wifi vlan guest network
-
@ppe
So you can run the wifi as a router. pfSense will only see the routers IP then for all wifi clients connected to it.If you enable the DHCP server in pfSense, I'd expect that the router pulls an IP.
Check out Status > DHCP IPv4 Leases if it is shown up there.I can imagine, however, that the wifi router blocks access to its management interface from outside of its own subnet.
If this is the case, you can circumvent this with an outbound NAT rule.
But first ensure, that it gets an IP from the DHCP. -
@ppe If your tagging with vlan id 3000, its never going to work unless your wifi is setup to understand this tag.
If you want to setup a different network for wifi. Then do that - but you can not use tagging unless your wifi router understands tagging.
You should just use your wifi router as an AP.. turn off its dhcp server and connect it to pfsense port via one of the lan ports on the router. If your wifi router does not have a AP mode.
Good idea to set the IP of the lan interface on your wifi router to be on the network your going to put it on. This 192.168.4/24 network
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/switch-overview.html
-
@ppe said in wifi vlan guest network:
WIFIGUEST_DHCP= 100% loss (status is "Offline, Packetloss")
That looks like you set the WIFIGUEST interface itself to DHCP which is almost certainly not what you want. That should be set as Static, then add a DHCP server on that in Services > DHCP Server.
Steve
-
@ppe said in wifi vlan guest network:
my wifi router is mii 4a (there is no vlan settings available).
You need VLANs and a 2nd SSID if you want a guest WiFi on the same access point.
-
hello, thank you everyone for yours answers !
i change of wifi router for the tp link archer c59.
i set to dynamic ip (so every computers are in 192.168.2.0/24) to get internet and i enable "guest wifi".
But i can access to my servers from guest wifi despite i disable "Allow guests to access my local network"...
it seems to be a bug : https://community.tp-link.com/en/home/forum/topic/575906So, how i can make all devices connected to the 192.168.4.0/24 network in order to be able to block access to the servers using firewall rules ?
Thanks
-
@ppe said in wifi vlan guest network:
i change of wifi router for the tp link archer c59.
How is that connected to pfSense? Is it not via the GuestWIFI interface any longer?
-
@stephenw10 all my wifi router can't offer vlan capabilies. so i remove vlan and the wifiguest because, if i well understand, i can't create interface without vlan on a switch (i'm on a sg 2100).
now, the wan port of my wifi router is wired to the lan port (N°4) of my pf.
-
@ppe said in wifi vlan guest network:
i can't create interface without vlan on a switch (i'm on a sg 2100).
where did you get that idea?? You can for sure create a different network on a port on the 2100 that doesn't need tags.
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/switch-overview.html#port-mode
These four switch ports are customizable and each can be configured to act as an independent switches or in groups.
In Port VLAN Mode, rather than specifying which interfaces are associated to a VLAN, the configuration can specify which physical ports form a switch.
-
Yup that^. You need to put the WiFi on a separate interface so you can filter the traffic.
-
i created a new interface using vlan (because no choice) like this :
- interfaces / vlans / add
- lan
- vlan tag = 3000 (mandatory)
- interfaces / add
i make vlan in port mode :
- Interfaces / Switch / VLANs
- switch port 5
- vlan grp : 4
- port : 4
- members : 5
- switch port 5
- removing port 4 from ports (except port 4) in field members
but i don't know how associate this interface with the switch port 4 ...
- interfaces / vlans / add
-
Use the instructions here to configured LAN4 as a separate interface:
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html -
@stephenw10 i can't use vlan tagged because my wifi router don't recognize vlan
-
The wifi router never sees the VLAN tags. The VLAN is all between pfSense and 2100 on-board switch not external to the 2100.
-
@stephenw10 ok thank, i set 802... vlan
but i have no internet from wifi router. On this, i set static ip : 192.168.4.1 and 192.168.2.1 as gateaway
-
-
Um...yeah, where did you set that?
Where ever it is the gateway must be in the same subnet as the interface address.
-
@stephenw10 i think i made a mistake. i'm back to "dynamic ip" and my wifi took well an ip from 192.168.4.0/24
but i have no internet... i set a captive portal also, i will check tomorrow what's wrong
-
@ppe there you go, so your client got an IP from the dhcp server on pfsense is a good sign your connected... Now you would create the rules you want on that pfsense inteface to allow or block what you want for clients on this network.
Here is an example set of rules you might put on a guest network.. that allows for internet but not talking to any of your other networks
Creating the rfc1918 alias is helpful, it just contains all the rfc1918 networks 10/8, 192.168/16 and 172.16/12 witch would be normally any other networks you might setup locally.
-
@johnpoz thank for your answer
it works with yours rules (except captive portal) but i have to maintain enable dhcp server of the wifi router.
So, all computers connected to wifi have 192.168.0/24 ip instead of.192.168.4/24..i can't set lan of wifi router to 192.168.4/24 (error message : WAN IP address and LAN IP address cannot be in the same subnet. )
-
@ppe said in wifi vlan guest network:
i can't set lan of wifi router to 192.168.4/24 (error message : WAN IP address and LAN IP address cannot be in the same subnet. )
Your not using it as an AP then your actually still natting.. To use ANY wifi router as just an AP... turn off its dhcp server, connect it to the network via one of its lan ports vs the wan/internet port. Set the lan IP to be on whatever network your connecting it to.
For wifi routers that have a AP mode - all they do is bridge in the wan internet into the lan, so that is just another lan port and there won't be a "wan" IP on it.
As to captive portal - are you trying to do that on the wifi device or pfsense captive portal??
Also about captive portal - I don't get the use case to be honest.. This is your home right? Not some lobby of a business or something.. So you can't give your "guests" a psk to use.. I have a QR code on a card they can scan to auth to the guest network.
Captive portals kind of make sense in a business setup where don't want to put a sign of what the psk is to auth to the wifi, and you also normally want to glean some info from those users.. If you truly just wanted to provide wifi to customers or whatever, why would you just not make it open, etc.
Why do you want a captive portal? What do you get from using that? What is your use case of a captive portal? Are you wanting to charge your guests a fee to use your wifi?
