wifi vlan guest network
-
@ppe said in wifi vlan guest network:
i change of wifi router for the tp link archer c59.
How is that connected to pfSense? Is it not via the GuestWIFI interface any longer?
-
@stephenw10 all my wifi router can't offer vlan capabilies. so i remove vlan and the wifiguest because, if i well understand, i can't create interface without vlan on a switch (i'm on a sg 2100).
now, the wan port of my wifi router is wired to the lan port (N°4) of my pf.
-
@ppe said in wifi vlan guest network:
i can't create interface without vlan on a switch (i'm on a sg 2100).
where did you get that idea?? You can for sure create a different network on a port on the 2100 that doesn't need tags.
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/switch-overview.html#port-mode
These four switch ports are customizable and each can be configured to act as an independent switches or in groups.
In Port VLAN Mode, rather than specifying which interfaces are associated to a VLAN, the configuration can specify which physical ports form a switch.
-
Yup that^. You need to put the WiFi on a separate interface so you can filter the traffic.
-
i created a new interface using vlan (because no choice) like this :
- interfaces / vlans / add
- lan
- vlan tag = 3000 (mandatory)
- interfaces / add
i make vlan in port mode :
- Interfaces / Switch / VLANs
- switch port 5
- vlan grp : 4
- port : 4
- members : 5
- switch port 5
- removing port 4 from ports (except port 4) in field members
but i don't know how associate this interface with the switch port 4 ...
- interfaces / vlans / add
-
Use the instructions here to configured LAN4 as a separate interface:
https://docs.netgate.com/pfsense/en/latest/solutions/netgate-2100/configuring-the-switch-ports.html -
@stephenw10 i can't use vlan tagged because my wifi router don't recognize vlan
-
The wifi router never sees the VLAN tags. The VLAN is all between pfSense and 2100 on-board switch not external to the 2100.
-
@stephenw10 ok thank, i set 802... vlan
but i have no internet from wifi router. On this, i set static ip : 192.168.4.1 and 192.168.2.1 as gateaway
-
-
Um...yeah, where did you set that?
Where ever it is the gateway must be in the same subnet as the interface address.
-
@stephenw10 i think i made a mistake. i'm back to "dynamic ip" and my wifi took well an ip from 192.168.4.0/24
but i have no internet... i set a captive portal also, i will check tomorrow what's wrong
-
@ppe there you go, so your client got an IP from the dhcp server on pfsense is a good sign your connected... Now you would create the rules you want on that pfsense inteface to allow or block what you want for clients on this network.
Here is an example set of rules you might put on a guest network.. that allows for internet but not talking to any of your other networks
Creating the rfc1918 alias is helpful, it just contains all the rfc1918 networks 10/8, 192.168/16 and 172.16/12 witch would be normally any other networks you might setup locally.
-
@johnpoz thank for your answer
it works with yours rules (except captive portal) but i have to maintain enable dhcp server of the wifi router.
So, all computers connected to wifi have 192.168.0/24 ip instead of.192.168.4/24..i can't set lan of wifi router to 192.168.4/24 (error message : WAN IP address and LAN IP address cannot be in the same subnet. )
-
@ppe said in wifi vlan guest network:
i can't set lan of wifi router to 192.168.4/24 (error message : WAN IP address and LAN IP address cannot be in the same subnet. )
Your not using it as an AP then your actually still natting.. To use ANY wifi router as just an AP... turn off its dhcp server, connect it to the network via one of its lan ports vs the wan/internet port. Set the lan IP to be on whatever network your connecting it to.
For wifi routers that have a AP mode - all they do is bridge in the wan internet into the lan, so that is just another lan port and there won't be a "wan" IP on it.
As to captive portal - are you trying to do that on the wifi device or pfsense captive portal??
Also about captive portal - I don't get the use case to be honest.. This is your home right? Not some lobby of a business or something.. So you can't give your "guests" a psk to use.. I have a QR code on a card they can scan to auth to the guest network.
Captive portals kind of make sense in a business setup where don't want to put a sign of what the psk is to auth to the wifi, and you also normally want to glean some info from those users.. If you truly just wanted to provide wifi to customers or whatever, why would you just not make it open, etc.
Why do you want a captive portal? What do you get from using that? What is your use case of a captive portal? Are you wanting to charge your guests a fee to use your wifi?
-
Yes you want that wifi router in access point mode. If it doesn't have a specific access point mode then:
https://docs.netgate.com/pfsense/en/latest/recipes/external-wireless-router.html#turning-a-wireless-router-into-an-access-pointSteve
-
hi, I set my wifi router as you suggest : with dhcp server disable and lan/lan connection (i don't wan ports of the wifi routers). And it works :-D !
I'm the IT/network admin of a very little firm (<10 workers). My goal is :
- set a wifi for worker of the company (access to the servers)
- set a wifi for our clients or visitors (not often but could happen)
And, i thought about captive portal for marketing purpose and also just test this technology.
About guest wifi, i change the lan ip from 192.168.0.1 to 192.168.4.2. Since this change, i can't connect to the admin portal.... i don't know why
-
Actually, i can access...
About guest wifi, i can access from 192.168.4.0/24 network but not from 192.168.2.0/24.
How do that ? Or is it possible to set to 192.168.2.3 for example (i think it might be better because, it can't be accessible from guest network) ? -
Ok so you're using this router only for guest wifi yes? Since it doesn't support multiple SSIDs and VLANs.
You are having trouble accessing the webgui on the wifi device?
There's probably no way to prevent i being accessible from the guestwifi subnet. But it should be password protected.
It probably has no route to be able to reply to other subnets so you would need an outbound NAT rule to mask those behind the guestwifi interface address.
-
I have this now :
login-to-viewi have no vlan capability on both wifi routers
i use 1 router wifi by ssid because, it seems more easy (but i think that i have no choice anyway...)
i set fw rules to block access by guests to the servers
but, i don't understand why i can't access to 192.168.4.2 from 192.168.2.0/24 network