pfSense with OpenWRT Guest logon with VLAN
-
@stephenw10 Thanks again for all your help, I really didn't feel like putting the Ver 21 snapshots into full use on my Dumb-APs then they stopped development on V21 and V22 RCs started coming out. I did testing with rc 4, 5, and 6 and they all looked promising so I just sat on rolling out the VLAN guest network on the WRT3200ACMs I have. Finally, Ver 22.03.0 (stable) was released so I have upgraded all my Dumb-APs and implemented the Guest network delivery via VLAN. I also had a need to have an ethernet IOT network pushed out over the backhaul connections to the remote routers. Again, your help made that easy to provision as well. I now have Guest network running on a separate network IPv4 with client isolation and a IOT network hard wired through another VLAN to run IP cameras at the out buildings on my property. All is well.... well, not quite.
The new provisioning is getting IP addresses via the VLANs and DHCP servers on pfSense. The configured OpenWRT Network on the WRT3200ACMs seem functional. Web pages load just fine. But, I came across something early this week I can't get to work. Whether the Guest network WiFi or the IOT ethernet, neither will allow a Speedtest (ookla) to run. The devices, WiFi or ethernet on the primary networks do. Whether using the Speedtest.net website or their App, once you get it up, when you hit start it says connecting and just pinwheels until it stops and says "Test failed to complete. Check your internet connection and try again". Any Ideas??
-
Hmm, that's curious. Any other sites that fail?
Do you have captive portal running on either?
Speedtest doesn't require anything special usually.
-
@stephenw10 If I had to guess maybe 8080 is blocked.. If can not talk on 8080, it can not find a server to test to, and would fail to start..
If I block 8080 I get this.
-
Oh, nice! Yeah, almost certainly that. Learned something today.
-
I learned that lesson earlier myself.
And just to let you know, maybe take a look at FreshTomato and if your device is supported. It is much easier to set up.
-
@stephenw10 said in pfSense with OpenWRT Guest logon with VLAN:
Hmm, that's curious. Any other sites that fail?
Do you have captive portal running on either?
Fail, not that I am aware of. Just Speedtest so far. Oddly, devices (even iOS) on the WiFi connections are unaffected.
No, don't run captive portal. I'm really rural and my guest count is single digit.
-
@johnpoz Yep, that's the exact indication I get. I do not have any rules blocking 8080. My rules on the VLANs block all of them from accessing LAN and accessing each other. LAN has access to all the VLANs. I don't run any rules, routing or dhcp on the blue box routers. They are all just Dumb-APs on a physical backhaul,
Observation: on an iOS wifi client on the routers, I can see this same result. But, if I play around with the test server I can get it to work.
So....
I know there is some scuttlebutt around the net about some (especially streaming) services playing games with Starlink clients since they often have out of state POPs. It would have to be unfortunate timing on my part that this problem cropped up just as I implemented the VLAN isolation to my routers. I'm very rural and did a lot of the early Beta testing for Starlink and it is a game changer for rural so I won't be switching. But there are factions out there with disdain for Musk so I'm not saying it isn't possible. If I use the speedtest util built into the Starlink software, it works every time.I don't think this is a pfSense problem but that is just a gut feeling. I can't seem to find the real reason.
And yes the little "John Poz" voice in my head keeps whispering "the solution starts with U"
-
@ramosel said in pfSense with OpenWRT Guest logon with VLAN:
I do not have any rules blocking 8080.
But do you have rules limiting to only specific things? Simple thing to do would be to sniff the traffic and then fire up the speedtest web or app, and see where it tries to go..
If it works with specific servers - some of their servers don't use 8080, etc..
Are you routing traffic on these vlans out a specific gateway, like a vpn or something?
-
So, I just let this stew and used the Speed Test available with the Starlink console... which worked fine. Quite a few people came up with the same issue and a few posted information to show that some (not all) ISPs and hosts were definitely blocking direct Starlink traffic via the Ookla website or app. You could use a VPN and get around the blocks too. Anyway, it all seems to be working without a VPN now. So, yep, it was just a coincidence this happened as I turned up some VLANs. I thought I'd done wrong... but with all you guys helping... how could I??
