Enables routing with ip routing
  2. Sets the default route ("how to get to the Internet") to the pfSense's LAN IP 192.168.2.1 with ip route 0.0.0.0 0.0.0.0 192.168.2.1
  3. Assigns the switch an IP in each VLAN. This is how the switch knows where the various IP subnetworks are located. For all VLANs except the one containing the pfSense box, this becomes the respective VLAN's default route (a.k.a. the router).
  4. Puts port 48 (pfSense) in VLAN 1, and port 5 into VLAN 20

As a final step, hosts in each VLAN should be configured with the switch's IP address as their default gateway. e.g. in VLAN 20, nodes should point to 192.168.20.1 as their default gateway.

  • FInally some reaction :) However when i try to enter the command (that i stumbled across in another forum) i get "Invalid input: ip"... The current firmware on the switch is WB.16.04.0008. Do you know why this error occurs? – Yolo Aug 30 '17 at 18:42
  • What command is returning this error? Regardless of the error, now seems like a good time to make sure you're on the latest firmware. – Twisty Impersonator Aug 30 '17 at 18:45
  • ip route 0.0.0.0 0.0.0.0 192.168.2.1 is the command i entered. The WB.16.04.0008 is the latest :( – Yolo Aug 30 '17 at 18:51
  • i added the output of show ip route to my question – Yolo Aug 30 '17 at 19:17
  • Is the config of your switch as posted in your question complete? If not, please post the complete configuration. You can remove/change any private information (hostname, password hashes, etc.) but everything else needs to be shown. – Twisty Impersonator Aug 30 '17 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.