Hey, folks! I had begun configuring VLANs recently, and I’ve got two managed switches between my firewall and my mini PC. I set up a 10 VLAN on the third octet with a /24 mask, and the idea is that anything on 10 should be able to reach the internet but not VLAN 1, while VLAN 1 should be able to access the internet and VLAN 10 services. I’m not so crazy as to try to start with that configuration though. No ports or anything are exposed yet, so my first test was just going to be full access between networks. I maybe counted my initial configuration as a success too soon, because with the mini PC on the 10 network, I can reach the gateway at 192.168.10.1 but nothing else. I can even access the OPNsense config page at the 10 gateway address. If I ping 192.168.1.1, I get “Network is unreachable”. If I ping www.google.com, I get “Temporary failure in name resolution”, and I also can’t pull up sites like YouTube. And again, this is all with a VLAN rule that I believed to be configured to allow all traffic, as it mimics what’s set up for my default LAN interface. Pinging the mini PC from the 1 VLAN also fails; it just sort of times out with 100% packet loss, so perhaps the default rule is less permissive than I thought, but it does say it allows all.
I’ve been following beginner guides from the Home Network Guy (a name that makes this stuff sound more approachable than how he actually presents it), but even with a video that’s not even 3 years old, pieces of OPNsense have been deprecated and replaced with new components such that I can’t follow along verbatim. For instance, it was an ordeal to get DHCP working now that the one he used has been replaced with Dnsmasque DNS and DHCP, and I can’t even tell you what I changed that eventually got it working, but my first couple of tries did not. In one of those videos I’ve been following, he indicates that the default rule on the LAN interface will allow full access between all networks, but that doesn’t seem to be the case, as the same settings on the other VLAN aren’t allowing them to talk to one another.
Obviously, I don’t intend to leave full access between the networks when it’s time to go live, but this simple smoke test shows that there’s a gap in my understanding if I can’t get what should be the easiest test to work. Does anyone know what I’m missing or what I should do to troubleshoot from here?
EDIT: Solved! At least my easy mode version of this is solved. Thanks to @[email protected] for help with diagnosing the issue as DHCP-related, and thanks to @[email protected] for writing up a guide more current than the YouTube tutorials I had been following. The problem was that I had DHCP options set that I probably shouldn’t have. Such is the problem of following multiple conflicting tutorials and trying to fill in the gaps.
Hey, just wanted to chime in and say thank you. I think your guide moves a little fast for someone like me, but through omission, I was able to suss out what was wrong, I think. I don’t know if it was a default setting or if it was something I picked up without understanding it while trying to fill in the gaps of DNSmasque DHCP, but I had two DHCP Options set; one was a Set option for router[3], and the other was a Set option for dns-server[6]. The fact that you didn’t have that in your guide at all led me to try a configuration without them, and now I’ve got full connectivity on my VLAN. I’ll of course now start properly blocking access off rather than leaving everything totally permissive before opening up services to the web.