-
The more I learn the more I discover I don't know.
-
@stephenw10 said in pfSense with OpenWRT Guest logon with VLAN:
The more I learn the more I discover I don't know.
So freaking true!
-
@stephenw10 said in pfSense with OpenWRT Guest logon with VLAN:
The more I learn the more I discover I don't know.
You have learned that valuable lesson early.
As a retired development engineer, I look back and can honestly say my best take on your statement and of modern technology is that the more I know about something, the worse the product was from the beginning.
-
@ramosel said in pfSense with OpenWRT Guest logon with VLAN:
the more I know about something, the worse the product was from the beginning.
-
@stephenw10
Is there any chance to make step by step guide about connecting openwrt dump access points to pfSense using vlans to isolate insecure devices such as phones cameras guests...
Thanks/
Nikos -
Right now is a terrible time to write such a guide because depending on which architecture the openwrt device is it may or may not have been converted to DSA. And that changes the way ports and interfaces are handled significantly!
In pfSense you just create a VLAN interface on the parent NIC the AP(s) is connected to and assign that as a new interface with the appropriate firewall rules.
You would have to add that VLAN to any switches in between pfSense and the AP(s).
In OpenWRT you would:
Create a VLAN device on the appropriate eth device.
Create a bridge that includes that new VLAN device.
Assign that bridge as a new interface.
Create a new SSID and set that as attached to the new interface.Doing that replicates the pre-configured br-lan interface but for the new VLAN.
That assumes an OpenWRT device that doesn't have a switch or at least isn't connected via the switch.
Steve
-
Thanks a lot.
Nikos
-
No worries. I'm sure we could help you get that working if you have an problems.
-
@ikonomn said in pfSense with OpenWRT Guest logon with VLAN:
@stephenw10
Is there any chance to make step by step guide about connecting openwrt dump access points to pfSense using vlans to isolate insecure devices such as phones cameras guests...
Thanks/
NikosI'm playing with this again on some Linksys e8450s (and it's fight back) so I've hesitated to respond to your request as I know it can be done... just not sure if wifi clients stay isolated as they pass through the VLANs into pfSense and out on the WAN.
If you use OpenWRT, there is a setting within the Wireless setup of each SSID to "isolate clients". I know the isolation works on the connected WAP as well as on multiple WAPs. But there is no setting to isolate any ethernet connections if you use the VLAN to hardwired devices... that I've found. Fortunately all those devices that need isolation are indeed, wireless.
-
Yes wireless clients will be isolated from each other is that is set on the access point. They would not be isolated from wired devices on the VLAN that AP is bridged to.
What exactly are you wanting to isolate?
Linksys e8450 looks like nice device.
-
@stephenw10 said in pfSense with OpenWRT Guest logon with VLAN:
Yes wireless clients will be isolated from each other is that is set on the access point. They would not be isolated from wired devices on the VLAN that AP is bridged to.
What exactly are you wanting to isolate?
I was just finally responding to Nikos... but I do Client Isolation on my WAP clients on my IOT VLAN... and all my wired IP Cameras are on that VLAN as well. I just have rules to to isolate the wired stuff in pfSense itself.
Linksys e8450 looks like nice device.
Yeah, I got some back channel info that one of the OpenWRT Devs is now coding for MediaTek and that some of the Linksys/Belkin stuff was going to get "extra" attention. They do seem have potential but there is a UBI memory hack from DangoWRT that works... but is suddenly causing devices to die.... almost like they've had a Covid shot too many.
Anyway... long story short, I'm having an issue getting the DSA build you and I worked on configured under Openwrt 23.05.3. Either I forgot the process, or it isn't going to work... I've even tried editing in the info in the tar backup Network file. I'll figure it out or I'll send you an e8450/rt3200
JP... yes, I'm hearing you in my head... unify, unify, unify. But I really need 4 ethernet ports on two of my remote WAPs with backhaul.
