Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    wifi vlan guest network

    Wireless
    5
    32
    1.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @ppe
      last edited by

      @ppe If your tagging with vlan id 3000, its never going to work unless your wifi is setup to understand this tag.

      If you want to setup a different network for wifi. Then do that - but you can not use tagging unless your wifi router understands tagging.

      You should just use your wifi router as an AP.. turn off its dhcp server and connect it to pfsense port via one of the lan ports on the router. If your wifi router does not have a AP mode.

      Good idea to set the IP of the lan interface on your wifi router to be on the network your going to put it on. This 192.168.4/24 network

      https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/switch-overview.html

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator @ppe
        last edited by

        @ppe said in wifi vlan guest network:

        WIFIGUEST_DHCP= 100% loss (status is "Offline, Packetloss")

        That looks like you set the WIFIGUEST interface itself to DHCP which is almost certainly not what you want. That should be set as Static, then add a DHCP server on that in Services > DHCP Server.

        Steve

        1 Reply Last reply Reply Quote 1
        • JKnottJ
          JKnott @ppe
          last edited by

          @ppe said in wifi vlan guest network:

          my wifi router is mii 4a (there is no vlan settings available).

          You need VLANs and a 2nd SSID if you want a guest WiFi on the same access point.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          1 Reply Last reply Reply Quote 0
          • P
            ppe
            last edited by

            hello, thank you everyone for yours answers !

            i change of wifi router for the tp link archer c59.

            i set to dynamic ip (so every computers are in 192.168.2.0/24) to get internet and i enable "guest wifi".

            But i can access to my servers from guest wifi despite i disable "Allow guests to access my local network"...
            it seems to be a bug : https://community.tp-link.com/en/home/forum/topic/575906

            So, how i can make all devices connected to the 192.168.4.0/24 network in order to be able to block access to the servers using firewall rules ?

            Thanks

            stephenw10S 1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator @ppe
              last edited by

              @ppe said in wifi vlan guest network:

              i change of wifi router for the tp link archer c59.

              How is that connected to pfSense? Is it not via the GuestWIFI interface any longer?

              P 1 Reply Last reply Reply Quote 0
              • P
                ppe @stephenw10
                last edited by ppe

                @stephenw10 all my wifi router can't offer vlan capabilies. so i remove vlan and the wifiguest because, if i well understand, i can't create interface without vlan on a switch (i'm on a sg 2100).

                now, the wan port of my wifi router is wired to the lan port (N°4) of my pf.

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @ppe
                  last edited by

                  @ppe said in wifi vlan guest network:

                  i can't create interface without vlan on a switch (i'm on a sg 2100).

                  where did you get that idea?? You can for sure create a different network on a port on the 2100 that doesn't need tags.

                  https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/switch-overview.html#port-mode

                  These four switch ports are customizable and each can be configured to act as an independent switches or in groups.

                  In Port VLAN Mode, rather than specifying which interfaces are associated to a VLAN, the configuration can specify which physical ports form a switch.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 1
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Yup that^. You need to put the WiFi on a separate interface so you can filter the traffic.

                    1 Reply Last reply Reply Quote 0
                    • P
                      ppe
                      last edited by

                      i created a new interface using vlan (because no choice) like this :

                      • interfaces / vlans / add
                        • lan
                        • vlan tag = 3000 (mandatory)
                      • interfaces / add

                      i make vlan in port mode :

                      • Interfaces / Switch / VLANs
                        • switch port 5
                          • vlan grp : 4
                          • port : 4
                          • members : 5
                      • removing port 4 from ports (except port 4) in field members

                      but i don't know how associate this interface with the switch port 4 ...

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Use the instructions here to configured LAN4 as a separate interface:
                        https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html

                        P 1 Reply Last reply Reply Quote 0
                        • P
                          ppe @stephenw10
                          last edited by

                          @stephenw10 i can't use vlan tagged because my wifi router don't recognize vlan

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            The wifi router never sees the VLAN tags. The VLAN is all between pfSense and 2100 on-board switch not external to the 2100.

                            P 1 Reply Last reply Reply Quote 0
                            • P
                              ppe @stephenw10
                              last edited by

                              @stephenw10 ok thank, i set 802... vlan

                              but i have no internet from wifi router. On this, i set static ip : 192.168.4.1 and 192.168.2.1 as gateaway

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @ppe
                                last edited by

                                @ppe said in wifi vlan guest network:

                                192.168.4.1 and 192.168.2.1 as gateaway

                                what?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Um...yeah, where did you set that?

                                  Where ever it is the gateway must be in the same subnet as the interface address.

                                  P 1 Reply Last reply Reply Quote 0
                                  • P
                                    ppe @stephenw10
                                    last edited by ppe

                                    @stephenw10 i think i made a mistake. i'm back to "dynamic ip" and my wifi took well an ip from 192.168.4.0/24

                                    but i have no internet... i set a captive portal also, i will check tomorrow what's wrong

                                    johnpozJ 1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @ppe
                                      last edited by johnpoz

                                      @ppe there you go, so your client got an IP from the dhcp server on pfsense is a good sign your connected... Now you would create the rules you want on that pfsense inteface to allow or block what you want for clients on this network.

                                      Here is an example set of rules you might put on a guest network.. that allows for internet but not talking to any of your other networks

                                      example.jpg

                                      Creating the rfc1918 alias is helpful, it just contains all the rfc1918 networks 10/8, 192.168/16 and 172.16/12 witch would be normally any other networks you might setup locally.

                                      alias.jpg

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                      P 1 Reply Last reply Reply Quote 1
                                      • P
                                        ppe @johnpoz
                                        last edited by ppe

                                        @johnpoz thank for your answer

                                        it works with yours rules (except captive portal) but i have to maintain enable dhcp server of the wifi router.
                                        So, all computers connected to wifi have 192.168.0/24 ip instead of.192.168.4/24..

                                        i can't set lan of wifi router to 192.168.4/24 (error message : WAN IP address and LAN IP address cannot be in the same subnet. )

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @ppe
                                          last edited by johnpoz

                                          @ppe said in wifi vlan guest network:

                                          i can't set lan of wifi router to 192.168.4/24 (error message : WAN IP address and LAN IP address cannot be in the same subnet. )

                                          Your not using it as an AP then your actually still natting.. To use ANY wifi router as just an AP... turn off its dhcp server, connect it to the network via one of its lan ports vs the wan/internet port. Set the lan IP to be on whatever network your connecting it to.

                                          For wifi routers that have a AP mode - all they do is bridge in the wan internet into the lan, so that is just another lan port and there won't be a "wan" IP on it.

                                          As to captive portal - are you trying to do that on the wifi device or pfsense captive portal??

                                          Also about captive portal - I don't get the use case to be honest.. This is your home right? Not some lobby of a business or something.. So you can't give your "guests" a psk to use.. I have a QR code on a card they can scan to auth to the guest network.

                                          Captive portals kind of make sense in a business setup where don't want to put a sign of what the psk is to auth to the wifi, and you also normally want to glean some info from those users.. If you truly just wanted to provide wifi to customers or whatever, why would you just not make it open, etc.

                                          Why do you want a captive portal? What do you get from using that? What is your use case of a captive portal? Are you wanting to charge your guests a fee to use your wifi?

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Yes you want that wifi router in access point mode. If it doesn't have a specific access point mode then:
                                            https://docs.netgate.com/pfsense/en/latest/recipes/external-wireless-router.html#turning-a-wireless-router-into-an-access-point

                                            Steve

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.