August 30, 20187 yr I'm having the same issue as @DZMM and followed the recommendations from this thread. However, I'm still having an issue where unraid cannot reach a docker in a vlan. I've taken screenshots of my settings below. Would someone mind taking a look? Capture - unraid network settings Capture2 - docker settings 3 - unifi switch uplink port config 4 - unifi switch unraid port config 5 - switch port config, "all" = native LAN and tagged vlans 6 - vlan20 firewall rules 7 - routing table The docker in question is in VLAN20. Unraid is in LAN. As you can see in "capture6", the block rule "VL20_VPN: default reject ipv4" rule prohibits unraid from communicating with this vlan (because the allow rules are only for VL20_VPN Net). This is by design. However, this reject rule generates logs on the firewall and I'm not seeing any alerts. I've tried pinging/traceroute too.
August 30, 20187 yr I use the same nguvu guides as you so I can actually follow your pfsense rules! Have you got 192.168.1.0/24 included in your LOCAL_SUBNETS alias?
August 31, 20187 yr Author 5 hours ago, DZMM said: I use the same nguvu guides as you so I can actually follow your pfsense rules! Have you got 192.168.1.0/24 included in your LOCAL_SUBNETS alias? Those guides are great! Yes, I do. The rules can be confusing if you're not familiar with the guides, but ultimately I'm looking for the second rule from the bottom to kick in and it does not. Unraid is 192.168.1.2 on the LAN net. Docker XYZ is 192.168.20.3 in VL20_VPN. The rules don't allow traffic from LAN to communicate with VL20_VPN, hence why I'm looking for the "VL20_VPN: Default reject ipv4" alert in firewall logs.
August 31, 20187 yr Not using pfsense - so I might be spouting gibberish here. it might not be triggering because you are trying to ping from unRAID (192.168.1.2) which is the source to the VLAN20 (192.168.20.3). AFAIK, pfsense is a stateful firewall, so the rule that would matter would be on the LAN tab (or floating). Have you tried the other way?
August 31, 20187 yr Author When you say "have you tried the other way" do you mean pinging unraid from the docker? If so, yes I tried that as well but no response. Also, here is a screenshot of my lan rules.
August 31, 20187 yr Author Dockers in bridge mode can ping the router 192.168.1.1 Docker in VLAN cannot ping router. Does this have something to do with DNS, similar to this post? I posted in this yesterday (before starting this thread), but haven't heard a response.
August 31, 20187 yr Can the dockers in the VLAN ping the router on its VLAN IP? 192.168.20.1 - this is very important because if this is not working, then the VLAN is not properly setup. DNS is not yet involved, but is probably affected by the same issue.
August 31, 20187 yr 7 hours ago, surfshack66 said: Those guides are great! Yes, I do. The rules can be confusing if you're not familiar with the guides, but ultimately I'm looking for the second rule from the bottom to kick in and it does not. I'm confused - I thought you wanted unraid to speak to the VLAN and it wasn't? If it is, then pfsense is working 'correctly' because you've got 192.168.1.0/24 included in your LOCAL_SUBNETS so rule #2 kicks in first (rules work from the top) and allows the traffic from LAN to VLAN20. If you want to block it, you need to remove 192.168.1.0/24 from LOCAL_SUBNETS Or, modify the rule e.g. for my guest VLAN I've changed my 3rd rule from 'VL44_GUEST_NO_VPN net' to a new alias 'Guest_Devices_With_LAN_Access' so that only certain devices can be seen by/see other VLANs. If what you meant was you can't ping and want to, but you were expecting the IPV4 rule to kick in and it isn't, the only difference I can see between your setup and mine (apart from the switch which I couldn't understand the grabs) is that I've assigned DHCP pools for my VLANs in settings/docker e.g. 192.168.XX.0/25 and then for my DHCP ranges in pfsense I've got 192.168.XX.100 - 192.168.XX.199. Other than that our rules look the same unless you've got something in floating that's having an impact. Edited August 31, 20187 yr by DZMM
August 31, 20187 yr Author 10 hours ago, ken-ji said: Can the dockers in the VLAN ping the router on its VLAN IP? 192.168.20.1 - this is very important because if this is not working, then the VLAN is not properly setup. DNS is not yet involved, but is probably affected by the same issue. Just to make sure I'm testing properly. 1. Select docker console 2. Ping 192.168.20.1 This test does not yield a response
August 31, 20187 yr Author 4 hours ago, DZMM said: I'm confused - I thought you wanted unraid to speak to the VLAN and it wasn't? If it is, then pfsense is working 'correctly' because you've got 192.168.1.0/24 included in your LOCAL_SUBNETS so rule #2 kicks in first (rules work from the top) and allows the traffic from LAN to VLAN20. If you want to block it, you need to remove 192.168.1.0/24 from LOCAL_SUBNETS Or, modify the rule e.g. for my guest VLAN I've changed my 3rd rule from 'VL44_GUEST_NO_VPN net' to a new alias 'Guest_Devices_With_LAN_Access' so that only certain devices can be seen by/see other VLANs. If what you meant was you can't ping and want to, but you were expecting the IPV4 rule to kick in and it isn't, the only difference I can see between your setup and mine (apart from the switch which I couldn't understand the grabs) is that I've assigned DHCP pools for my VLANs in settings/docker e.g. 192.168.XX.0/25 and then for my DHCP ranges in pfsense I've got 192.168.XX.100 - 192.168.XX.199. Other than that our rules look the same unless you've got something in floating that's having an impact. Sorry for the confusion. Hopefully this will make things clear. Desired behavior - Docker (192.168.20.3) in VL20_VPN to succesfully ping unraid (192.168.1.2) in LAN Actual behavior - Docker cannot ping unraid To make things simple for the sake of solving this issue, I have created a rule on VL20_VPN (at the top of the rule set) to allow ANY protocol from ANY source/port to ANY destination/port. This rule should eliminate any issue with pfsense configuration, so all that is left is either unraid config or the switch config.
