Skip to content

Configure VLANs

VLANs allow a single physical NIC to carry multiple logically separated networks using 802.1Q tags. This guide covers creating a VLAN, assigning it as an interface, and applying firewall policy.

For reference information, see VLANs.

Prerequisites

  • A physical NIC that supports 802.1Q tagging (check your driver documentation)
  • A managed switch with the corresponding port configured as a trunk carrying the VLAN tag(s)
  • A planned IP subnet for the VLAN that does not overlap with existing interfaces

Step 1: Create the VLAN

Go to Interfaces > VLANs and click Add.

Field Value Notes
Interface em0 (or your NIC name) The physical NIC connected to the trunk port
VLAN tag 100 Must match the tag on the switch trunk port
Description Servers Human-readable label

Save. Repeat for each additional VLAN.

Step 2: Assign the VLAN as an interface

Go to Interfaces > Assign.

In the available interfaces list, the VLAN appears as em0.100 (or similar). Click Add to assign it to the next optional interface slot (OPT1, OPT2, etc.).

Step 3: Configure the interface

Go to Interfaces > OPT1 (or whichever slot was assigned).

Field Value
Enable Checked
Description SERVERS (or your VLAN name)
IP address 192.168.100.1/24 (your chosen subnet)

Save and apply.

Step 4: Enable DHCP (if hosts need automatic addressing)

Go to Services > DHCP Server and select the SERVERS tab.

Enable DHCP and set the address pool within the VLAN subnet. See DHCP Server.

Step 5: Firewall rules

By default, no traffic is permitted on the new interface. Add rules at Firewall > Rules > SERVERS.

Example: Allow VLAN hosts to reach the internet, block access to LAN:

# Block SERVERS from reaching LAN
Action:   Block
Interface: SERVERS
Source:   SERVERS subnet (192.168.100.0/24)
Dest:     LAN subnet (192.168.1.0/24)

# Allow SERVERS internet access
Action:   Pass
Interface: SERVERS
Source:   SERVERS subnet
Dest:     any

Rule order matters — place block rules before the pass-any rule.

Step 6: Validate

  1. Connect a host to the switch port configured for VLAN 100 (access mode) or tag VLAN 100 on a trunk port to the host
  2. Confirm the host receives an IP in the 192.168.100.0/24 range
  3. Confirm internet access works
  4. Confirm the host cannot reach LAN subnet addresses

Multiple VLANs on one NIC

Repeat Steps 1–5 for each VLAN. Each VLAN gets: - A unique VLAN tag (1–4094) - Its own optional interface slot - Its own IP subnet - Its own DHCP scope (if needed) - Its own firewall rules tab

All VLAN interfaces share the same physical NIC but are isolated by the 802.1Q tag.

NIC driver MTU note

If your NIC does not have native 802.1Q driver support, the MTU is reduced to accommodate the VLAN tag. This can cause fragmentation for packets near the standard 1500-byte MTU. Prefer NICs with confirmed 802.1Q support (e.g., Intel em/igb family).