[SOLVED] Pfsense in Proxmox and VLANs

[lumox]

Hi,
For the time being, I've installed pfSense in Proxmox as a VM. Here is the diagram:


On NIC1 is my WAN connected to my ISP router in, say, DMZ

Here is my Proxmox network setup:


In pfSense the two virtual switch are seen this way:





Basically the LAN above with IP 192.168.5.1 manages both Vms in Proxmox and any devices connected to the esternal physical swith on the NIC2.

Everything works greats BUT, for learning purpose, I'd like now to rearrange my network and create VLANs: VLAN10, VLAN20, and VLAN30.

VLAN10 for VMs in Proxmox, my desktop and my private WIFI. VLAN20 for my IoT, and VLAN30 for guest wifi and maybe for one ethernet port on the physical swith. I'm going to use a DD-WRT device to accomplish that. I think that I don't need to change any setup on my WAN port since I also want to access Proxmox from WAN port

Before going on I'd like to figure a few things out and make up my mind on the Proxmox side first.

1) Should I enable 'Vlan aware' in Proxmox for the virtual switch vmbr1:




2) Do I need to set up VLAN tag for any VM here too (the windows VM in thie case below?



Please your thought and advice on my project.

Thanks

 

[Dunuin]

There are two ways.

Option 1: Do it like you explained it. Enabling "vlan aware" and setting the "VLAN Tag" for you VMs virtual NICs.
Option 2: Create a dedicated VLAN Interface and dedicated bridge for each VLAN on your PVE host.

And you might want to use tagged VLANs (aka trunk) if you want to use different VLANs on that switch that is only connected using a single NIC to your PVE host.

 

[lumox]

There are two ways.

Option 1: Do it like you explained it. Enabling "vlan aware" and setting the "VLAN Tag" for you VMs virtual NICs.
Option 2: Create a dedicated VLAN Interface and dedicated bridge for each VLAN on your PVE host.

I dont' think I have understood option 2..anyway
I'll most likely go for option 1, but I need to make sure that I got it right.
So, when I enable "VLAN aware" on the virtual bridge (vmbr1) it would be as if I had set up a trunk port for my VLANS? Correct?

And you might want to use tagged VLANs (aka trunk) if you want to use different VLANs on that switch that is only connected using a single NIC to your PVE host.

Are you talking about the PHYSICAL switch (a DD-WRT device for the record) that I'm going to attach at the physical NIC (enp5s1)?

Thank you

 

[Dunuin]

I dont' think I have understood option 2..anyway
I'll most likely go for option 1, but I need to make sure that I got it right.
So, when I enable "VLAN aware" on the virtual bridge (vmbr1) it would be as if I had set up a trunk port for my VLANS? Correct?

Yes, enabling it basically allows it to carry tagged vlans like a trunk. Without it can only use untagged traffic.

Are you talking about the PHYSICAL switch (a DD-WRT device for the record) that I'm going to attach at the physical NIC (enp5s1)?

Yes. According to your diagram you want to use that physical switch with multiple VLANs for IoT, Guests, LAN and so on so you need a managed switch that can handle tagged vlans and you need to configure both to use it.

 

[Astraea]

I use pfSense and run in on a VM in my ProxmoxVE cluster, I have 3 bridges set up on each of my Proxmox nodes and none of them are set to be VLAN aware.

vmbr0 is set as my virtual machine traffic where all of my LAN-based VLANs will travel.
vmbr1 is for communicating with other Proxmox nodes
vmbr2 is for communication to the Storage network and all my storage servers.

Then for my pfSense, VM I have the following network devices configured:

net0 = WAN connection and is tagged as VLAN 100
net1 = Base LAN connection and is untagged
net2 = My virtual server VLAN and is tagged as VLAN 200

If I add a VLAN to my network I create another interface on the VM, tag the network device as needed and then add it into pfSense as if it was a physical NIC connected to a separate physical network. The reason I did it this way is that all the traffic other than the base LAN (which is for switches and wireless APs) is so that the pfSense VM can run on any host, it is also why my WAN is on a VLAN that only pfSense makes use of and is set as untagged on the switch the modem connects to with access to no tagged VLANs.

 

[lumox]

I use pfSense and run in on a VM in my ProxmoxVE cluster, I have 3 bridges set up on each of my Proxmox nodes and none of them are set to be VLAN aware.

vmbr0 is set as my virtual machine traffic where all of my LAN-based VLANs will travel.
vmbr1 is for communicating with other Proxmox nodes
vmbr2 is for communication to the Storage network and all my storage servers.

Then for my pfSense, VM I have the following network devices configured:

net0 = WAN connection and is tagged as VLAN 100
net1 = Base LAN connection and is untagged
net2 = My virtual server VLAN and is tagged as VLAN 200

ok
According to my goal, as for pfSense only, do I need to delete LAN interface and add only VLAN interfaces? Please see image four. Thanks

 

[Astraea]

If you are using a single NIC virtual or otherwise to pass tagged and untagged traffic you will need to have a base interface in pfSense. as they are all technically going over a single connection between pfSense and the switch. You would then add the VLANs to pfSense as well as the switch your node is connected to allow the tags to work. I used to set it up with a single LAN and then add the VLANs to pfSense and used OVS in Proxmox but it's been a while since I did it that way.

 

[lumox]

If you are using a single NIC virtual or otherwise to pass tagged and untagged traffic you will need to have a base interface in pfSense. as they are all technically going over a single connection between pfSense and the switch. You would then add the VLANs to pfSense as well as the switch your node is connected to allow the tags to work. I used to set it up with a single LAN and then add the VLANs to pfSense and used OVS in Proxmox but it's been a while since I did it that way.

Ok I think I got it right ...for the most part at least.
In order to make it as simple as possible, I decided to create two VLANs only

I set up VLANs in pfSense first:




then I tagged a VM's network device (My Windows VM in Proxmox in this case):



For VLAN10, I set 192.168.10.0/24 as its network in pfsense and also set a dhcp server. Ok. it works perfectly. The windows VM got its IP! Great.
I can acces internet from my Windows VM which is now on VLAN10.

I got a little problem though.
From my Windows VM I can ping a PC on my real physical network, but I can ping it from my PC.
However, I can ping the VLAN gateway 192.168.10.1 either from my external PC and from my physical external router via its terminal as well.

There must be a problem with the firewall, but I wasn't able to figure it even though I already had set a WAN rule in pfsense:




Could anyone help me with this issue please?
Thanks

 

[lumox]

This is strange. I restarted all my devices this morning, I tried it again, and it turned out that I can now open a Remote Desktop session from my external PC to my Windows VM in Proxmox in VLAN10, but I still can't ping it!

 

[lumox]

UPDATE

I FIXED IT FINALLY.

It was the Windows' Firewall.

 

[left4pve]

Sorry to bring this up again. I'm looking to do the same thing and I've now created the VLAN10 so that other VMs on the same PVE can join the VLAN using a tag(basically option 1 in this thread).

However, other machines connected to the LAN unmanaged switch(which is connected to the LAN port of PVE host) or even directly connected to the PVE host NIC aren't able to join VLAN10 even with manual IP and VLAN tag.

Did you managed to run VLAN on your switch?