Hey, folks! I had begun configuring VLANs recently, and I’ve got two managed switches between my firewall and my mini PC. I set up a 10 VLAN on the third octet with a /24 mask, and the idea is that anything on 10 should be able to reach the internet but not VLAN 1, while VLAN 1 should be able to access the internet and VLAN 10 services. I’m not so crazy as to try to start with that configuration though. No ports or anything are exposed yet, so my first test was just going to be full access between networks. I maybe counted my initial configuration as a success too soon, because with the mini PC on the 10 network, I can reach the gateway at 192.168.10.1 but nothing else. I can even access the OPNsense config page at the 10 gateway address. If I ping 192.168.1.1, I get “Network is unreachable”. If I ping www.google.com, I get “Temporary failure in name resolution”, and I also can’t pull up sites like YouTube. And again, this is all with a VLAN rule that I believed to be configured to allow all traffic, as it mimics what’s set up for my default LAN interface. Pinging the mini PC from the 1 VLAN also fails; it just sort of times out with 100% packet loss, so perhaps the default rule is less permissive than I thought, but it does say it allows all.

I’ve been following beginner guides from the Home Network Guy (a name that makes this stuff sound more approachable than how he actually presents it), but even with a video that’s not even 3 years old, pieces of OPNsense have been deprecated and replaced with new components such that I can’t follow along verbatim. For instance, it was an ordeal to get DHCP working now that the one he used has been replaced with Dnsmasque DNS and DHCP, and I can’t even tell you what I changed that eventually got it working, but my first couple of tries did not. In one of those videos I’ve been following, he indicates that the default rule on the LAN interface will allow full access between all networks, but that doesn’t seem to be the case, as the same settings on the other VLAN aren’t allowing them to talk to one another.

Obviously, I don’t intend to leave full access between the networks when it’s time to go live, but this simple smoke test shows that there’s a gap in my understanding if I can’t get what should be the easiest test to work. Does anyone know what I’m missing or what I should do to troubleshoot from here?

  • Jenseitsjens@lemmy.worldEnglish
    1·
    5 hours ago

    DHCP usually provides three things:

    • IP Address (+ subnet mask)
    • Defaulft gateway IP
    • DNS servers

    In the DHCP lease you for example get the IP 192.168.10.42/24. That IP is assigned to your interface which creates a implizit route like 192.168.10.0/24 dev netinterface. Now you know how to reach other hosts in your local network.

    In the same DHCP lease, you should also receive a default gateway - likely 192.168.10.1. this would add a route like default via 192.168.10.1.

    Without the default route, packets for IPs other than your local network never leave your host because it doesn’t know where to send them to.

    DNS servers are also provided, though before troubleshooting that, I would just ping addresses like 8.8.8.8 (google dns) for testing connectivity.

    (Btw, what I’m trying to say is: DHCP is working, but your server configuration may not be correct for what you’re trying to do)

    You could also skip troubleshooting DHCP by running ip route add default via 192.168.10.1 to test if your firewall is configured correctly. That should enable you to ping other networks.