How to isolate DHCP clients
-
One more related question: If I want to move a DHCP client from one network to another (i.e. from the "isolated" network on LAN 2 to the "main" network on LAN 1, can I simply statically assign that client (using the pfsense DHCP leases section) an IP address on the "main" network?
-
depends on your switch, if not you just plug it into a port on that network that you want it on.
-
@rsn:
One more related question: If I want to move a DHCP client from one network to another (i.e. from the "isolated" network on LAN 2 to the "main" network on LAN 1, can I simply statically assign that client (using the pfsense DHCP leases section) an IP address on the "main" network?
@XIII:depends on your switch, if not you just plug it into a port on that network that you want it on.
My question was assuming I was not using a VLAN, rather two NICs. Sorry for the confusion.
I'm wondering if pfsense will allow this type of an assignment.
-
you mean if you have a total of 3 nics, wan,lan and opt1/lan2?
yes, i currently do this.
just disable the dhcp server on the nic you have static ips assigned on. do a firewall rule to separate them. -
Yes, 3 NICs. So pfsense will allow me to take a client that has been assigned an IP address by LAN2 and statically assign it an IP on LAN via the DHCP leases static assignment tool?
-
no. networks must be different. cant have 192.168.0.1 on both nics
AFAIK you can not give LAN2 an IP from LAN1 unless they are on the same network by default you would have to disable the anti spoof feature to do this. -
I think there is still a bit of confusion over my question, or perhaps I don't totally understand the reply.
Let me provide an example:
WAN xx.xx.xx.xx
LAN: 192.168.1.0 <- NO DHCP
LAN2: 192.168.50.0 <- DHCP server runninglaptop1 is a DHCP client and is assigned 192.168.50.24 by the DHCP server running on LAN2. I determine that I want to move laptop1 to the LAN network without manually entering in the new IP info on the laptop1 machine itself. So, I would like to go into the DHCP leases portion of the pfsense UI, click the "statically assign" button, and assign it an IP address of 192.168.1.102 (which happens to be on the LAN network). Is this possible? If not, how can I make this workflow happen?
-
yes it is.
I guess I just didnt fully understand the question Sorry about that. -
No problem. I should have provided the example in my first post.
Thanks for the input!
-
If there's no DHCP server running on LAN interface then there can't be any address assignments happening for hosts on LAN by pfSense, you'll have to assign IP address/gateway/dns settings manually on the client.
-
@kpa:
If there's no DHCP server running on LAN interface then there can't be any address assignments happening for hosts on LAN by pfSense, you'll have to assign IP address/gateway/dns settings manually on the client.
yea that is true, forgot about that, I usually assign statics via DHCP, I got confused again. Today is just not my day, at least it is Friday though.
What you would do is enable the DHCP server with a range of the number of devices you would assign static IPs to, that way authorized devices get an ip via DHCP and unauthorized devices cant as there is not any available.
example:
192.168.1.0 with dhcp range of: 192.168.1.2-.15, statically assign those 14 ips to devices and then when a device connects to that network they cant get an ip as all the ips are used up via a static mapping. unless of course they spoof the mac of a statically assigned device then they will get that ip. -
@kpa:
If there's no DHCP server running on LAN interface then there can't be any address assignments happening for hosts on LAN by pfSense, you'll have to assign IP address/gateway/dns settings manually on the client.
yea that is true, forgot about that, I usually assign statics via DHCP, I got confused again. Today is just not my day, at least it is Friday though.
