Configuring the Switch Ports¶
The default configuration of the Netgate 1100 has each port configured as a discrete interface (WAN, LAN, OPT), but under the hood the interfaces operate as a switch and the default configuration isolates them by using a separate VLAN for each port.
This optional guide changes the configuration such that the LAN and OPT Ethernet ports are on the same VLAN, effectively creating a small two-port LAN switch.
When connecting to the GUI, do NOT connect to any port being configured during this procedure or the device will lose connectivity to the GUI.
Open the pfSense® Plus software GUI and log in.
From the menu, navigate to Interfaces > Switches.
Go to the Ports tab.
Click on the Port VID for OPT. Change the default value from
4091. In the lower right-hand corner click Save.
At this point the Ports tab under Interfaces > Switches should look like the following:
Click on the VLANs tab.
Click on the button for VLAN group 3.
VLAN group 0 must remain in place and VLAN groups 1-3 must include 0t as a member, to function properly.
Click Delete for Member 1, then click Save.
Click on the button on VLAN group 2.
Click on the Add member button. Enter Member
1, uncheck tagged and then click Save.
Confirm the configuration matches the screenshots below:
Unlike software bridging, traffic between ports 1 and 2 will never leave the switch chip so it will perform at switching speed. The firewall cannot filter traffic between the two ports as pfSense® Plus software will never see it, as with any other (external) switch.
With both the LAN and OPT switch ports using the same VLAN on the switch
4091), the firewall will receive traffic from either port on its
mvneta0.4091 interface, which is assigned as LAN by default. The assigned
OPT interface in the firewall settings is redundant at this point and can be
removed, along with the definition for VLAN