VLANS are Virtual Local Area Networks. They are logically separate networks similar in concept to physically separated networks.

The biggest difference is that you do not need to put network devices on physically separate switches or other network hardware. VLANs are both economical and convenient. It is economical since you do not need to purchase extra hardware and convenient since your network devices can be physically located anywhere yet still be grouped in logically separate networks.

Create New VLAN interface

1. To configure VLANs, you must go to Interfaces > Other Types > VLAN. Click “Add” to add a new VLAN. The first option you need to select is the parent interface. It is the physical port where the VLAN should reside. Give a tag number (something other than 1), priority of VLAN traffic and short description. And finally click “Save” to create the new VLAN.

2. The next step is to assign a new logical interface for the VLAN. Go to Interfaces > Assignments. On the interface assignments screen select the new VLAN interface and click on the Add “+” button. Then click on “Save” button.

3. Now access the OPNsense interfaces menu and select the new VLAN interface. You can change the name of the VLAN interface and enable it.

4. Once the interface is enabled, define the following configuration:

• Enable: Yes
• Description: Optionally you may change the name of VLAN inteface
• IPv4 configuration type: Static IPv4
• IPv6 configuration type: None
• Speed and duplex: Default

On the Static IPv4 configuration area, enter the following information:

• IPv4 address: VLAN interface IP address and netmask. For example, 192.168.10.1/24 Click on “Save” and “Apply changes” button.

Enable DHCP on VLAN interface

Now DHCP service must be enable for the VLAN interface in order for devices on the VLAN to obtain an IP address automatically.

1. Go to Services > DHCPv4 > [VLAN interface name]
2. Click the “Enable DHCP server on [VLAN interface name] interface” checkbox
3. Now enter the IP addresses range which will be used for clients in the VLAN. For example: 192.168.10.100 - 192.168.10.200
4. There is no need to change any other settings unless a different gateway or DNS server are intended to be used
5. Save and apply the changes

Add the appropriate firewall rules

Now that you have created and enabled a new VLAN, you will need to set up firewall rules in order for data to flow out of your VLAN. By default, all network traffic for a newly created interface is blocked so you will need to create a few rules to allow the desired traffic on that particular network. To get up and running quickly, you may clone the same basic rules that were created when the LAN interface was initially generated during the OPNsense install. There are 3 rules: the anti-lockout rule which cannot be removed (it keeps you from locking yourself out of the web administration pages), an allow all IPv4 rule.You may clone both of those rules if you wish by clicking on the far right icon beside the rule:

And then, modify the fields accordingly:

References

• techexpert tips
• homenetworkguy