Hey, folks! I had begun configuring VLANs recently, and I’ve got two managed switches between my firewall and my mini PC. I set up a 10 VLAN on the third octet with a /24 mask, and the idea is that anything on 10 should be able to reach the internet but not VLAN 1, while VLAN 1 should be able to access the internet and VLAN 10 services. I’m not so crazy as to try to start with that configuration though. No ports or anything are exposed yet, so my first test was just going to be full access between networks. I maybe counted my initial configuration as a success too soon, because with the mini PC on the 10 network, I can reach the gateway at 192.168.10.1 but nothing else. I can even access the OPNsense config page at the 10 gateway address. If I ping 192.168.1.1, I get “Network is unreachable”. If I ping www.google.com, I get “Temporary failure in name resolution”, and I also can’t pull up sites like YouTube. And again, this is all with a VLAN rule that I believed to be configured to allow all traffic, as it mimics what’s set up for my default LAN interface. Pinging the mini PC from the 1 VLAN also fails; it just sort of times out with 100% packet loss, so perhaps the default rule is less permissive than I thought, but it does say it allows all.
I’ve been following beginner guides from the Home Network Guy (a name that makes this stuff sound more approachable than how he actually presents it), but even with a video that’s not even 3 years old, pieces of OPNsense have been deprecated and replaced with new components such that I can’t follow along verbatim. For instance, it was an ordeal to get DHCP working now that the one he used has been replaced with Dnsmasque DNS and DHCP, and I can’t even tell you what I changed that eventually got it working, but my first couple of tries did not. In one of those videos I’ve been following, he indicates that the default rule on the LAN interface will allow full access between all networks, but that doesn’t seem to be the case, as the same settings on the other VLAN aren’t allowing them to talk to one another.
Obviously, I don’t intend to leave full access between the networks when it’s time to go live, but this simple smoke test shows that there’s a gap in my understanding if I can’t get what should be the easiest test to work. Does anyone know what I’m missing or what I should do to troubleshoot from here?
Try allowing IPv4 and IPv6, something really basic appears to be broken, so it makes sense to allow more until it’s figured out
I think I’ve adjusted it to be as permissible as possible. There are some auto-generated rules that populate above it that, when expanded, look like maybe they would interfere? But I thought the manual rules should override anything in there. I can’t think of anything else.
If you haven’t allowed 4 and 6 then it’s not as permissive as possible
That’s what I’m saying though. I believe I tried a few configurations of both 4 and 6 now, in the time since you asked. At first it was only 4, because a tutorial said I didn’t need to bother. I added one for 6. I tried setting the source to “any” instead of just the VLAN network. I tried a handful of permutations of those things, disconnecting and reconnecting the wired connection to release/renew between each one. It doesn’t seem to have changed.