In this article I will go over how to configure routing between multiple VLANs by using our pfSense router and a switch that supports 802.1Q. On our pfSense router we will configure our LAN port with multiple sub interfaces and assign each one to a certain VLAN. The uplink port on the switch side connecting to our pfSense router will be set to tag all the traffic using the 802.1Q protocol. This configuration is known as a router on a stick and the diagram below gives you an idea of the configuration that we will accomplish. In the diagram, we have five VLANs and a different subnet assigned to each. Our pfSense box will have an IP address in each VLAN(,, etc…) which will function as the default gateway for clients assigned to those VLANs.


The switch configuration will vary from manufacturer to manufacturer which means that what applies to my switch might not necessarily apply to yours. I will cover Cisco, Dell, and Avaya switch configuration commands for configuring trunks, VLANs, and access ports since I am familiar with all three.

pfSense Configuration:

Before we start, we are going to configure our WAN interface firewall rules to allow us to connect to our pfSense web GUI from the WAN. We are doing this because while configuring our LAN port to trunk multiple VLANs we will lose connection to pfSense should we be accessing it via the LAN. For this reason, it is better if we connect a laptop directly to the WAN port while we are configuring the router’s LAN port so that we do not lock ourselves out. By default, pfSense will block connections destined to port 443 so we must allow it by creating a firewall rule. You can create a firewall rule by heading over to firewall–>rules–>WAN.


In here you want to add a new rule at the bottom. See below for the settings for this new rule.


You must also modify the WAN interface and give it a static IP address since it is most likely configured to grab one via DHCP. If it is not configured for DHCP then you should be fine, otherwise modify it by going over to interfaces–>WAN.


You should now be able to plug your laptop or desktop directly to the WAN interface on your pfSense router and access it via the web by going over to https://IPADDRESS where IPADDRESS is the IPv4 address you chose above. Note: You should assign your laptop or desktop a static IP address in the same subnet as the WAN IP Address. If you chose as your WAN IP address then through are all valid IP addresses that you can assign the network adapter on your laptop or desktop.

Once you have gained access to your pfSense box by plugging into the WAN port then the next step is to head over to Interfaces–>VLANs. You should have two Interfaces currently configured which should be your LAN and WAN interfaces respectively and each one should be mapped to a physical port on your pfSense box.


In the VLANs tab you want to add a new VLAN and assign it to the interface that your managed switch will be plugging into. Each VLAN that you create must get a TAG between 1 and 4094 which will match the VLAN number that you configured on your switch that plugs into this port. Below is an example of a VLAN creation.


Note: If for some reason the parent interface is not listing all your network adapters then that means that your network adapters do not support 802.1Q tagging and therefore they cannot tag traffic.

Hit save when done and add other VLANs should you need to create more.


We must now head back to the interface assignments tab and start adding interfaces for each VLAN that we created.


When you are done, you want to click on your interfaces which should have a name starting with OPT# and enable them.


After enabling the VLANs, you should have more settings available. Below is one of my VLANs that I have configured with a static IPv4 address. The IP address that I assigned to this VLAN will be the default gateway for my clients that will be assigned to this VLAN.


Note: You should restart your pfSense box once you are done configuring all your settings for each VLAN. I noticed that my settings did not take effect until I restarted my box.

Now that all my VLANs are setup and each one has been assigned an IP address then the next thing that I did was configured DHCP for each one of those VLANs. DHCP will allow my clients to get an IP address automatically when they connect to any of those VLANs. Configuring DHCP is simple and once you enable the DHCP server on each VLAN interface then all you have to do is assign a range of IP addresses that your clients will receive on this VLAN.


Note: There are a lot more DHCP options that you can set should you decide to use them but I will not cover them here.

Now that we have the VLAN interfaces created, DHCP configured in each VLAN, then the next thing that we have to do is to enable DNS in each VLAN interface. Most people will configured their pfSense box to forward all DNS request to either their ISP, Google Public DNS, or another third-party DNS server. This means that for DNS forwarding to work properly then you must enable it on the interfaces that your clients will be connecting to. In our case our clients will be connecting to the VLANs that we created and they will most likely be behind private IP addresses with their DNS servers being set to their VLAN default gateway IP address.


The last thing that we will do is modify our firewall rule for each VLAN interface and create an allow rule similar to the one below. The reason for creating this firewall rule is so that NAT can work since it is most likely the case that our clients will be behind private IP addresses and will need their traffic to be NATed in order to reach the internet.


The specific settings for the firewall rule above is shown below.


Now that our pfSense box is configured with VLANs then the next step is to configure our switch that will be connecting to the pfSense box.

