Skip to content

Add a User VLAN with Internet Access

A linear runbook for adding one new VLAN across the whole chain — created in pfSense on the Netgate 6100 MAX, trunked to the Cisco switch, with DHCP and internet access for the devices in it. Each step links to the page with full background; this page is just the sequence, like Step-by-Step Switch Configuration. For the conceptual model behind these clicks, see Routing and VLANs in pfSense.

Example scenario used throughout — substitute your own values, they only have to stay consistent from step to step:

Setting Value
VLAN ID / name 20 / Users
Subnet 192.168.20.0/24
Gateway (the pfSense VLAN interface) 192.168.20.1
DHCP pool 192.168.20.100 – 192.168.20.199
pfSense parent interface igc0 (LAN1 — the port cabled to the switch, per the port allocation strategy)
Switch uplink to pfSense Gi0/48 (trunk)
User-facing access port Gi0/10

1. Plan the VLAN

  • Pick a VLAN ID and subnet not already in use. Check Interfaces → Assignments → VLANs in pfSense and show vlan brief on the switch. This wiki's example scheme: 10 = Management, 20 = Guest/Users, 30 = Video — see VLAN Basics in pfSense.
  • Know which physical pfSense port feeds the switch. Everything below assumes igc0 (LAN1).
  • Have console access to the switch ready for step 8 — you'll be reconfiguring the very port your management traffic may ride on.

The DHCP pool deliberately starts at .100, leaving .2–.99 free for anything that needs a static address later.

2. Create the VLAN in pfSense

Go to Interfaces → Assignments → VLANs tab, click Add:

  • Parent Interface: igc0
  • VLAN Tag: 20
  • VLAN Priority: leave blank
  • Description: Users

Click Save. This creates the tagged subinterface — it isn't usable until it's assigned and enabled in the next step. See VLAN Basics in pfSense for what pfSense is doing under the hood.

3. Assign and Configure the Interface

Back on the Interface Assignments tab, select VLAN 20 on igc0 (Users) in the Available network ports dropdown and click Add. It appears as a new OPTx interface — click its name to configure it:

  • Check Enable interface
  • Description: USERS — this becomes the interface's name across the whole GUI
  • IPv4 Configuration Type: Static IPv4
  • IPv4 Address: 192.168.20.1, and set the mask dropdown to 24 — it defaults to a host mask (32), which breaks the whole subnet if left
  • IPv4 Upstream gateway: None

Click Save, then Apply Changes.

Caution — leave the upstream gateway on None: gateways belong only on WAN-type interfaces. Netgate's own guidance: do not set a gateway on internal interfaces such as a LAN or DMZ — selecting one makes pfSense treat the interface as a WAN for NAT and related functions, and the VLAN's internet access breaks in confusing ways.

4. Enable DHCP

Devices in the VLAN need addresses handed out, or nothing else in this guide is testable. Go to Services → DHCP Server → USERS tab:

  • Check Enable
  • Range: 192.168.20.100 to 192.168.20.199
  • DNS Servers: leave empty — pfSense then hands clients its own VLAN address (192.168.20.1), answered by its DNS Resolver

Click Save. See DHCP Fundamentals for what actually happens when a client asks for a lease.

5. Add Firewall Rules

A new interface starts with no rules, which means all traffic is blocked — users could get a DHCP lease yet reach nothing. This default-deny behavior is covered in Routing and VLANs in pfSense.

Go to Firewall → Rules → USERS, click Add:

  • Action: Pass
  • Interface: USERS
  • Address Family: IPv4
  • Protocol: Any — the field defaults to TCP, which silently breaks ping (ICMP) and DNS lookups (UDP)
  • Source: USERS subnets
  • Destination: any
  • Description: Allow Users to any

Click Save, then Apply Changes.

Destination "any" includes your other VLANs, not just the internet. To give users internet while keeping them out of your gear, add a block rule above the pass rule — rules match top-down, first match wins:

Order Action Protocol Source Destination Purpose
1 Block Any USERS subnets 192.168.10.0/24 Keep users off the Management VLAN
2 Pass Any USERS subnets any Internet and everything else

Add one block rule per VLAN that should stay private. The reasoning behind per-interface rules is in VLAN Basics in pfSense.

