Help needed with my setup: SDN - OPNsense - VLANs

[rudydevolder]

Hello, I'm trying to get VLAN's working on my TopTon N305 with 4 LAN ports.
I would like to use 1 LAN port as a trunk port for all my VLAN's.
OPNsense runs inside the same ProxMox server.
CAN SOMEONE TELL ME WHAT IS WRONG WITH MY CONFIG?
My virtual machine with ID 101 seems to work on VLAN 55 and gets an address within my VLAN-range.
But when I try to connect an external PC via a managed VLAN switch on VLAN 55 and I don't get any connection.
Something is bothering me though;
Q1. why I can't enable VLAN aware directly on my interface enp2s0 ?
Q2. Is this needed to make it work?
Q3. I am confused between the VLAN tagging on 2 or maybe 3 different levels;

1. VNETs
2. At the assignment of an interface, you can also put a VLAN tag.

I don't understand, for me these 2 levels of VLAN tagging seem to conflict each other. Or maybe at the level of VNET it's acting as a membership filter and at the level of interface assignment it's acting by inserting the tag on an untagged port?
If VLAN tagging is also needed on the enp2s0 interface it makes 3 levels of VLAN tagging.
Can someone clarify how these assignments interact?


This my setup:

Port	ProxMox	P-OPNsense	NET	VLAN	OPNSense MAC	OPNsense-Gateway
ETH-0	Vmbr4	Net5	VOIPnet	11	BC:24:11:A3:5D:12	10.11.11.11/24
ETH-0	Vmbr4	Net4	MGMnet	22	BC:24:11:AF:A0:ED	10.22.22.22/28
ETH-0	Vmbr4	Net7	IOTnet	44	BC:24:11:7B:5A:B4	10.44.44.44/24
ETH-0	Vmbr4	Net3	GUESTnet	55	BC:24:11:F1:29:63	10.55.55.55/24
ETH-0	Vmbr4	Net6	CCTVnet	66	BC:24:11:89:E2:44	10.66.66.66/24
ETH-1	Vmbr2	Net1	WAN	BC:24:11:77:95:FE
ETH-2	Vmbr0	Net0	LAN	BC:24:11:2F:04:71
ETH-3	Vmbr3	Net2-guest	GUEST_native	BC:24:11:82:C5:2E

 

[waffleiron]

I think this will answer you. If you are familiar with the term "trunk" in networking that is equivalent to "vlan aware" in proxmox.
So, if you mark something as a trunk AND assign it a vlan...I don't really know what the expected outcome is because those two actions are basically opposites of one another.

The picture below should give you a working version of what you are trying to do using two of your interfaces as an example.
Only the vnet should have a vlan tag.
Only the bridge should be vlan aware.