Layer 3 Switch w/ PFSense

phil9878

Member
Apr 2, 2021
30
4
8
I wonder if pfsense is pushing the return traffic back through the trunk port since there are no route statements. Can you disconnect the trunk port and add route statements and ping out from a client? I don't care if DHCP is broken.

Never mind. You can't add route statements with DHCP defined with those networks.
It is routing from the switch so it is returning right.
Yes, static routes cannot be added if the interface is defined any way, because pfSense knows about the interface

I doubt downstream traffic is going through the Transit route. I am not sure how to check it in pfsense, maybe an allow rule...
However, I am not seeing any issues in logs about specific TCP:S and TCP:FA blocks related to my use
 

coxhaus

Member
Jul 7, 2020
63
23
8
I have been thinking about this diagram and I think it will not work with your pfsense L3 structure. If you use only new networks on the SG350X L3 switch I think you can make it work Pfsense knows all the networks by DHCP and it would try to use your L2 connection as you can't point to the second L3 switch with a routing statement since the network is already defined on pfsense. Think about it that is the way multiple routers would work.
 
  • Like
Reactions: phil9878

phil9878

Member
Apr 2, 2021
30
4
8
I have been thinking about this diagram and I think it will not work with your pfsense L3 structure. If you use only new networks on the SG350X L3 switch I think you can make it work Pfsense knows all the networks by DHCP and it would try to use your L2 connection as you can't point to the second L3 switch with a routing statement since the network is already defined on pfsense. Think about it that is the way multiple routers would work.
I dropped that idea of the L2 switch in between pfSense and the L3, so I did not test it. Also, pfSense cannot do DHCP in any case with that diagram because it doesn't have the downstream VLAN interfaces. It has static routes.

With my last diagram configured however, everything works properly. pfSense doesn't care about the asymmetric path for downstream traffic coming from the wan! Other firewalls won't allow it I guess!

Still looking how to multicast between vlans. It seems complicated despite the switches should support it in docs
 

coxhaus

Member
Jul 7, 2020
63
23
8
Why do you think you need multicast? It is a 1 to many relationship. Unless you are going to put all your TVs on the same channel it probably won't help you.
 

phil9878

Member
Apr 2, 2021
30
4
8
The DLNA Media server is now running in a jail inside the Data Server, on the same VLAN as the TVs. The DLNA server and the Data server are on different physical interfaces and on different VLANs. TVs are fine with that as they get the DLNA brodcasting on the same subnet

However, I wanted to receive the DLNA stream on another VLAN. I can live without it. But, since the Cisco SG350 series support it, I want to make it work, also for learning purposes.

I am still progressively setting up the network, segment by segment. I just managed today to isolate the Media Server Jail in a dedicated VLAN different from the Host Server. Needed some work in TrueNAS...

Once I am completely done, I will post the config of the different devices. The nice part is that it is very simple to change the layout to a single transit, no interfaces in pfSense and only static routes, no DHCP in pfSense if someone has another firewall that wont accept the asymmetric part in the proposed config.

Meanwhile, if someone has an idea how to properly setup the switch for the DLNA across VLANs, please drop a comment :)

Best regards
 

phil9878

Member
Apr 2, 2021
30
4
8
I don't know as it has been many years since I setup a multicast and I think back then it was all in 1 VLAN. Here is something that might relate across VLANs. From what I remember it was a manual process for each port to assign multicast or not.

Configure Access Port Multicast TV Virtual Local Area Network (VLAN) Membership on a Switch - Cisco
I read that article
But it was not clear for me during testing:
- how to add the Media Server from a Trunk to the Multicast Group (Multi Cast group members are only Access ports on the receiver side)
- what IP is the Multi Cast Group

I will try it later once I finished configuring the network. I have to try the 239.255.255.250 IP: