我有一个 Unifi AP，有一个MYNETSSID 连接到我的 HP 2520 交换机的端口 23。我有一个 pfSense LAN 接口连接到端口 1。AP 客户端192.168.1.0/24从 pfSense获得 DHCP ( ) 并且可以访问互联网等。我有静态租约我所有的“已知”设备还有一个 DHCP 池，因此新设备可以继续进行配置。
我在 pfSense 和策略路由端口 443 上配置了 OpenVPN（客户端），等等。虽然有些网站会丢弃 VPN 流量，所以我想我会在 AP 上设置一个“vpn 绕过”SSID 并给它一个完全不同的子网。我可以告诉 pfSense 只是将整个网络路由出 WAN 接口。
我vlan 200在 AP 上添加并给它NOVPN一个 SSID。在 pfSense 上，我遵循了一些教程并vlan 200在 LAN 接口上进行了设置。我启用了 vlan 接口，为其添加了防火墙“通过”规则。然后，为完全不同的子网 ( 192.168.2.0/24)设置 DHCP 。如果重要的话，我还没有为它配置静态租约。
当客户端离开MYNET并连接到 时NOVPN，客户端不会获得 IP。tcpdump 显示来自客户端的 DHCP 请求和 pfSense 回复，但这就是我看到的全部内容。在客户端，连接超时/失败。在 pfSense 上，我看到一个 DHCP 回复到客户端的静态租约MYNET。回复来自x.x.1.1（pfSense LAN 接口）。我期待它来自pfSensex.x.2.1的vlan 200地址。
11:44:16.625014 IP 192.168.1.1.67 > 192.168.1.66.68: BOOTP/DHCP, Reply, length 300
我认为这可能是因为我的交换机上没有任何 VLAN 可能会发生这种情况？我尝试vlan 200在我的交换机上进行设置，但在标记/未标记/GVRP 等中迷路了。我是否需要以某种方式中继/标记AP 和 pfSense 端口，因为它们将承载多个 VLAN 流量？我从这个HP 链接尝试了一些东西，但无法弄清楚需要什么才能使这项工作正常进行。有什么想法吗？
当前 HP 端口分配：
===========================- TELNET - MANAGER MODE -============================
Switch Configuration - VLAN - VLAN Port Assignment
Port DEFAULT_VLAN no_vpn_vlan | Port DEFAULT_VLAN no_vpn_vlan
---- + ------------ ------------ | ---- + ------------ ------------
1 | No Untagged | 13 | No Untagged
2 | No Untagged | 14 | No Untagged
3 | No Untagged | 15 | No Untagged
4 | No Untagged | 16 | No Untagged
5 | No Untagged | 17 | No Untagged
6 | No Untagged | 18 | No Untagged
7 | No Untagged | 19 | No Untagged
8 | No Untagged | 20 | No Untagged
9 | No Untagged | 21 | No Untagged
10 | No Untagged | 22 | No Untagged
11 | No Untagged | 23 | No Untagged
12 | No Untagged | 24 | No Untagged
Actions-> Cancel Edit Save Help
端口/中继设置（所有端口设置与#1 相同）：
Port Type Enabled Mode Flow Ctrl Group Type
---- --------- + ------- ------------ --------- ----- -----
1 1000T | Yes Auto Disable
...
更新：在下面添加开关配置：
运行配置
switch-2520G# show run
Running configuration:
; J9299A Configuration Editor; Created on release #J.14.54
hostname "switch-2520G"
vlan 1
name "DEFAULT_VLAN"
no untagged 1-24
no ip address
exit
vlan 200
name "no_vpn_vlan"
untagged 1-24
ip address 192.168.1.10 255.255.255.0
exit
auto-tftp 192.168.100.120 "/tftp"
banner motd "HP SWITCH
"
include-credentials
password manager user-name "x..." sha1 "x..."
no telnet-server
ip authorized-managers 192.168.1.220 255.255.255.255 access manager
ip authorized-managers 172.22.200.220 255.255.255.0 access manager
ip authorized-managers 192.168.1.220 255.255.255.255 access manager
ip ssh public-key operator "ssh-rsa ..."
ip ssh public-key operator "ssh-rsa ..."
