Help with guest network on access point

JKnott

@AndyRH said in Help with guest network on access point:

Just be aware you will need a managed switch to do VLANs on the on the AP.

Actually, you can get away without that, but they're recommended. I ran a VLAN to an AP for years, before I got around to getting a managed switch.

SteveITS

@JKnott said in Help with guest network on access point:

you can get away without that, but they're recommended. I ran a VLAN to an AP for years, before I got around to getting a managed switch

This is true, but note that it works much better with wireless clients. The wireless device connects to the AP which assigns the VLAN tag. They can't connect to a different VLAN without using a different SSID.

If wired clients are also in use, they can often set their own VLAN tag in the driver settings. A managed switch can/would block that. Typically the wired network would not need/want to connect to the guest wireless though.

JKnott

@SteveITS said in Help with guest network on access point:

The wireless device connects to the AP which assigns the VLAN tag.

This part works the same either way. The difference is without a managed switch, the VLAN is available elsewhere. That may or may not be desirable.

fernando_om

Thanks for your replies!
I was searching for my mini PCI-express WLAN adapters I have laying around here but they are too old. The newer ones I found are all full height, the pfSense motherboard I'm using only accepts half height. I'm almost sure I have a half height Ralink, but it is missing...
While searching, I found a Raspberry Pi model 3B v1.2. I turned it into an RaspAP yesterday, now I'm checking what kind of settings it have on it to see if it can address my needs. Even if the GUI doesn't have an option to configure, in theory it can support VLANs on a OS basis by using the command line to create a link on ethernet (eth0) interface.
Lets see... if I get any progress, I'll be readily here to inform.

fernando_om

So as promised, I'm back to report my progress...

I didn't buy any new devices yet, so no VLAN's at this point. But, the Rpi that was laying around was of such a great help. The RaspAP looks very good until now and, by command line on the underlying Raspbian, I could create a rule in iptables so all the packages (or frames) directed to internal networks will be dropped right there. Right after, I made it permanent with persistent iptables and it is working like a charm: guests do have internet but they don't see my local network.

I appreciate every single answer given here and I'll be implementing some of them as soon as I get the new gear. RaspAP is good but it is a temporary solution for me.

provels

I'm also VLAN challenged due to dumb switches, but I don't really need anything more. But I have a spare port in my FW device and an ancient access point running DD-WRT and plan on following this cookbook when the time comes, just substituting my AP's RealLAN for the VLAN.
Guest Net Setup

JKnott

@provels

If you want a guest WiFi, you don't need a managed switch. I did that for years before I got a managed switch. The only issue is, with a dumb switch, the VLAN will be available everywhere on your network. However, for this to be a problem, the users would have to tamper with the network settings on their computers. Those computers are locked down, right?

On the other hand, I recommend getting a managed switch anyway.

provels

@JKnott I wouldn't be using a VLAN at all, just another OPTn interface connecting the AP directly to the FW, like in a DMZ (only outbound), and deny that LAN access to the internal net.
On another tangent, I wonder if a wireless net bypassing pfB would help with my cell's Wi-Fi calling feature.

fernando_om

I forgot to mention the links I used to make my temporary solution:

https://unix.stackexchange.com/questions/46104/how-to-provide-a-guest-lan-on-one-ethernet-device
https://github.com/RaspAP/raspap-webgui/issues/275
https://askubuntu.com/questions/270693/how-can-set-these-iptables-rules-to-run-at-startup
https://linuxconfig.org/how-to-make-iptables-rules-persistent-after-reboot-on-linux

fernando_om

@JKnott
I'm really interested in VLANs for a near future, I just need to wisely choose the gear as I'll need to replace some of that I already own. I built my setup over a J1800 processor in a fully integrated motherboard. It is a strange setup I bought second hand almost for free but it lacks expansion slots, it features one mini PCI-express slot (I filled with that old wireless card but the range is not useful for a guest WLAN) and one 1x (one lane) PCI-express which I installed the Gigabit ethernet port, also there is just one memory slot with a 4GB DDR3 (it supports a maximum of 8GB). It is a weird ECS-BAT-I (brand?) motherboard that even features an HDMI port and LVDS connector (for LCD screens), I think its a hybrid between a Desktop and a Laptop motherboard, with pieces of SBCs here and there. What I like is that it is a 10W TDP processor that runs pfSense quite well with a medium processor usage of 7%, so very efficient in power usage (This is consuming an average of only 19W/hour according to my Home Assistant measures, by using a PZEM-004T, I guess most of energy is lost in conversion by the old cheap ATX Power Supply, I have one TFX FSP300-60SGV which is 80Plus Gold labelled but I don't know if I can just swap an ATX for an TFX power supply, never tried).
Probably for my next shot, I'll replace this motherboard with a normal Desktop one with more PCI-e slots so I can put more interfaces and create several OPTn-s to work with the VLANs. If the consumption is not that much of a difference, of course.
Single PCI-e with more than one port is not cost-effective according to my searches (in my country, at least). For example: One adapter with 2 Gigabit ports cost much more than 2x single ports Gigabit boards.

For now, guest WLAN is working without exposing my network to unknown or infected devices right away (I guess).
And I really appreciate every one of you that shared you knowledge and time to help me out, you guys are the best!

JKnott

@fernando_om said in Help with guest network on access point:

Probably for my next shot, I'll replace this motherboard with a normal Desktop one with more PCI-e slots so I can put more interfaces and create several OPTn-s to work with the VLANs.

You might consider a mini PC, like the one in my sig. It has 4 Ethernet ports. In fact, one of my friends bought one last week and his has 2.5 Gb Ethernet ports but mine has only 1 Gb. <sniff>

You can put VLANs on the same interface as your LAN. For example, my guest WiFi VLAN is on my main LAN, so that the access point has both available.

provels

@fernando_om Thanks for the links. If you do decide to pursue a mini-PCIE card, I recommend one based on the Atheros AR9280 chip. And you can get bigger antennas. I use both an AR9280 and 9380 based cards (not half-sized) but the 9280 seems to work particularly well and the 9380 should have 3 antennas and I'm one short there. Good luck.