Thanks Omen, appreciate that man.

Normally the firewall is initialised to prevent access from WAN (your wireless network) to LAN. If you want to retain that configuration you'll have to write firewall rules to allow access from WAN to LAN OR initiate your tests from LAN.

If you are new to pfSense you may find it easier to add another NIC to your box, use it for WAN, make the wireless NIC OPT1 and bridge OPT1 with LAN. This is a more "usual" type of configuration and there is a tutorial for that configuration - see the pfSense docs page at http://doc.pfsense.org/index.php/Main_Page and click on the Tutorials link and look for the link to add a WiFi interface.

I have these two:

http://linitx.com/viewproduct.php?prodid=11919
http://linitx.com/viewproduct.php?prodid=11736

Atheros AR5414 - R52H 802.11a/b/g High Power minipci and the pci to minipci adapter work flawlessly with pfsense 1.2.2.

The high power really (350mw) does make a difference, before I was using netgear WG511t, also atheros.

Update:

Posting from my laptop connected to pfsense (hotspot).  Seems like everything is working just fine.

Still leads me to wonder why I'm unable to pass traffic when connected with an xv6800 Pocket PC running WM 6.1??

Hi,

yes, I followed the man page, and I can configure the card on the command line.  I changed the loader.conf, copied the corresponding ipw kernel modules to the proper place and added all parameters from iwi replaced with ipw, and I even created the structure in /usr/share do point to the directory containing the README because of the license parameter. The card is detected fine now (and has to, as otherwise I guess I wouldn't be able to configure it via cli)

Well, probably not so important then, as I guess I'll have to get an atheros based card if I want to have an ap. But before I just wanted to test everything…

Thanks,
Klaus

@wallabybob:

If you have your access point connected to a switch then all the wireless clients are effectively on the same LAN as all the computers connected to the switch.

If you have the access point connected to the pfSense box through an additional NIC card in the pfSense box then I think you have more configuration options, for example, you can bridge the wireless LAN and LAN so that things look much like connecting the access point to the switch OR you can treat the wireless LAN as a separate network with restricted access to the LAN.

Also, pfSense supports a number of wireless LAN cards so you can turn your pfSense box into a router-firewall-wireless access point. I have such a system at home which happily supports three family laptops with wireless access and about six wired computers. Currently the wireless support in pfSense is 802.11b and 802.11g only which is probably plenty fast enough for many home applications.

Thanks for the detailed information. I'm going to do some testing with different configurations before putting it into productions. Since my switch supports VLAN's, i'll try to put the W.A.P. on its on VLAN. Unfortunatley i don't have enough room in my pfsense for another card since its on a 1u server.

@mildmanneredreporter:

I have had an IPCop box running for several years, but broke it with a Net-to-Net application. So I am trying to shift to pfSense and am unable to access the Net wirelessly, even though I am clearly on the wireless network. I believe its a DNS problem that I cannot fathom.

I have built the pfS box and have the LAN running. It works fine. Wireless looks like this:

Cable modem >> pfSense >> Linksys WRT54GS >> Laptop

This worked fine as:

Cable modem >> IPCop >> Linksys WRT54GS >> Laptop

so I know that the wireless AP works. I can even shift back to the IPCop box and get wireless net access running. My laptop will also join the wireless WRT54GS network flawlessly even on pfS. I can see the laptop on the pfSense routing table. But that's as far as I can get.

I followed the config instructions here:
http://www.freesoftwaremagazine.com/articles/configure_professional_firewall_using_pfsense?page=0%2C1

I use the OpenDNS servers, and have them correctly listed in my General Setup. They work on my LAN. I have tried turning DNS forwarding off and on, checking the DNS mapping boxes and not checking the DHCP registration boxes in the DNS forward service. I just can't get out of my house on my wireless network.

Any idea what I'm doing wrong here?

UPDATE: For some reason, two reboots got it going again.

Thanks for the fast reply. Working :)

If your  wired and wireless clients are on the same IP subnet, that's what you want.

@Nanafriend:

As far as I know WPA2 isn't the best way to go as many other wireless adapters are not compatible with it.  I read several times that there isn't any difference between WPA and WPA2, at least in turns of cracking.  You want to use WPA - Pre shared key(psk), with tkip only.

Don't use TKIP at all anymore, it is crackable (or close to it, Google for recent info on this). WPA with AES is fine, and WPA2 works on almost everything. Some laptops with XP may not work with WPA2 unless the wireless card manufacturer provides software that supports it.

Yes

Search this forum for more help.  Compatible cards and setup.

"to a small camping were they use wireless 3*AP (linksys wrt-54gl),"  I am not sure I understand the scenario but it likely doesn't matter.  You are attempting to make the pfsense box the primary router and then make the others… simple wireless access points?  The 'best' option is to run cat5e or cat6 rj-45 cables to and from each one.  I don't really understand why you feel the need to fulfill this idea exactly.  I doubt you can monitor all of what goes on inside of each of those boxes but you can likely check out everything that goes on inside of your pfsense box using squid and Bandwidthd.  From what I see in Bandwidthd it shows you exactly what happens with each individual IP and subnet and all that.  It is a pretty deep program it seems like.  If your pals won't listen to you when you say, 'no torrents' for whatever reason, then just yank their wire and put it at that.  Or you can use the traffic shaper to disable torrents or even all P2Ping.  Traffic shaper is under the firewall tab, 5th down.  I don't understand what  "I have thought of a text in the beginning of your site, and dont it," means.  I assume you mean like.. alix boards or something, you won't be able to use your current settings, everything will be fresh and new and I think there are several limitations versus going the full X86 route with a hard drive.

@df:

Hi Ktims,

I'm also using Alix and therefore i must ask, would you mind sharing your kernel config ?
I have to admit i'ld like to make some use of the LED support too ;)

Ps: Is there any chance to see the LED support added to the current pfsense kernel config ?

Sure. I have been experiencing some freezes when mucking in Advanced Options in the webUI, so I'm not going to vouch for the stability of my kernel, but that could easily be (and probably is) something else. I haven't had a chance to hook up a serial console and see what's happening.

config
tarball of /boot/kernel

It's based on 7.0-RELEASE. I have added the content of src/sys/dev/glxsb to the kernel tree and modified src/sys/conf/files.i386 to include the lines that reference those files so it will compile. That gets you hardware cryptodev. I have also copied src/sys/i386/i386/geode.c from HEAD. That gets you /dev/led support. If all you're interested in is LED support I would grab the pfSense-embedded kernel config linked above by lsf (you might need an older revision, I couldn't find where IPSEC_NAT_T and ALTQ_FAIRQ where coming from, they don't seem to be in 7.0) and build it with the replaced geode.c and no other changes.

I based my changes on this article by Kvedulv.

lol, I think this thread needs to be put out of it's misery. I don't think anyone is getting anything out of this. ;)

My wifi works for days in bridge mode, but eventualy no wireless clients can connect, stuck at authentication. When I don't use the bridge everything keeps working fine.

Backend only, you can modify the hostadp config generated from pfsense to allow such use.

The file in question is /etc/inc/interfaces.inc (look for function interfaces_wireless_configure) and edit the config section that comes after:

                case 'hostap':                         if (isset($wlcfg['wpa']['enable'])) {                                 $wpa .= <<

This is the portion that takes all the variables set in the web GUI and creates the hostapd_"if-name".conf file. "man hostapd" for more information.

Did you add rules to allow such traffic in on the wifi interface ?

I meant you should connect a directional antenna to the computer (the pfSense) connecting to the accesspoint.
A directional antenna has benefits for both sides.