Hey All,
Having a bit of trouble with my network setup. I'm mostly a noob with very light understanding of what I'm working with, so bear with me.
I've got my opnsense box setup with mostly defaults set for rules. The opnsense box is hooked directly to an MB8611 modem on the WAN interface, with LAN interface running to an 8 port managed netgear switch on port 1 of the switch. I have port 2 of the switch hooked up to a vlan-aware access point. Other ports are occupied by physical links to some servers.
Everything on LAN works fine, including the access point. I have the access point setup with 3 SSIDs, all that can connect clients no problem. Some of the clients on the network are game consoles/gaming PCs that run into connectivity issues with some titles, I believe because of a strict NAT. Rather than just assigning outbound rules by static addresses, I opted to create a VLAN to house all gaming devices and segment them from the network. I don't need them to talk to each other or other devices.
I have created VLAN10, assigned it a gateway address of 192.168.10.0/24, setup DHCP and assigned the LAN as the parent interface. I created a new SSID on the access point and gave it the VLAN 10 tag. All of the ports on the switch are now assigned to default vlan1 with untagged traffic, and then ports 1 and 2 are assigned to vlan 10 with tagged traffic. Testing with an iPhone, this works totally fine. I get assigned the correct leases and can make outbound connections to the internet. Testing on a windows 11 gaming PC, previously connected to an untagged SSID and now switched over to the tagged SSID, I am unable to make outbound connections to the internet. Another android device that I connected with to the new SSID also worked fine, so I'm not sure what's up with this PC. I haven't tested other gaming devices yet.
Any ideas on what I'm doing wrong here?
It does appear that you have addressing working but not connectivity. As I said, I'm no expert on OPNSense but I did find this thread which has some thoughts: https://forum.opnsense.org/index.php?topic=29459.msg142330#msg142330
As well as:
This latter rule is... odd to me since there shouldn't really be NAT for IPv6 to a delegated prefix. But maybe that rule is meant to effectively disable the NAT and allow traffic to pass straight through without translation, obviously after applying your firewall rules.
Wow, that was a highly relevant thread! Feels like my search skills were lacking to not have come across that.
Seems like I'm only a couple of adjustments away from getting this working, so I'll give you some peace now. Thank you so much again for your time and advice!
Good luck! Also, when you do have everything working, back up your config. And also check to make sure your firewall is blocking inbound traffic as expected, for both v4 and v6.