snmp-server community "x..." operator
snmpv3 engineid "xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx"
aaa authentication ssh login public-key
no tftp server
知识产权信息
switch-2520G# show ip
Internet (IP) Service
Default Gateway :
Default TTL : 64
Arp Age : 20
Domain Suffix :
DNS server :
VLAN | IP Config IP Address Subnet Mask Proxy ARP
-------------------- + ---------- --------------- --------------- ---------
DEFAULT_VLAN | Disabled
no_vpn_vlan | Manual 192.168.1.1 255.255.255.0 No
VLAN信息
switch-2520G# show vlan
Status and Counters - VLAN Information
Maximum VLANs to support : 256
Primary VLAN : DEFAULT_VLAN
Management VLAN :
VLAN ID Name Status Voice Jumbo
------- -------------------- ------------ ----- -----
1 DEFAULT_VLAN Port-based No No
200 no_vpn_vlan Port-based No No
VLAN 1 (DEFAULT_VLAN)
switch-2520G# show vlan 1
Status and Counters - VLAN Information - VLAN 1
VLAN ID : 1
Name : DEFAULT_VLAN
Status : Port-based Voice : No
Jumbo : No
Port Information Mode Unknown VLAN Status
---------------- -------- ------------ ----------
Overridden Port VLAN configuration
Port Mode
---- ------------
VLAN 200 (no_vpn_vlan)
switch-2520G# show vlan 200
Status and Counters - VLAN Information - VLAN 200
VLAN ID : 200
Name : no_vpn_vlan
Status : Port-based Voice : No
Jumbo : No
Port Information Mode Unknown VLAN Status
---------------- -------- ------------ ----------
1 Untagged Learn Up
2 Untagged Learn Down
3 Untagged Learn Down
4 Untagged Learn Down
5 Untagged Learn Down
6 Untagged Learn Down
7 Untagged Learn Down
8 Untagged Learn Down
9 Untagged Learn Down
10 Untagged Learn Down
11 Untagged Learn Up
12 Untagged Learn Down
13 Untagged Learn Up
14 Untagged Learn Down
15 Untagged Learn Down
16 Untagged Learn Up
17 Untagged Learn Down
18 Untagged Learn Down
19 Untagged Learn Down
20 Untagged Learn Down
21 Untagged Learn Up
22 Untagged Learn Down
23 Untagged Learn Up
24 Untagged Learn Down
VLAN端口分配
Port DEFAULT_VLAN no_vpn_vlan | Port DEFAULT_VLAN no_vpn_vlan
---- + ------------ ------------ | ---- + ------------ ------------
1 | No Untagged | 13 | No Untagged
2 | No Untagged | 14 | No Untagged
3 | No Untagged | 15 | No Untagged
4 | No Untagged | 16 | No Untagged
5 | No Untagged | 17 | No Untagged
6 | No Untagged | 18 | No Untagged
7 | No Untagged | 19 | No Untagged
8 | No Untagged | 20 | No Untagged
9 | No Untagged | 21 | No Untagged
10 | No Untagged | 22 | No Untagged
11 | No Untagged | 23 | No Untagged
12 | No Untagged | 24 | No Untagged
UPDATE-2/解决方案（由 Zac67 提供）：
更改两个 VLAN 的 IP 地址：交换机配置 - Internet (IP) 服务
Default Gateway :
Default TTL : 64
Arp Age : 20
VLAN IP Config IP Address Subnet Mask
-------------------- + ---------- --------------- ---------------
DEFAULT_VLAN | Manual 192.168.1.1 255.255.255.0
no_vpn_vlan | Manual 192.168.2.1 255.255.255.0
正确的 VLAN 标记：
Switch Configuration - VLAN - VLAN Port Assignment
Port DEFAULT_VLAN no_vpn_vlan | Port DEFAULT_VLAN no_vpn_vlan
---- + ------------ ------------ | ---- + ------------ ------------
1 | Untagged Tagged | 13 | Untagged No
2 | Untagged No | 14 | Untagged No
3 | Untagged No | 15 | Untagged No
4 | Untagged No | 16 | Untagged No
5 | Untagged No | 17 | Untagged No
6 | Untagged No | 18 | Untagged No
7 | Untagged No | 19 | Untagged No
8 | Untagged No | 20 | Untagged No
9 | Untagged No | 21 | Untagged No
10 | Untagged No | 22 | Untagged No
11 | Untagged No | 23 | Untagged Tagged
12 | Untagged No | 24 | Untagged No
添加 pfSense NAT 规则no_vpn_vlan：
