Hello Everyone. I need help with configuration. I tried doing this on a single port without VLANs, everything works including webfiltering. However, I'm having trouble setting this up with a trunk port which has 3 VLANs.
Here is my setup:
- Modem > [ESXI host: OPNsense router > Sophos UTM] > WIFI AP (unifi)
Here is my physical connections:
- Modem WAN > ESXI port 1
- ESXI port 2 > Management Computer (192.168.1.200)
- ESXI port 3 > (test port)
- ESXI port 4 > Wifi AP
Here is my virutal connections:
- OPNSense vWAN > ESXI port 1
- OPNSense vLAN > ESXI port 2 (192.168.1.1)
- OPNSense vOPT1 > ESXI port 3 (10.0.0.1)
- OPNSense vOPT2 > Sophos v-eth1 (TRUNKPORT no ip address)
- VLAN10: 18.104.22.168,
- VLAN 20: 22.214.171.124,
- VLAN 30: 126.96.36.199)
Sophos UTM (before bridging)
- SophosUTM v-eth0 > ESXI port 2 (192.168.1.100)
- SophosUTM v-eth1 > OPNSense vOPT2
- Sophos UTM v-eth2 > ESXI port 4
Hopefully this is understandable. So, what I did was I bridged SophosUTM v-eth1 and Sophos v-eth2
Sophos UTM (after bridging)
- SophosUTM v-eth0; static 192.168.1.100, 255.255.255.0, default gateway 192.168.1.1
- SophosUTM v-br0 (v-eth1, v-eth2); 0.0.0.0, 0.0.0.0
- VLAN10: static 188.8.131.52, 255.255.255.0, ProxyARP, allow proxy broadcast, allow stp
- VLAN 20: static 184.108.40.206, 255.255.255.0, ProxyARP, allow proxy broadcast, allow stp
- VLAN 30: static 220.127.116.11, 255.255.255.0, ProxyARP, allow proxy broadcast, allow stp
- Firewall rules: any any any, deleted NAT rules, DHCP server is off, Nothing on DNS
With webfiltering off, everything works, however, when I turned my webfiltering for VLAN 30, I don't get any DNS resolution on devices on VLAN 30. I'm still getting resolutions on VLAN 10 and 20 because webfiltering is off. I I turned webfiltering on on those 2 VLANs, it will not work also.
Here is my questions:
- should I tick IPV4 gateways on all the VLANS having multiple WAN links?
- Should I assign static IP address on the trunk port on OPNsense and Sophos UTM?
Please help with the proper configuration. Thanks.
On side note, when I tried this on my test port with no VLANS, I was able to get everything to work.