wifi vlan guest network
-
Hi,
I try to install wifi guest only on my network isolated from the rest.
i have :
- 192.168.2.0 : work lan (switch port 1, vlan 1)
- 192.168.3.0 : vpn lan (switch port 2, vlan 1)
- 192.168.4.0 : wifi lan (switch port 4, vlan 3000)
my wifi router is mii 4a (there is no vlan settings available).
i try to set the wifi router in extend mode but it say me that "couldn't get ip".
I'm don't know how get out of this mess...
does need use vlan ? set extend mode in my wifi router ?
thanks you !
-
on the interface WIFiGUEST, i set DHCP. so, i set 192.168.4.20 to my wifi router but i can't access it anymore...
WIFIGUEST_DHCP= 100% loss (status is "Offline, Packetloss")can you help me ?
-
@ppe
Not clear, what you intend.192.168.4.0 is your wifiguest network?
@ppe said in wifi vlan guest network:
i try to set the wifi router in extend mode but it say me that "couldn't get ip".
What does the extended mode on the router?
Do you intend, that its whole wifi to be the guest network?
-
@viragomann yes, all wifi is guest
-
@viragomann below, the goal :
-
@viragomann sorry if it is not clear; i don't really of the more pertain solution to choose
-
@ppe
So you can run the wifi as a router. pfSense will only see the routers IP then for all wifi clients connected to it.If you enable the DHCP server in pfSense, I'd expect that the router pulls an IP.
Check out Status > DHCP IPv4 Leases if it is shown up there.I can imagine, however, that the wifi router blocks access to its management interface from outside of its own subnet.
If this is the case, you can circumvent this with an outbound NAT rule.
But first ensure, that it gets an IP from the DHCP. -
@ppe If your tagging with vlan id 3000, its never going to work unless your wifi is setup to understand this tag.
If you want to setup a different network for wifi. Then do that - but you can not use tagging unless your wifi router understands tagging.
You should just use your wifi router as an AP.. turn off its dhcp server and connect it to pfsense port via one of the lan ports on the router. If your wifi router does not have a AP mode.
Good idea to set the IP of the lan interface on your wifi router to be on the network your going to put it on. This 192.168.4/24 network
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/switch-overview.html
-
@ppe said in wifi vlan guest network:
WIFIGUEST_DHCP= 100% loss (status is "Offline, Packetloss")
That looks like you set the WIFIGUEST interface itself to DHCP which is almost certainly not what you want. That should be set as Static, then add a DHCP server on that in Services > DHCP Server.
Steve
-
@ppe said in wifi vlan guest network:
my wifi router is mii 4a (there is no vlan settings available).
You need VLANs and a 2nd SSID if you want a guest WiFi on the same access point.
-
hello, thank you everyone for yours answers !
i change of wifi router for the tp link archer c59.
i set to dynamic ip (so every computers are in 192.168.2.0/24) to get internet and i enable "guest wifi".
But i can access to my servers from guest wifi despite i disable "Allow guests to access my local network"...
it seems to be a bug : https://community.tp-link.com/en/home/forum/topic/575906So, how i can make all devices connected to the 192.168.4.0/24 network in order to be able to block access to the servers using firewall rules ?
Thanks
-
@ppe said in wifi vlan guest network:
i change of wifi router for the tp link archer c59.
How is that connected to pfSense? Is it not via the GuestWIFI interface any longer?
-
@stephenw10 all my wifi router can't offer vlan capabilies. so i remove vlan and the wifiguest because, if i well understand, i can't create interface without vlan on a switch (i'm on a sg 2100).
now, the wan port of my wifi router is wired to the lan port (N°4) of my pf.
-
@ppe said in wifi vlan guest network:
i can't create interface without vlan on a switch (i'm on a sg 2100).
where did you get that idea?? You can for sure create a different network on a port on the 2100 that doesn't need tags.
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/switch-overview.html#port-mode
These four switch ports are customizable and each can be configured to act as an independent switches or in groups.
In Port VLAN Mode, rather than specifying which interfaces are associated to a VLAN, the configuration can specify which physical ports form a switch.
-
Yup that^. You need to put the WiFi on a separate interface so you can filter the traffic.
-
i created a new interface using vlan (because no choice) like this :
- interfaces / vlans / add
- lan
- vlan tag = 3000 (mandatory)
- interfaces / add
i make vlan in port mode :
- Interfaces / Switch / VLANs
- switch port 5
- vlan grp : 4
- port : 4
- members : 5
- switch port 5
- removing port 4 from ports (except port 4) in field members
but i don't know how associate this interface with the switch port 4 ...
- interfaces / vlans / add
-
Use the instructions here to configured LAN4 as a separate interface:
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html -
@stephenw10 i can't use vlan tagged because my wifi router don't recognize vlan
-
The wifi router never sees the VLAN tags. The VLAN is all between pfSense and 2100 on-board switch not external to the 2100.
-
@stephenw10 ok thank, i set 802... vlan
but i have no internet from wifi router. On this, i set static ip : 192.168.4.1 and 192.168.2.1 as gateaway