Switch Configuration:

Below are some commands that you use to configure a trunk port on switches for different vendors that I am familiar with. Assume that your switch is named SW1 and that interface 1/1 is used to connect to your pfSense box. We will start with the VLAN configuration followed by the trunk configuration and then the access port configuration.

Cisco Configuration:

VLAN Configuration

 SW1(config)#vlan #

This will create a layer 2 VLAN

 SW1(config-vlan)#name NAMEHERE

Assign a name


Exit VLAN configuration mode

Trunk Configuration

 SW1(config)#interface gig 1/1

 SW1(config-if)#Switchport trunk encapsulation dot1q

Switches the encapsulation to 802.1Q

 SW1(config-if)#Switchport mode trunk

changes the port to a trunk port

 SW1(config-if)#Switchport trunk allowed vlan {add|all|except|remove}

configures which VLANs can be allowed on a trunk. By default, all the VLANs are allowed.

Access Port Configuration

 SW1(config)#interface Fastethernet #/#

 SW1(config-if)#switchport mode access

Make it an access port

 SW1(config-if)#switchport access VLAN#

Assign the VLAN that it belongs to.

Dell Configuration:

On Dell PowerConnect switches the configuration is very similar to Cisco switches.

VLAN Configuration

 SW1(config)#Vlan database

Enter VLAN configuration mode

 SW1(config-vlan)#Vlan #

Create VLAN


Exit VLAN configuration mode

Trunk Configuration

 SW1(config)#Interface ethernet 1/1

 SW1(config-if)#Switchport mode trunk

Switches the encapsulation to 802.1Q

 SW1(config-if)#Switchport trunk allowed vlan add

configures which VLANs can be allowed on a trunk.

Access Port Configuration

 SW1(config)#interface ethernet #/#

 SW1(config-if)#switchport mode access

Make it an access port

 SW1(config-if)#switchport access VLAN#

Assign the VLAN that it belongs to.

Avaya Configuration:

On an Avaya switch the configuration differs from the Dell and Cisco configuration.

VLAN Configuration

 SW1(config)#vlan create VLAN# name NAMEHERE type port

Create the VLAN, give it a name, and make it be a port based VLAN.

Trunk Configuration

 SW1(config)#vlan ports 1/1 tagging tagAll

Configure our port to tag all traffic

 SW1(config)#vlan members add VLAN# 1/1

Configure which VLANs you will be tagging on this interface

Access Port Configuration

 SW1(config)#vlan members add VLAN# PORT#/#

Assign VLANs to ports

 SW1(config)#vlan ports #/# pvid VLAN#

Assign the Port VLAN ID to the port

Note: A port can be a member of multiple VLANs but can only have one PVID(Port VLAN ID) associated with it which tells us what VLAN you transmit on. Most people make this a 1 to 1 relationship so that the VLAN assigned to the port matches the PVID.

This will conclude another pfSense article. As I experiment more with the platform and decide to use other features then I will keep documenting the configuration for reference here. As always, thank you for taking your time to read this blog post and I hope that it was helpful. Any feedback and comments are greatly appreciated.

78 Responses to “Configuring VLANs on pfSense”

  1. Excellent guide!
    I’ve configured all like described but I’m encountering problems 🙁
    I’ve configured the VLAN 50 and from my VM I get a DHCP Lease
    But I cannot ping the pfsense box nor ping google… what could it be?

  2. Hi All,

    Hope all are fine.

    I’m new on pfsense and I started implementing this solution on my project, that look llike:


    Note: The CORE-SW are L3 making a routing and I have one SERVER with act as DHCP as well.

    From the switch up to Servers and PC I can get the IP address automatically and bettwen the switch I can ping all them.

    I Just have 5 VLANS (same configuration on pfsense and core-sw):
    – BlackHole 999 – (no ip address)
    – Native 25 (no ip address)
    – Default 1 – (disabled, no ip address)
    – Management 127 (
    – Data 63 (

    On PFsense i’m using 2 port (WAN and LAN).


    a) Wich IP address must be set on PFsense...
            - In way that I can access it
     b) Just the Data vlan need go to to do it?

    Thanks and Hope that someone can help me.



  1. Home Network Challenge Part 3 – Random Other Projects - […] Setting up VLANs on pfSense is also fairly easy. There are several good tutorials online and I ended up…
  2. devolo WiFi pro 1200e, ZyXEL GS1920 und pfSense – VLAN einrichten – Andy's Blog - […] HIGHLNK – Configuring VLANs on pfSense […]

Leave a Reply