This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Configuration with Bridge mode for trunk port with 3 VLANS

Hello Everyone.  I need help with configuration.  I tried doing this on a single port without VLANs, everything works including webfiltering.  However, I'm having trouble setting this up with a trunk port which has 3 VLANs.

Here is my setup:

  • Modem > [ESXI host: OPNsense router > Sophos UTM] > WIFI AP (unifi)

Here is my physical connections:

  • Modem WAN > ESXI port 1
  • ESXI port 2 > Management Computer (192.168.1.200)
  • ESXI port 3 > (test port)
  • ESXI port 4 > Wifi AP

Here is my virutal connections:

OPNsense router

  • OPNSense vWAN > ESXI port 1 
  • OPNSense vLAN > ESXI port 2 (192.168.1.1)
  • OPNSense vOPT1 > ESXI port 3 (10.0.0.1)
  • OPNSense vOPT2 > Sophos v-eth1 (TRUNKPORT no ip address)
    • VLAN10: 172.0.10.1,
    • VLAN 20: 172.0.20.1,
    • VLAN 30: 172.0.30.1)

Sophos UTM (before bridging)

  • SophosUTM v-eth0 > ESXI port 2 (192.168.1.100)
  • SophosUTM v-eth1 > OPNSense vOPT2
  • Sophos UTM v-eth2 > ESXI port 4

Hopefully this is understandable.  So, what I did was I bridged SophosUTM v-eth1 and Sophos v-eth2

Sophos UTM (after bridging)

  • SophosUTM v-eth0; static 192.168.1.100, 255.255.255.0, default gateway 192.168.1.1
  • SophosUTM v-br0 (v-eth1, v-eth2); 0.0.0.0, 0.0.0.0
    • VLAN10: static 172.0.10.100, 255.255.255.0, ProxyARP, allow proxy broadcast, allow stp
    • VLAN 20: static 172.0.20.100, 255.255.255.0, ProxyARP, allow proxy broadcast, allow stp
    • VLAN 30: static 172.0.30.100, 255.255.255.0, ProxyARP, allow proxy broadcast, allow stp
  • Firewall rules: any any any, deleted NAT rules, DHCP server is off, Nothing on DNS

With webfiltering off, everything works, however, when I turned my webfiltering for VLAN 30, I don't get any DNS resolution on devices on VLAN 30.  I'm still getting resolutions on VLAN 10 and 20 because webfiltering is off.  I I turned webfiltering on on those 2 VLANs, it will not work also.

Here is my questions: 

  1. should I tick IPV4 gateways on all the VLANS having multiple WAN links?
  2. Should I assign static IP address on the trunk port on OPNsense and Sophos UTM?

Please help with the proper configuration.  Thanks.

On side note, when I tried this on my test port with no VLANS, I was able to get everything to work.



This thread was automatically locked due to age.
Parents Reply Children