Thanks for your reply!
@BrightEyesDavid:
2. I'm thinking wifi access point 2 would be for guest internet access, where they can only get internet access and not access any of the other devices on wifi access point 1 or the switch; is this possible? Alternatively, would it be possible to achieve the same effective result with only one access point, where only certain devices would be allowed to send/receive from other devices on the home network but all devices would have internet access?
Edit: I just remembered the SG-2220 has wireless options; could I achieve the same result using its own wifi?
@mauroman33:
2. Yes, if the switch supports VLANs.
Regarding using VLANs for isolation, I think I heard that VLAN-based separation/isolation is not as secure as using separate interfaces because the VLAN tag on the end of each packet can potentially be faked. Is that right, or is a VLAN means of separating groups of devices reliable in this situation?
Does the SG-2440 have four separate interfaces (one for WAN, other three for LANs in my case), or are all/some of the ports on the same interface?
@BrightEyesDavid:
3. I'd like to run a couple of internet-accessible services on a home computer (webserver and mumble server). I only want the associated ports to be reachable on that particular computer - not other devices. Can I configure pfSense so that all incoming traffic on certain ports (80, 443, etc.,) only get routed to a certain computer attached to the switch (which is attached to the SG-2220), whether using IPv4/NAT or IPv6/no NAT?
4. Also, can I effectively isolate this internet-accessible computer from my other computers (in case of compromise via website software, for example), perhaps with the exception of port 22 for SSH access from one or two of my other computers? (And is this a fairly safe/sensible approach? The SG-2220 has just the one LAN interface.)
@mauroman33:
I think there will be no problems about number 3 and 4, although it's better to wait for someone more experienced.
Okay, thanks. I would have thought that 3 in particular is something basic for pfSense as it seems similar to what a typical NAT router does when it forwards ports.
By the way, I've started watching this Comprehensive Guide To pfSense 2.3 video series which seems helpful, and I think I'm going to learn a lot and hopefully find out more about things related to my questions.