6. Check Outbound NAT and DNS

Two things internet access depends on that are usually — but not always — already in place:

  • Outbound NAT: Firewall → NAT → Outbound. In Automatic mode (the default), new local networks are included with no action needed. In Manual mode, nothing is generated for the new VLAN — add a mapping for 192.168.20.0/24 on WAN, mirroring the existing LAN entry. Any configuration that switches this page to Manual or Hybrid — routing a subnet out of a tunnel interface, for instance — makes this step mandatory rather than optional. Concept background: NAT & Private IP Ranges.
  • DNS Resolver: Services → DNS Resolver — Network Interfaces is set to All by default, which covers the new VLAN. If it's been restricted to specific interfaces, add USERS to the selection.

If some VLANs route through a tunnel rather than the WAN, also decide which gateway this VLAN should use. By default the pass rule from step 5 sends traffic straight out of the WAN, which is usually what a general-purpose user VLAN should get. Traffic is steered per rule by setting Gateway under a rule's advanced options.

7. Create the VLAN on the Switch

pfSense now tags VLAN 20 toward the switch, but the switch drops tags for VLANs it doesn't know about.

Cisco IOS — global configuration mode (conf t):

vlan 20
 name Users

If the switch refuses with a VTP error, it's in client mode — see VTP.

8. Add the VLAN to the Trunk

The uplink to pfSense must carry the new VLAN's tags. First check what that port is doing today.

Cisco IOS — privileged EXEC:

show interfaces Gi0/48 switchport

If it's already a trunk (Operational Mode: trunk), add the VLAN to the allowed list:

Cisco IOS — global configuration mode (conf t):

interface Gi0/48
 switchport trunk allowed vlan add 20

Caution — add is not optional on a live trunk: the bare command switchport trunk allowed vlan 20 replaces the entire allowed list, instantly cutting off every other VLAN on the uplink — see the full warning in VLANs & Inter-VLAN Routing.

If it's still an access port (a single flat LAN so far), convert it to a trunk. Do this from the console cable, not over the network — a typo here cuts off your own management session:

Cisco IOS — global configuration mode (conf t):

interface Gi0/48
 switchport mode trunk
 switchport trunk native vlan 1
 switchport trunk allowed vlan 1,20

The existing untagged LAN keeps working because it rides the trunk's native VLAN — which must match whatever VLAN the untagged network uses (VLAN 1 on a default config; see Native VLAN for mismatch risks). Don't set the new VLAN as native: pfSense sends VLAN 20 tagged, so the switch must too. Long-term, Netgate's best practice is to move everything on this port into tagged VLANs — see the note in VLAN Basics in pfSense.

If switchport mode trunk is rejected with an encapsulation error, see the platform note in Step-by-Step Switch Configuration.

9. Assign Access Ports

Put each user-facing port into the VLAN:

Cisco IOS — global configuration mode (conf t):

interface Gi0/10
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
 no shutdown

spanning-tree portfast skips the ~30-second STP listening/learning delay so DHCP works the moment a device is plugged in — use it only on ports facing end devices, never on the trunk. For several ports at once, use interface range Gi0/9 - 12.

10. Save the Switch Config

Nothing above survives a reload until it's written to NVRAM:

Cisco IOS — privileged EXEC:

end
copy running-config startup-config

11. Verify End-to-End

On the switch — privileged EXEC:

! VLAN 20 exists and Gi0/10 is listed under it
show vlan brief

! VLAN 20 shows as allowed AND in the forwarding/active list on Gi0/48
show interfaces trunk

In pfSense: Status → Interfaces shows USERS up with 192.168.20.1; after a client connects, Status → DHCP Leases shows its lease.

Then plug a laptop into Gi0/10 — it should get a 192.168.20.1xx address with gateway 192.168.20.1.

On your laptop's terminal:

ping 192.168.20.1
ping 1.1.1.1
nslookup example.com

Each proves a different layer: the gateway ping proves the tagged path through the trunk works, 1.1.1.1 proves the firewall rule and outbound NAT work, and the lookup proves DNS works. All three good = users have internet.

If Something Doesn't Work

Symptom First things to check
No DHCP lease Trunk not carrying VLAN 20 (show interfaces trunk), port in the wrong VLAN (show vlan brief), or DHCP not enabled on the USERS tab
Lease OK, can't ping 192.168.20.1 Tag mismatch — VLAN 20 must be tagged on both the pfSense parent and the switch trunk, and must not be the trunk's native VLAN
Gateway pings, ping 1.1.1.1 fails Firewall rule protocol left at TCP, missing Apply Changes, or outbound NAT in Manual mode with no 192.168.20.0/24 mapping (step 6)
IPs work, names don't DNS Resolver not listening on USERS, or clients handed a DNS server they can't reach — check what the lease actually delivered
Switch refuses vlan 20 VTP client mode — see VTP

More general debugging flow: Common Issues and Diagnostic Commands.