Open up a vlan ip to the outside

[johnpoz]

@rashadmahmood How many ports do you have free on your poe switch, you can use another port on the poe and pfsense for your other segmented network without having to vlan them.

I do this - I have some networks just native, and then some networks that are vlans over the same physical wire. The networks that are vlans are just wifi networks, and don't actually talk to each other so no hairpin traffic over the same physical interface.

For remote access I would setup a vpn.. So you don't have to expose cameras or the nvr to the public internet at all.

[rashadmahmood]

@johnpoz

The POE switch will have 3-4 ports free.

so I should segment the access points, using the two lans on pfsense? - and set up firewall rules so they can speak to the other network in the house (some pcs will be connected to the physical lan)

Do I still need two NICS in the NVR?

[johnpoz]

@rashadmahmood do your AP support vlans? You can for sure segment out your wifi ssids to different networks if you desire. But your cameras are not over wifi are they? You really wouldn't need a wifi segment for your cameras if they are wired.

And again - your cameras are not going to be saturating the wire or anything, not with 4 of them.. But I would keep traffic between the cameras and the nvr on a completely different network than your normal network traffic. If your wanting to segment it out, might as well keep it from riding over the same wires as your normal network if possible.

For example - lets say your cameras are doing 40mbps per second.. If that rides over the same wire as your normal traffic to your router as all your other traffic for other networks, or even over the same wire to say your nvr machine. That is 40mbps that is used that your devices can't use.. Or if you saturate that link with other traffic, maybe your cameras have issues with recording..

It is best if possible to put this sort of traffic on its own wires so that it doesn't compete or interfere with your normal day to day network traffic.

its not the end of the world if you can't, and it might never be problem - but if your going to take the time to set it up on its own network anyway, might as well keep this traffic off your normal day to day connections.

[rashadmahmood]

@johnpoz

yep the access points can do vlans.

@johnpoz said in Open up a vlan ip to the outside:

It is best if possible to put this sort of traffic on its own wires so that it doesn't compete or interfere with your normal day to day network traffic.

absolutely agree, I will do this, thanks so much for your help and advice!

[JKnott]

@rashadmahmood said in Open up a vlan ip to the outside:

What is the best way to deal with this? My understanding is that you want to segment the CCTV LAN; otherwise, the whole network would be broadcasting all over the place. With a VLAN, I can confine this to the CCTV LAN.

Does your NVR have 2 ports? If so, you use one to access the NVR from elsewhere and one for an isolated LAN for your cameras.

[rashadmahmood]

@JKnott

thanks, yes I will separate the camera network from the NVR.

[johnpoz]

@rashadmahmood keep in mind if your going to multihome this box your using as your nvr. The interface you add to the cam network you create wouldn't have a gateway set, nor dns on this interface.

I would just have an IP with proper mask for the network your attaching it too.

[rashadmahmood]

@johnpoz

You mean such as 192/168.0.1/24 (proper subnet mask?) and omit the gateway?

[johnpoz]

@rashadmahmood yeah your just going to use this interface to talk to cameras on this same network - you would not want your pc being used as nvr to use it for any other connections to other networks - so there would be no gateway set on it.

[rashadmahmood]

@johnpoz

Many thanks

[johnpoz]

@rashadmahmood example - my main pc connection to my nas at 2.5ge.. That I use only to move files back and forth from my pc and nas.

This network 192.168.10/24 isn't use for anything else.. Kind of like the network your pc/nvr will user to talk to the cameras..

if I want to talk to the nas for say admin of the nas, then I talk to it on its 192.168.9 IP address.

[rashadmahmood]

@johnpoz perfect, thanks!

[JKnott]

@johnpoz said in Open up a vlan ip to the outside:

so there would be no gateway set on it

Unless the device needs a gateway set. Then just use the NVR or a dummy address.

[johnpoz]

@JKnott said in Open up a vlan ip to the outside:

Unless the device needs a gateway set.

Why would the windows PC with a 2nd nic added it to it need a gateway on the interface?

This not the cameras - this is the PC he is using as his NVR.

"It's a PC running Windows 10 with AXIS Camera Station 5 software"

[rashadmahmood]

@johnpoz + @JKnott

The 1st NIC connected to the network (for the purpose of viewing the server/software) would require a gateway - correct?
The 2nd NIC connected to the cameras via a POE switch does not require a gateway?

Have I understood this correctly?

Also can I use the same POE switch for bother camera (different network) and other lan devices (again another network)?

[rashadmahmood]

@johnpoz + @JKnott

So I'm thinking of implementing the following

Network 1:

Subnet: 192.168.0.0/24
Gateway: 192.168.0.1 (pfSense)
Windows machine for viewing cameras: Assign a unique IP within the range, e.g., 192.168.0.10/24
Other LAN devices: Assign unique IPs within the range.
VLAN 1:

VLAN 1 Interface for Access Point 1: 192.168.0.2/24
VLAN 1 Interface for Access Point 2: 192.168.0.3/24

Network 2 (CCTV):

Subnet: 10.0.0.0/25
NIC 2 of the Windows machine: Assign an IP within this range, e.g., 10.0.0.1 with no gateway
cameras 1 to 4 set with no gateway

Example Configuration:
pfSense Gateway: 192.168.0.1/24
Windows Machine NIC 1 (Network 1): 192.168.0.10/24
Windows Machine NIC 2 (Network 2): 10.0.0.1/25
Access Point 1: 192.168.0.2
Access Point 2: 192.168.0.3

Also create a vpn to access the 192.168.0.0/24 network

Apologies, its been a while since I messed with network configs.

[JKnott]

@johnpoz said in Open up a vlan ip to the outside:

Why would the windows PC with a 2nd nic added it to it need a gateway on the interface?

Over the years I have come across some devices that required all the setting to be configured, including gateway whether it was needed or not. I'm not saying that will happen here, but it's always possible.

[JKnott]

@rashadmahmood

Yes, that's correct and yes you can use the same PoE switch, provided it supports VLANs.

[rashadmahmood]

@JKnott - yep its a managed switch

[johnpoz]

@JKnott said in Open up a vlan ip to the outside:

, but it's always possible.

What part are you not getting that this is a Windows PC??

His cameras should point to pfsense as their gateway.. That is if he wants them to talk to the internet to say get firmware updates. Or if he wants to talk to them directly via his vpn connection without doing source natting. Or any other local networks.