Comment on Help configuring OPNsense VLANs? Tutorials I find seem to quickly become outdated.
ampersandrew@lemmy.world 1 day ago Thanks!
ampersandrew@lemmy.world 1 day ago Comment on Help configuring OPNsense VLANs? Tutorials I find seem to quickly become outdated.
ampersandrew@lemmy.world 1 day ago Thanks!
MuttMutt@lemmy.world 1 day ago
Ok, so first of all a TON of things have changed in OPNsense in the last couple updates so you may just want to pull everything you did. It looks like you are using the old firewall rules which while they are going to stick around they are trying to migrate people away from them.
You should be using KEA DHCP as that is the modern and latest and greatest DHCP server that is vLAN aware. Also UnboundDNS is a recursive DNS server and designed for modern networks, with the advantage of being able to use DNS Blocklists to block ads and other “junk.” Just remember that the blocklists live in RAM so if you don’t have much RAM available I wouldn’t recommend using them.
NOTE: If you are using Dnsmasq DNS&DHCP you will have to turn it off before you can enable KEA DHCP and UnboundDNS as it will tie up the ports needed and they will fail to start. You can copy everything over before making the change and if there is an issue you can switch back just by stopping the new ones and enabling the old one.
With that said one of the biggest things is that with a managed switch you will need to trunk the port that OPNsense is plugged in to for the LAN unless you are using multiple ports on your OpnSense install and then those ports will need to be properly tagged and you will need to trunk any ports that are linking switches together you will have to figure that out on your own but I suggest grabbing a copy of your switch’s manual (and if you use a chatbot upload that file to it for help.) Then you can use vLAN tagging for each port that you want to receive an IP address from a particular pool automatically. You can also trunk ports that you want to use for management but set the default the port will use for access so the device can get an ip via DHCP, this really only works well with Linux. If you are using windows you will need to just create firewall rules that allow your device to talk to the other vLAN’s instead.
When you create your firewall rules you have to understand that you can only preform one action per rule. If you want to allow your vLAN 1 network to talk to vLAN 10 that is one rule. To allow vLAN 10 to talk to the internet that is another rule. You can use floating rules to do the work on multiple vLAN’s but that should be limited. If you select more than one network interface a rule will becoming a floating rule and will process before other rules so if you create a rule to block something later on but have the same interface set on a floating rule the block will not work, it’s better to enable piece by piece than to blanket enable and then try to block. With 5 vLAN’s I have 5 floating rules and 34 regular rules plus 40 automatically generated rules (which handle things like allowing DHCP access and basic protections.)
Here is a firewall rule that allows my “Trusted” vLAN to access my “Camera” vLAN as an example. The Categories are not important but make finding what a rule deals with later on a lot easier, they are set under the firewalls - categories. You should also use good descriptions for this reason.
Image
You will also have to explicitly allow access to services like DNS. This is how I am allowing my “Trusted” vLAN to access DNS services on my OPNsense.
Image
This is how I allow my trusted network to access the internet. If you have multiple WAN’s you can choose a specific one or if you have failover configured you would likely select the “group” you created when you setup the failover.
Image
If you need more help let me know. If you have been tinkering with a bunch of stuff you may want to start over, just backup your current configuration and reset everything to defaults. If you can’t figure it out you can reset to defaults and restore your configuration.
Thanks! I appreciate step by step guides with explanations, but as we’ve both covered, the guides I followed have now fallen way out of date. Has OPNsense always moved this fast with ripping out components and paradigms and replacing them with others? Do you have an up to date video guide that you could refer me to so that I get more "how"s and "why"s along with each setting to help understand it better?
Unlike some other settings in OPNsense, there’s nothing like “Legacy” or “Deprecated” to indicate that Dnsmasque is being phased out, and when I see “new Rules”, I suspect that it’s so hot off the presses that it may not be fully working yet. Their replacements are both ready for prime time? Blocking ads by DNS wasn’t a goal I had in mind for this project of mine, but I can’t say I haven’t been tempted to increase scope to cover it.
My switches are both GS305E Netgear switches, and the word “trunk” doesn’t show up anywhere in the manual. What I do have are VLAN 10 ports tagged when they face the firewall or another managed switch; and untagged when they face the end device; as per Home Network Guy. That was what got me far enough along that I was able to ping the gateway. Before that, my pings went completely unanswered.
Unfortunately, most of my networking experiments end up sectioned off to the weekend, because I try to minimize any damage I might do to my home network during the work week (I work from home) and disruption for my wife trying to enjoy the internet herself. All that to say that I might be back here again asking for help, but it will be on a hell of a lag. You definitely gave me some homework to do, too.
MuttMutt@lemmy.world 1 day ago
No. I didn’t use any video’s to set mine up and wouldn’t even know where to find one that is up to date.
Dnsmasq isn’t being deprecated that I know of but when you begin doing more advanced functions some tools work better than others. The “New” rules are fully functional and I suspect the old ones will slowly be removed in later releases. They are revamping some stuff, ISC DHCP used to be the go to but that is being passed out by the creators. www.isc.org/kea/ and OPNsense is cleaning up things so it all works with the rest api and is higher performance.
Trunking is when a port can deal with all setup vLAN’s not sure about your switches as they are pretty basic looking. I’m using a pair of Dell PowerConnect 5548’s and a Quanta LB6M which are much more complex. But basically think of a vLAN as a branch of a tree and the Trunk is the base that connects to everything.
I don’t see myself needing more advanced functions, and at this point I’d be happy to get the basic ones working, haha.
I understand the concept of a trunk port, but I don’t know how to translate that into some other terminology that my manual uses instead, or if there’s some other paradigm. To the best of my knowledge, it’s the difference between a tagged port and an untagged port, which I think I have configured correctly. I must be at least in the ballpark if I can hit the gateway and nothing else.