How to set up VLAN in OPNsense

Virtual Local Area Networks - VLANs - are an important tool for the network infrastructure, particularly in environments with firewall solutions such as OPNsense. They allow to divide a physical network into multiple logical networks, which improves security and organization. This article describes how to set up VLANs in OPNsense 25.1.

Assign VLAN

First, a VLAN-ID between 1 and 4094 is assigned to an interface. The ID 4095 is reserved, as in all VLAN networks..

• 
  Go to Interfaces ‣ Devices ‣ VLAN.
• 
  Here, click on the +.
• 
  Assign the desired Interface as well as the VLAN-ID, in this example 10.
• 
  Click on Apply.

It is also possible to use an interface as Trunk by simply assigning a second VLAN with a different ID to the same interface.

Create interface

The following screenshots demonstrate the process of adding a network interface:

• 
  In the webinterface, navigate to Interfaces ‣ Assignments and select the new VLAN in the section Assign a new interface.
• 
  State a description and click on Add.
• 
  The new VLAN was added as new interface Lab in this example. Click on Save.

In Thomas-Krenn-Wiki, you will find information on how to add an OPNsense interface.

Assign IP address

Here, an IP address is assigned to the added interface. There are several options available, such as automatic address assignment using DHCP or manual configuration of a static IP address (Static IPv4). In this example, a static address assignment with the IP-address 192.168.10.1/24 is used.

• 
  Click on the menu item Assignments ‣ Interfaces on the previously created VLAN interface.
• 
  Activate it with the help of the option Enable Interface.
• 
  Go to the menu item IPv4 Configuration Type after activation of the interface and select one of the options described earlier.
• 
  If you selected the Static IPv4 option, scroll down to the Static IPv4 configuration section. State the static IPv4 address as well as the subnet. After that, click on Save.
• 
  Store the configuration with Apply changes.

Firewall rules

Note: By default, all incoming connections on this interface are blocked. To change this, you must create rules to control and secure data traffic for the VLAN you created.

• 
  Go to the Firewall menu and click on Rules to create rules here.

References

Translator: Alina Ranzinger Alina has been working at Thomas-Krenn.AG since 2024. After her training as multilingual business assistant, she got her job as assistant of the Product Management and is responsible for the translation of texts and for the organisation of the department.