Setting up VLANs

Question

Good Morning, Afternoon, Evening, or Night 
 Is there a tutorial, which explains how to properly configure VLANs? 
 I wanted to seperate a Network in different VLANs, some where outbound traffic is allowed, others where it isn't. 
 My switches are 802.1Q capable and the VLANs are set up there. Internal traffic works where expected and is blocked between devices where it should be blocked. So internally it works. 
 But I'm not sure how I should configure the UTM. 
 I added Ethernet VLAN interfaces where I chose the internal NIC eth0 (not the external WAN (eth1)). They are shown in the dashboard with state DOWN and link UP. 
 Under Interfaces & Routing | Interfaces all VLANs are marked as down and do not have an IP. 
 Under Network Services | DHCP I can't choose the VLAN interfaces, only internal. How can I assign IPs to them? 
 I'd like to have a bunch of several VLANs with different firewall rules for each concerning the outbound traffic. Any help is highly appreciated. :) Thanks in advance!

apijnappels · Accepted Answer

You can do so from the interfaces config: Interfaces & Routing -> Interfaces -> Edit interface and then deselect dynamic IP. This will allow you to set an IP-address and once that is set create DHCP servers for every VLAN. 
 Make sure to make different subnets on each VLAN ie: 
 VLAN 10: 172.16.10.1 / 255.255.255.0 VLAN 20: 172.16.20.1 / 255.255.255.0 and don't use VLAN 1 since it is reserved in the UTM for wireless.

#ID · Answer

Perfect! Thank you very very much for your guidance! No it's working as expected! :D 
 A little Guide for everyone with the same problem: How the setup VLANs or The brief VLAN Tutorial : 
 #1: Interfaces & Routing | Interfaces: 
 
 New Interface for each VLAN you want to use
 
 with your desired name; 
 Type: Ethernet VLAN; 
 IPv4 address: add manually an IP-address that is not within the range of any other network 
 IPv4 Netmask: /24 standard

do not turn it on yet 
 
 #2: Network Services | DHCP 
 
 New DHCP Server...
 
 Make one for each VLAN 
 adjust the range if needed

Can already be started 
 
 #3: Network Protection | NAT 
 
 Specify here which kind of traffic is allowed at all, eventhough the specific firewall rules are needed, here you can enable inter VLAN traffic, e.g.
 
 VLAN_20 -> External (WAN) 
 VLAN_20 -> VLAN_90

#4: Network Protection | Firewall 
 
 Create firewall rules, e.g.
 
 VLAN_20 - DNS -> Any 
 VLAN_20 - Web Surfing -> any (except you're using webfiltering, see post below) 
 Internal - Network Printing -> VLAN_90

Create a rule for each service a specific VLAN should be allowed to use online or 
 inter VLAN, i.e. a service provided by a server in another VLAN - communication between VLANs has to be allowed as needed 
 
 I would say this is the minimal configuration for working VLANs. From here on many things can be done as Setting up different Web Filter Profiles, specific IPS settings, DNS-Servers for the VLANs and so on the further increase your security or complexity of your network.