August 31, 20187 yr 1 hour ago, surfshack66 said: Just to make sure I'm testing properly. 1. Select docker console 2. Ping 192.168.20.1 This test does not yield a response this is really bad as it simply means the docker on a VLAN cannot reach the router. nothing can work / will pass unless this is fixed. this means you need to double check how your VLAN is defined on the router, on the switches (ubiquitis) and unRAID. pfsense does have this ip 192.168.20.1 on the VLAN20 interface right? Edited August 31, 20187 yr by ken-ji
August 31, 20187 yr Author 3 minutes ago, ken-ji said: this is really bad as it simply means the docker on a VLAN cannot reach the router. nothing can work / will pass unless this is fixed. this means you need to double check how your VLAN is defined on the router, on the switches (ubiquitis) and unRAID. pfsense does have this ip 192.168.20.1 on the VLAN20 interface right? Yes, this is not good. I posted all the screenshots of all my config. Anything else I can take a screenshot of? EDIT: added screenshot of VL20_VPN interface on pfsense Edited August 31, 20187 yr by surfshack66
August 31, 20187 yr Unfortunately I dont know what else to look at - only thing that comes to mind is what is the VLAN ID of VL20_VPN? and the definition of the physical interface of the pfsense router? other than that I'm stumped.
August 31, 20187 yr Author 1 minute ago, ken-ji said: Unfortunately I dont know what else to look at - only thing that comes to mind is what is the VLAN ID of VL20_VPN? and the definition of the physical interface of the pfsense router? other than that I'm stumped. VLAN ID of VL20_VPN = 20 physical interface is em2, which is an open port of the 4 port nic assigned to pfsense So is it safe to say unraid config is fine? Might be able to solve this by process of elimination...
August 31, 20187 yr what docker are you trying to ping from? I can't ping from some of my dockers e.g. makemkv - have you tried other VL20 dockers? Other than the small differences between our pfsense setup I listed, your switch is the only difference we have so maybe that's the problem area.
September 2, 20187 yr Author The nguvu guide, and pfsense experts, recommend using an unassigned parent interface. The parent interface refers to the physical interface where the vlans will reside. So that is what I did. I have a 4 port nic, so em0 is wan, em1 is lan, and em2 is unassigned but used as the parent interface for the vlans. That being said, I changed vl20 parent interface from unassigned em2 to an already assigned em1, i.e the LAN. I'm now able to communicate with the docker from unraid and vice versa. I'll probably take this to the pfsense forum for more support, so I'll mark this solved from unraids perspective. However, I'd still like to follow the recommendation of not using an assigned parent interface. @DZMM what parent interface did you use?
September 2, 20187 yr 4 minutes ago, surfshack66 said: The nguvu guide, and pfsense experts, recommend using an unassigned parent interface. The parent interface refers to the physical interface where the vlans will reside. So that is what I did. I have a 4 port nic, so em0 is wan, em1 is lan, and em2 is unassigned but used as the parent interface for the vlans. That being said, I changed vl20 parent interface from unassigned em2 to an already assigned em1, i.e the LAN. I'm now able to communicate with the docker from unraid and vice versa. I'll probably take this to the pfsense forum for more support, so I'll mark this solved from unraids perspective. However, I'd still like to follow the recommendation of not using an assigned parent interface. @DZMM what parent interface did you use? I've only got a dual nic so my VLANs are on the same port as my LAN, so maybe that's how you got it working. I think the advice to use an unassigned interface is because some cards cause problems if you don't - it's not a set in stone rule.
September 2, 20187 yr Author 1 hour ago, DZMM said: I've only got a dual nic so my VLANs are on the same port as my LAN, so maybe that's how you got it working. I think the advice to use an unassigned interface is because some cards cause problems if you don't - it's not a set in stone rule. It has to do with vlan hopping, which is a potential security threat. Out of curiosity, do you have unraid in your LAN or one of the vlans?
September 2, 20187 yr I've got unRAID in my LAN. I've just read up quickly on vlan hopping and it's not a concern for me - my vlans are to control how devices get out to the internet e.g. on a prioirty VLAN or via a VPN - not because I've got say credit card transactions going over one network!
September 3, 20187 yr Hmm.. VLAN Hopping was never a concern on my end too. Personally, I think it only matters if you have an untrusted/compromised machine hardwired on the network. But its a relatively easy mitigation. Just make sure untrusted ports are access only - they only carry one VLAN as untagged. Nothing else. Another switch like the OP ubiquiti could be used to limit what ports have what VLANs and you only provide LAN and VLANS (trunked) service to either trusted machines or downlinks to other managed switches (again the ubiquit)
Archived
This topic is now archived and is closed to further replies.