1. Login to pfSense
2. Click on Interfaces → Assignments
3. Click on VLANs (link on the upper menu)
4. Click on the Green Add button
5. Fill out this information below on the VLAN Configuration
   1. Parent Interface: em1 (typically this is the LAN port)
   2. VLAN Tag: 20
   3. VLAN Priority: 0
   4. Description: VLAN 20
   5. Click on the blue Save button
6. Click on Interfaces Assignments
   1. For “Available network ports”: Click the drop down arrow and Choose VLAN 20 on em1
   2. Click on the green Add
   3. Click on the blue Save
7. Click on the interface link for OPT1
8. Fill out this information below:
   1. General Configuration
      1. Enable Interface: checked
      2. Description: OPT1VLAN20
      3. IPv4 Configuration Type: Static IPv4
   2. Static IPv4 Configuration
      1. IPv4 Address: 192.168.20.1
      2. Click the dropdown for the Subnet Mask and select 24.
   3. Click on the blue Save
   4. Click on the green Apply Changes button at the top.

Great! You’ve got a VLAN.

It’s on VLAN 20 and it’s IP interface is set to 192.168.20.1.

Keep in mind, just because it’s VLAN 20 doesn’t mean the subnet has to contain the “20” in it’s IP of 192.168.20.1.

We just find it makes it easier to keep the numbers the same as it’s easier in identifying particular settings and connected clients later.

Now in order for this VLAN interface to start issuing IP addresses we need to configure a DHCP Server for it. Read on.

1. Login to pfSense (you’re probably still in pfSense but just in case you’re not you gotta log back in)
2. Click on Services → DHCP Server
3. Click on Opt1VLAN20 (link on the upper menu)
   1. Enable: Checked
   2. Range: 168.20.100 to 192.168.20.150 (We’re simply going to issue 50 leases out for this VLAN. You can change this if you need more DHCP IP addresses)
   3. Click on the blue Save

Perfect! We’ve now got the VLAN 20 interface issuing IP addresses.

However, we have to create some firewall rules to get out to the Internet. We may want to create some other rules as well restricting what exactly a client on VLAN 20 can get to.

There are a few rules we need to setup for VLAN 20.

Most importantly, if you want VLAN 20 to get out to the Internet we have to create a rule for that.

Perhaps you want to restrict clients on VLAN from accessing devices on the LAN. We need a rule for that.

What about NOT allowing clients on VLAN 20 to even get to the pfSense web interface. Well, we need a rule for that.

So below are some rules you may need to configure depending on what you want VLAN 20 to have access to.

One hugely important thing about Firewall Rules. When you create a rule, it may not seem as if it goes into effect immediately. The reason:

• Let’s say a device is on the VLAN20 network and it is constantly accessing something on the LAN.
• You haven’t activated a firewall rule yet to block VLAN20 from the LAN.
• Even if you create that rule it won’t affect the device that’s constantly hitting something on the LAN due to something called a “Firewall State” or “Network State”.
• The only way to make the rule go into effect immediately is to:
  • Create the rule (or any rule for example)
  • Click on Diagnostic –> States –> Reset States
  • When you do this any and all open states that exist will be broken. So there will be a brief hiccup in Internet access. However, it is usually very quick. Just be aware of that before you go off and Reset States.

1. Login to pfSense (once again, you’re probably still in pfSense but just in case you’re not you know the drill)
2. Click on Firewall –> Rules
3. Click on Opt1VLAN20 (link on the upper menu)
4. Click on the green Add button
5. Fill out this information below:
   1. Edit Firewall Rule
      1. Action: Pass
      2. Interface: OPT1VLAN20
      3. Protocol: Any
      4. Source
         1. Source: Any
      5. Extra Options
         1. Description: Allow OPT1VLAN20 to any
      6. Click on the blue Save
      7. Click on Apply Changes.

At this point, clients on VLAN 20 that are issued IP addresses on the 192.168.20.0 subnet should be able to get out to the Internet.

Navigate to Firewall –> Aliases.

• Click on the green Add
• Name: pfSenseGUI
• Description: Disable Access to pfSense GUI
• Type: Hosts(s)
• IP or FQDN: Enter the IP of the actual pfSense. Example, 192.168.1.1.

Navigate to Firewall –> Rules.

• Select Floating:
• Click on a green Add button.
• Action: Block.
• Quick: Checked.
• Interface: Select the VLAN(s) to be denied access.
• Direction: in.
• Address family: IPv4.
• Protocol: TCP\UDP.
• Source:
  • Invert Match: Not Checked.
  • Source: any
• Destination:
  • Invert Match: Not Checked.
  • Destination:
    • Single host or alias
    • Destination Address: pfSenseGUI.
• Destination Port Range:
  • From: HTTPS (443). If pfSense is set to HTTP this needs to be HTTP (80).
  • To: HTTPS (443). If pfSense is set to HTTP this needs to be HTTP (80).
• Description: VLAN 20 – no access to pfSense GUI
• Click Save.
• Click Apply Changes at the top.

1. Click on Firewall → Rules
2. Click on Opt1VLAN20 (link on the upper menu)
3. Click on the green Add button (up arrow), so this needs to be the first rule in the list.
4. Fill out this information below:
   1. Edit Firewall Rule
      • Action: Block
      • Interface: OPT1VLAN20
      • Protocol: Any
   2. Source
      • Source: OPT1VLAN20 net
      • Destination: LAN net
   3. Extra Options
      • Description: VLAN 20 – cannot access LAN
5. Click on the blue Save button.
6. Click on the green Apply Changes button at the top.