VLAN Issue When Bridging LAN Interfaces for Additional Ports

[abrown203]

Greetings Untangle Forum,

I could use some help getting a VLAN to work when multiple physical local network interfaces are bridged together.

Background:
I am a Home user of Untangle and network hobbyist. The backbone of my system is a Protectli Vault 6 port appliance to run Untangle, two Unifi APs for Wifi, and a few Netgear Plus managed switches. The first physical interface of the appliance is the WAN. The second physical interface is the LAN addressed to the 192.168.2.1/24 network with DHCP enabled. The “Config Type” of three physical interfaces (OPT1, OPT2, OPT3) are set to “Bridged” to the “LAN” interface to get additional physical ports. To be clear, when you read the wiki for Network Configuration, I am doing the bridging for “Additional Port”, and not “Standard Bridge Mode”. I use the remaining OPT4 as my Lab sandbox, with the physical interface addressed to the 192.168.200.1/24 network with DHCP enabled (not bridged to LAN).

I also have three 802.1q tagged VLAN addressed interfaces setup in Untangle: Guest (ID = 100), IoT (ID = 20), and Cameras (ID = 30). They all have the parent interface set to LAN. Their addresses are 192.168.xxxx.1/24, where xxx is the VLAN ID.

Within my Unifi Controller I have three Wifi networks: Default (VLAN ID = 1), Guest (VLAN ID = 100), and IoT. (VLAN ID = 20). The VLANs are working as expected through the Unifi APs; clients logging into the different Wifi networks get assigned the different networks defined in Untangle.

I recently purchased two PoE IP cameras. I started by uplinking them to my Untangle Lab interface (OPT4, not bridged) via a Netgear Plus PoE managed switch. This switched is configured to assign VLAN 30 to the two ports the cameras are connected to. When connected to my Lab interface, they get assigned a 192.168.30.xxx IP address as expected. This gives me confidence that the switch VLAN is configured properly.

Problem:
When I simply move the uplink of the Netgear Plus PoE managed switch from my Lab interface (OPT4, not bridged) to any of the other four bridged interfaces (LAN, OPT1, OPT2, OPT3), the Cameras VLAN (ID = 30) no longer works.

Side Note: It is odd to me that the clients with VLANs sourced from Unifi and connected to a bridged interface work fine, but clients sourced from the Netgear switch connected to a bridged interface do not.

A Bit More Information:
I have a different Protectli Vault 4 port appliance running the latest OPNSense. I defaulted it, setup WAN and LAN, created and setup VLAN 30, then walked through the OPNSense LAN Bridge Setup steps to bridge LAN and OPT1. Plugging the same Netgear Plus PoE managed switch into either bridged (LAN or OPT1) or un-bridged (OPT2) interfaces results in the client getting assigned the 192.168.30.xxx IP address as expected. This gives me further confidence that the switch is configured properly for VLAN 30, and it is something with Untangle.

FYI… the last steps of the OPNSense LAN Bridge Setup steps talk about needing to change some tunable parameters (net.link.bridge.pfil_member, net.link.bridge.pfil_bridge). I wonder if this is a clue to what may be the issue in Untangle.

[TirsoJRP]

From the network config wiki:

What "bridged" really means.
In untangle when two interfaces are bridged it means that they are in the same zone or that they both connect to the same network space. As the cardinal rules explain, Untangle routes all traffic according to its routing table - even those crossing between two bridged interfaces. This is sometimes called brouting or a brouter - unlike how a traditional layer-2 bridge/switch behaves.

Do not expect the same behavior from opnsense, pfsense, openwrt, etc. Untangle bridges are not meant to be simple L2 bridges.

Example:

AFAIK If you have VLANs defined in the LAN interface, the same does not apply to interfaces bridged to LAN.

[sky-knight]

This is correct, Untangle doesn't bridge, it broutes and it has to do with the way the virtual pipline works.

Untangle is not like anything else on the market in this regard. And it is also correct that as a result all VLANs have to be terminated on each port individually. This is also the reason why I HIGHLY RECOMMEND no one EVER USE bridged interfaces in production. There are cases where it's appropriate, but with the ease and inexpensive access to layer 2 managed switching there's simply no reason to go through all that work just to find things that don't work everywhere you turn.

TLDR, do not use Untangle as a managed switch, you will regret it. Also, whatever you think you know about other products doesn't apply, use the Untangle documentation.

[abrown203]

Thank you @TirsoJRP and @sky-knight very much for your replies. This issue has given me tremendous frustration over the past month, and am happy to have some understanding.

I also think this explains the inconsistent VLAN behavior I observed; with VLANs working for clients connected to Unifi APs but not working for clients connected to the Netgear managed switch. The Unifi APs are connected to the LAN interface (parent interface for bridge and VLANs) via a simple switch, whereas I was connecting the Netgear PoE managed switch for the Cameras to OPT1 (a interface bridged to LAN).

I am managing some lingering frustration with Untangle on this issue. I have re-read the network config wiki from beginning to end. I do not think of my network deployment as particularly advanced or complex. I am surprised that using these two seemingly straightforward features together (bridging two LAN interfaces, wanting to use VLANs on these interfaces) would result in conflict with Untangle's 3rd cardinal rule. However I acknowledge that what makes Untangle so attractive to me is how simple they make things, and there are inevitable limits and collisions associated with this simplicity.

Best wishes to all.

[sky-knight]

What you're running into is a combination of how Linux bridges and the way Untangle's pipeline works.

I vastly prefer the way BSD bridges, which is where the OPNSense and PFSense stuff really starts to melt your mind a bit...

But in Untangle all sorts of strange things happen because Linux doesn't really bridge, but it sort of feels like it does. Then you start Untangling and... boom.

So I'm constantly telling people, ROUTER THAT MESS! Because if Untangle is routing, everything is straight forward. Start bridging and stuff gets weird... quick.

Never VLAN over an Untangle bridge... not if you like your hair!

[TirsoJRP]

Unrelated... Just wondering if Untangle will use DSA and related hardware, could be interesting.