I have a Netgear switch which has some VLANs configured:

VLAN 1 in ports 1,2,3,4,5,6,7,8 Untagged
VLAN 2 in ports 1,2,3 Untagged + 8 tagged  (8 is the router)
VLAN 3 in ports 4,5,6,7 Untagged + 8 tagged  (8 is the router)
PVID: 2 (1,2,3), 3 (4,5,6,7), 1 (8)

I also have an opnsense router with the VLAN interfaces VLAN2 and VLAN3. From a computer A in VLAN2 I can reach the router VLAN3 interface (ping, Web access, etc), so the switch is not blocking this inter-VLAN traffic. From the router, I can reach computer B in VLAN3 (ping), so the computer B is correctly configured in the VLAN3 network. However, when I try to ping from computer A at VLAN2 to computer B at VLAN3, the ping doesn't reach the destination. Therefore, it looks like opnsense is blocking such traffic, but I am unable to find how, since both VLAN2 and VLAN3 have a rule to "pass" IPv4 traffic (IPv4 * * * * * * *). (VLAN2, computer A) --> (VLAN2, router) --> (VLAN3, same router) --> (VLAN3, computer B)

My questions are:

  1. How can I allow access from computer A to computer B?
  2. Why is the switch not blocking level-2 traffic from one VLAN to another? Is it because of the tagged router port I set?
  • Normally you only have one untagged vlan per port. I'm familiar with cisco's terminology, so that's what I will use. You can reference these terms and translate them to netgear lingo. Normally the untagged VLAN is vlan-1 (the native vlan). The router should have a trunk port going to it with virtual interfaces for each vlan set up and in use, (all VLANs but the native tagged). End devices usually get an untagged vlan port. You can also feed your wan connections to the router through the switch this way, it's called routing on a stick. Mar 14, 2021 at 2:40
  • Also note: you can set the native vlan to something other than vlan-1, but when using trunk ports, both sides of the trunk need to have the same untagged vlan on both sides. Mar 14, 2021 at 2:42
  • I tried to delete VLAN1 but it's not possible ("VLAN 1 is enabled for IGMP Snooping and cannot be deleted") I can, however, remove the untagged there and change PVID to "2" for port 8 (the router), is that more correct?. Btw, I followed this kb.netgear.com/30919/… Mar 14, 2021 at 3:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.