Unifi Intervlan connectivity

[ahuacate]

Just tried out your pfSense OpenVPN client with Unifi DHCP build. VPN connectivity works except for these issues:

1. No inter-VLAN connectivity between UniFi VLANs. I cannot ping a UniFi DHCP client on the new VPN VLAN.
2. What Firewall Rules do you use at the pfSense interface? I note you do not list any.

Any hints would be much appreciated.

Cheers

[RobertDWhite]

Hi @ahuacate
So sorry for the massive delay. I am not sure why I missed all these. Apparently notifications were not set by default for Discussions.

Nonetheless, you are likely talking about my original post on the topic. With that setup, there is no "good" way to communicate inter-vlan due to the double gateway. The best way to do it is to tag the host(s) on the same VLAN as the pfSense network, which is not feasible in most circumstances. The other way (which works for the couple of ways I have used it in the past) is to set the firewall rules on both the UDMP as well as the pfSense gateway. You have to get your mindset to understand forwarding UDMP -> pfSense WAN IP, then everything from there would be like port forwarding from the Internet to a device on a subnet on the UDMP....I know that was confusing, but you're essentially setting firewall rules on the UDMP side and port-forwarding on the pfSense side. I set up a Nginx Proxy Manager host on my pfSense LAN, which accepts 80/443 and sends the request to the appropriate host based on destination. I used firewall rules on the UDMP to allow 80/443 to the pfSense WAN, and the port forwarding rules on pfSense sent 80/443 to the Nginx Proxy Manager host. I imagine you can use a similar set up for other ports and purposes.

However, I have a new post on the topic that uses WAN2 on a UDMP to allow you to do policy-based routing. This setup does NOT need the extremely limiting multi-gateway setup in the same way. Check the post out here:
https://whitematter.tech/posts/vpn-policy-based-routing-with-unifi-and-pia/

If you follow these instructions, you will be able to access the devices with simple firewall rules such as "ALLOW" VLAN1 IP Range-> VLAN2 IP Range. This will solve your issue in a much more manageable and scalable way. You basically will do all the routing 100% in Unifi.