Hey, folks! I had begun configuring VLANs recently, and I've got two managed switches between my firewall and my mini PC. I set up a 10 VLAN on the third octet with a /24 mask, and the idea is that anything on 10 should be able to reach the internet but not VLAN 1, while VLAN 1 should be able to access the internet and VLAN 10 services. I'm not so crazy as to try to start with that configuration though. No ports or anything are exposed yet, so my first test was just going to be full access between networks. I maybe counted my initial configuration as a success too soon, because with the mini PC on the 10 network, I can reach the gateway at 192.168.10.1 but nothing else. I can even access the OPNsense config page at the 10 gateway address. If I ping 192.168.1.1, I get "Network is unreachable". If I ping www.google.com, I get "Temporary failure in name resolution", and I also can't pull up sites like YouTube. And again, this is all with a VLAN rule that I believed to be configured to allow all traffic, as it mimics what's set up for my default LAN interface. Pinging the mini PC from the 1 VLAN also fails; it just sort of times out with 100% packet loss, so perhaps the default rule is less permissive than I thought, but it does say it allows all.
I've been following beginner guides from the Home Network Guy (a name that makes this stuff sound more approachable than how he actually presents it), but even with a video that's not even 3 years old, pieces of OPNsense have been deprecated and replaced with new components such that I can't follow along verbatim. For instance, it was an ordeal to get DHCP working now that the one he used has been replaced with Dnsmasque DNS and DHCP, and I can't even tell you what I changed that eventually got it working, but my first couple of tries did not. In one of those videos I've been following, he indicates that the default rule on the LAN interface will allow full access between all networks, but that doesn't seem to be the case, as the same settings on the other VLAN aren't allowing them to talk to one another.
Obviously, I don't intend to leave full access between the networks when it's time to go live, but this simple smoke test shows that there's a gap in my understanding if I can't get what should be the easiest test to work. Does anyone know what I'm missing or what I should do to troubleshoot from here?
I might not understand what you mean, but doing the best I can figure out, the output from the endpoint mini PC running ip route is:
192.168.10.0/24 dev enxc84d4422aa48 proto kernel scope link src 192.168.10.157 metric 100From the OPNsense firewall, the trace route looks like this (I would have expected to see the switches that it hops to in between, but I don't see them here):
I can't find any option to print routing tables in my switches, both of them Netgear GS305E switches. I don't see any mention of it in the manual either. I suspect that what you asked me to do was lost on me.
If that's the only route then your issue starts there. If you want to reach anything other than the local network there needs to be a default route to the gateway.
The default route is sent along the dhcp lease so my suspicion is that the issue is in the dhcp server config.
So what do you think might be the problem with it that I might check? As far as I know, if I've been assigned an IP address, DHCP is working.
DHCP usually provides three things:
In the DHCP lease you for example get the IP 192.168.10.42/24. That IP is assigned to your interface which creates a implizit route like
192.168.10.0/24 dev netinterface. Now you know how to reach other hosts in your local network.In the same DHCP lease, you should also receive a default gateway - likely 192.168.10.1. this would add a route like
default via 192.168.10.1.Without the default route, packets for IPs other than your local network never leave your host because it doesn't know where to send them to.
DNS servers are also provided, though before troubleshooting that, I would just ping addresses like 8.8.8.8 (google dns) for testing connectivity.
(Btw, what I'm trying to say is: DHCP is working, but your server configuration may not be correct for what you're trying to do)
You could also skip troubleshooting DHCP by running
ip route add default via 192.168.10.1to test if your firewall is configured correctly. That should enable you to ping other networks.Hey, that's forward progress! The first I've had since this thread! That command did in fact allow me to ping my desktop from my mini PC on the VLAN. It also allowed me to ping 8.8.8.8, which I was unable to do before. On reboot, that default gateway seems to be reset until I run the command again, which makes sense. So I guess my next question is: what does this mean, and how do I fix it? I take it to mean that of those three jobs DHCP is supposed to provide in your list, it's only done the first one. The DHCP systems in particular are a major change from what OPNsense was just two years ago when the guides I've been following were made.