pfSense with OpenWRT Guest logon with VLAN
-
@stephenw10 said in pfSense with OpenWRT Guest logon with VLAN:
Hmm, that's curious. Any other sites that fail?
Do you have captive portal running on either?
Fail, not that I am aware of. Just Speedtest so far. Oddly, devices (even iOS) on the WiFi connections are unaffected.
No, don't run captive portal. I'm really rural and my guest count is single digit.
-
@johnpoz Yep, that's the exact indication I get. I do not have any rules blocking 8080. My rules on the VLANs block all of them from accessing LAN and accessing each other. LAN has access to all the VLANs. I don't run any rules, routing or dhcp on the blue box routers. They are all just Dumb-APs on a physical backhaul,
Observation: on an iOS wifi client on the routers, I can see this same result. But, if I play around with the test server I can get it to work.
So....
I know there is some scuttlebutt around the net about some (especially streaming) services playing games with Starlink clients since they often have out of state POPs. It would have to be unfortunate timing on my part that this problem cropped up just as I implemented the VLAN isolation to my routers. I'm very rural and did a lot of the early Beta testing for Starlink and it is a game changer for rural so I won't be switching. But there are factions out there with disdain for Musk so I'm not saying it isn't possible. If I use the speedtest util built into the Starlink software, it works every time.I don't think this is a pfSense problem but that is just a gut feeling. I can't seem to find the real reason.
And yes the little "John Poz" voice in my head keeps whispering "the solution starts with U"
-
@ramosel said in pfSense with OpenWRT Guest logon with VLAN:
I do not have any rules blocking 8080.
But do you have rules limiting to only specific things? Simple thing to do would be to sniff the traffic and then fire up the speedtest web or app, and see where it tries to go..
If it works with specific servers - some of their servers don't use 8080, etc..
Are you routing traffic on these vlans out a specific gateway, like a vpn or something?
-
So, I just let this stew and used the Speed Test available with the Starlink console... which worked fine. Quite a few people came up with the same issue and a few posted information to show that some (not all) ISPs and hosts were definitely blocking direct Starlink traffic via the Ookla website or app. You could use a VPN and get around the blocks too. Anyway, it all seems to be working without a VPN now. So, yep, it was just a coincidence this happened as I turned up some VLANs. I thought I'd done wrong... but with all you guys helping... how could I??
-
The more I learn the more I discover I don't know.
-
@stephenw10 said in pfSense with OpenWRT Guest logon with VLAN:
The more I learn the more I discover I don't know.
So freaking true!
-
@stephenw10 said in pfSense with OpenWRT Guest logon with VLAN:
The more I learn the more I discover I don't know.
You have learned that valuable lesson early.
As a retired development engineer, I look back and can honestly say my best take on your statement and of modern technology is that the more I know about something, the worse the product was from the beginning.
-
@ramosel said in pfSense with OpenWRT Guest logon with VLAN:
the more I know about something, the worse the product was from the beginning.
-
@stephenw10
Is there any chance to make step by step guide about connecting openwrt dump access points to pfSense using vlans to isolate insecure devices such as phones cameras guests...
Thanks/
Nikos -
Right now is a terrible time to write such a guide because depending on which architecture the openwrt device is it may or may not have been converted to DSA. And that changes the way ports and interfaces are handled significantly!
In pfSense you just create a VLAN interface on the parent NIC the AP(s) is connected to and assign that as a new interface with the appropriate firewall rules.
You would have to add that VLAN to any switches in between pfSense and the AP(s).
In OpenWRT you would:
Create a VLAN device on the appropriate eth device.
Create a bridge that includes that new VLAN device.
Assign that bridge as a new interface.
Create a new SSID and set that as attached to the new interface.Doing that replicates the pre-configured br-lan interface but for the new VLAN.
That assumes an OpenWRT device that doesn't have a switch or at least isn't connected via the switch.
Steve
-
Thanks a lot.
Nikos
-
No worries. I'm sure we could help you get that working if you have an problems.
-
@ikonomn said in pfSense with OpenWRT Guest logon with VLAN:
@stephenw10
Is there any chance to make step by step guide about connecting openwrt dump access points to pfSense using vlans to isolate insecure devices such as phones cameras guests...
Thanks/
NikosI'm playing with this again on some Linksys e8450s (and it's fight back) so I've hesitated to respond to your request as I know it can be done... just not sure if wifi clients stay isolated as they pass through the VLANs into pfSense and out on the WAN.
If you use OpenWRT, there is a setting within the Wireless setup of each SSID to "isolate clients". I know the isolation works on the connected WAP as well as on multiple WAPs. But there is no setting to isolate any ethernet connections if you use the VLAN to hardwired devices... that I've found. Fortunately all those devices that need isolation are indeed, wireless.
-
Yes wireless clients will be isolated from each other is that is set on the access point. They would not be isolated from wired devices on the VLAN that AP is bridged to.
What exactly are you wanting to isolate?
Linksys e8450 looks like nice device.
-
@stephenw10 said in pfSense with OpenWRT Guest logon with VLAN:
Yes wireless clients will be isolated from each other is that is set on the access point. They would not be isolated from wired devices on the VLAN that AP is bridged to.
What exactly are you wanting to isolate?
I was just finally responding to Nikos... but I do Client Isolation on my WAP clients on my IOT VLAN... and all my wired IP Cameras are on that VLAN as well. I just have rules to to isolate the wired stuff in pfSense itself.
Linksys e8450 looks like nice device.
Yeah, I got some back channel info that one of the OpenWRT Devs is now coding for MediaTek and that some of the Linksys/Belkin stuff was going to get "extra" attention. They do seem have potential but there is a UBI memory hack from DangoWRT that works... but is suddenly causing devices to die.... almost like they've had a Covid shot too many.
Anyway... long story short, I'm having an issue getting the DSA build you and I worked on configured under Openwrt 23.05.3. Either I forgot the process, or it isn't going to work... I've even tried editing in the info in the tar backup Network file. I'll figure it out or I'll send you an e8450/rt3200
JP... yes, I'm hearing you in my head... unify, unify, unify. But I really need 4 ethernet ports on two of my remote WAPs with backhaul.
