📟 Retro Mode

VLANs: OPNsense & Cisco Managed Switch

Dividing a flat local network into Virtual Local Area Networks (VLANs) is one of the single best ways to secure a home lab or multi-building property. By segregating traffic such as separating trusted workstations, smart home IoT devices, guest Wi-Fi, and server infrastructure you contain potential security risks and drastically reduce broadcast noise.

This guide covers configuring VLANs using a Router-on-a-Stick architecture with virtualized OPNsense on Proxmox connected via an LACP Link Aggregation Group (LAG) to a Cisco SG350 series managed switch.

1. Core Concepts: How VLANs Work

Think of a physical network switch as an office building with a single massive hallway. By default, everyone in every room can shout back and forth across that hallway (a flat network).

  • VLAN Tagging (802.1Q): Imagine putting colored wristbands (tags, numbered 1 through 4094) on people as they leave a room. When a packet travels across a trunk link between your router and your switch, it wears a 4-byte 802.1Q header tag so network gear instantly knows which virtual room it belongs to.
  • Access Ports (Untagged): Ordinary end-devices (like a desktop computer, a smart TV, or an IP camera) don’t understand VLAN tags. An access port strips the tag off outgoing packets and adds a default tag to incoming untagged packets from the device.
  • Trunk Ports (Tagged): A trunk link carries multiple VLANs simultaneously between networking devices (e.g., from your Proxmox hypervisor/OPNsense virtual machine to your core Cisco switch).

2. Phase 1: OPNsense & Proxmox Hypervisor Configuration

In a virtualized environment, your physical network interface card (NIC) is managed by the hypervisor. To pass multiple VLANs from OPNsense to your physical switch, you configure virtual switches on Proxmox and assign parent interfaces.

Step 1: Proxmox Network Setup

  1. Ensure your physical interfaces are bound to Linux Bridges (e.g., vmbr0 for LAN/Trunk).
  2. If utilizing LACP (IEEE 802.3ad) for high availability or link bonding between Proxmox and your Cisco switch, configure a Linux Bond (bond0) using mode balance-slb or LACP (802.3ad) with hash-policy layer2+3, and bridge it to vmbr0.

Step 2: Assigning the Parent Interface in OPNsense

  1. Log into your OPNsense Web UI.
  2. Navigate to Interfaces > Other Types > VLAN.
  3. Click Add (+) to create a new VLAN:
    • Parent interface: Choose your physical LAN interface (e.g., vtnet1 or the interface mapped to your trunk bridge).
    • VLAN Tag: Enter your specific VLAN ID (e.g., 20 for IoT, 30 for Servers, 99 for Management).
    • VLAN Priority: Leave default (0) unless implementing custom QoS.
    • Description: Give it a clear identifier (e.g., VLAN20_IoT).
  4. Click Save and then Apply Changes.

Step 3: Assigning and Enabling the Interface

  1. Go to Interfaces > Assignments.
  2. At the bottom of the interface list, select your newly created VLAN from the dropdown (e.g., vlan0.20) and click Add.
  3. Click on the newly added interface (typically named OPTx).
  4. Check Enable Interface.
  5. Configure IPv4 Configuration type to Static IPv4 and assign its gateway IP for that subnet (e.g., 10.0.20.1/24).
  6. Click Save and Apply Changes. Repeat for any additional VLANs.

3. Phase 2: Cisco Managed Switch Configuration (CLI / Web UI)

Your Cisco switch must be configured to pass these tagged VLANs across the trunk port connected to OPNsense, while delivering untagged traffic via access ports to end devices. Below is standard Cisco IOS CLI configuration logic (applicable to SG350 series switches).

Step 1: Create the VLANs Globally

configure terminal
vlan 20
 name IoT-Devices
vlan 30
 name Server-Infrastructure
vlan 99
 name Management-VLAN
end

Step 2: Configure the Trunk Port (Connecting to Proxmox/OPNsense)

Assuming interface GigabitEthernet 1/1 is your trunk uplink carrying the traffic:

configure terminal
interface GigabitEthernet 1/1
 description OPNsense-Proxmox-Trunk-LACP
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan add 20,30,50-80,99
end

(Note: If using an LACP Port Channel instead of a single interface, apply these exact switchport commands to the interface port-channel X bundle interface).

Step 3: Configure Access Ports (Connecting End Devices)

For a device residing in the IoT room (VLAN 20) plugged into port GigabitEthernet 1/5:

configure terminal
interface GigabitEthernet 1/5
 description Living-Room-IoT-Device
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
end

4. Best Practices

  • Establish a Dedicated Management VLAN: Never leave your switches, Proxmox hypervisor, and OPNsense GUI on the default VLAN 1. Isolate management traffic onto a secure, firewalled management VLAN (e.g., VLAN 99) with restricted access rules.
  • Implement Strict Inter-VLAN Firewall Rules: By default, OPNsense blocks all traffic between new VLANs, which is ideal. Build explicit “allow” rules only where necessary (e.g., allowing your trusted LAN to reach server management ports, but blocking IoT VLAN from initiating outbound connections to your private subnets).
  • Prune Unused VLANs on Trunks: Explicitly define the switchport trunk allowed vlan list on Cisco switches rather than allowing all VLANs (vlan all), preventing accidental leakage of sensitive networks to unintended ports.
  • Enable Spanning Tree PortFast / BPDU Guard: On all edge access ports connected to end devices, enable portfast to prevent long network convergence delays when devices boot up.

5. Common Pitfalls & Troubleshooting

  • The Native VLAN Mismatch:
    • The Trap: If OPNsense expects an untagged native VLAN on its parent interface, but the Cisco switch trunk port has a different native VLAN ID configured (or vice versa), frames will drop or loop, resulting in intermittent packet loss or complete loss of connectivity.
    • The Fix: Ensure the native VLAN ID on the Cisco trunk port matches the untagged network configuration on that physical leg.
  • Forgetting Firewall Rules for New VLANs:
    • The Symptom: You set up the VLAN interface in OPNsense and assign an IP, but connected devices cannot pull a DHCP lease or reach the gateway.
    • The Fix: OPNsense blocks everything by default. You must create an IPv4/IPv6 “Pass” rule on the specific VLAN tab under Firewall > Rules allowing traffic out to * (or at least allowing DHCP requests to the gateway IP).
  • Asymmetric MTU or LACP Hash Discrepancies:
    • The Symptom: Erratic dropouts under heavy data transfers between VLANs.
    • The Fix: Verify that your LACP hash policy on the Proxmox/Linux bond matches or complements the switch settings, and ensure jumbo frames (if enabled) are applied uniformly across the path.