What you would do is enable the DHCP server with a range of the number of devices you would assign static IPs to, that way authorized devices get an ip via DHCP and unauthorized devices cant as there is not any available.
example:
192.168.1.0 with dhcp range of: 192.168.1.2-.15, statically assign those 14 ips to devices and then when a device connects to that network they cant get an ip as all the ips are used up via a static mapping. unless of course they spoof the mac of a statically assigned device then they will get that ip.Do you mean assign these 14 IPs as static via DHCP or manually on the client? Even if this is what you mean, then this does not really solve my problem. I really want all of my devices/hosts to receive IPs via DHCP. However, I want those assigned address via DHCP to be isolated from devices that I have "flagged". In other words, I don't want any device that is assigned an address via DHCP (such as house guests) to be able to even see any machine on my house network unless I "move them over" to the house network. I also don't want my "house network" machines to be DHCP clients, as some of them are mobile devices (in other words they may connect to networks in other physical locations and I don't want to have to continually disable and enable DHCP on these clients. You see what I mean? There must be some way to make this happen - I just don't know how.
-
@rsn:
I don't want any device that is assigned an address via DHCP (such as house guests) to be able to even see any machine on my house network unless I "move them over" to the house network.
Then you need physically separate networks OR a VLAN capable switch with the two groups of devices on separate VLANS.
-
@rsn:
I don't want any device that is assigned an address via DHCP (such as house guests) to be able to even see any machine on my house network unless I "move them over" to the house network.
Then you need physically separate networks OR a VLAN capable switch with the two groups of devices on separate VLANS.
KPA has already said that I cannot "move clients over" from one network to another if the 2nd network is not running a DHCP server. That is the problem I am trying to overcome here.
-
rsn, please re-read wallabybob's answer. Yes, you need a DHCP server on both networks, but to separate your 2 networks you have to make them 2 separate networks, either physically or by using VLANs.
-
Physically separate them as in put them on different switches and not connect the two switches together? If that isn't done then won't having two DHCP servers cause problems? If that IS done then this presents a lot of new challenges.
-
you can have more than 1 dhcp server per network, problems arise if they are not aware of eachother or they are configured to give the same ip address range. Each interface is on a different address scheme and different physical network, so it will be fine. it is seen as 1 dhcp server per network. unless you add rules specifically allow it, each network is unaware of the other. Just physically seperate the networks as you mentioned and enable the dhcp server on each one, and for the one you want static do the static mappings i mentioned previously.
-
you can have more than 1 dhcp server per network, problems arise if they are not aware of eachother or they are configured to give the same ip address range. Each interface is on a different address scheme and different physical network, so it will be fine. it is seen as 1 dhcp server per network. unless you add rules specifically allow it, each network is unaware of the other. Just physically seperate the networks as you mentioned and enable the dhcp server on each one, and for the one you want static do the static mappings i mentioned previously.
Just want to be clear: do I actually need to separate the networks by putting them on different switches that are not connected to each other?
-
I'll elaborate on some of the previous replies.
You have a number of computers you want to be able to access the internet through a pfSense box. The computers fall into two categories: a "trusted" group and an "untrusted" group. For the sake of illustration we'll say you want to deny access to the trusted group from the untrusted group and deny access to the untrusted group from the trusted group.
Configure all computers to get their IP address, default gateway and DNS by DHCP.
Connect all the "trusted" computers to the LAN port of a pfSense box through a switch. On pfSense configure the LAN interface with an IP address in the private IP address range (e.g. 192.168.11.0/24). Enable DHCP on the LAN interface, giving DHCP a subset of the addresses in the LAN network (192.168.11.0/24).
On pfSense configure OPT1 with a private IP address (say 192.168.21.1/24). Enable DHCP on OPT1 giving DHCP a subset of the addresses in the OPT1 network (192.168.21.0/24).
To deny access from LAN to OPT1 add a firewall rule to the LAN interface to block access to the OPT1 network (destination address in 192.168.21.0/24) but specify OPT1 network rather than IP address and network mask so if you change OPT1's IP address or netmask the rule will automatically adapt (restart might be required).
To deny access from OPT1 to LAN add a firewall rule to the OPT1 interface to block access to the LAN network.
By default LAN will have firewall rules to allow access to the internet but OPT1 won't so you will need to add firewall rules to OPT1 to allow internet access. If you take all your private IP address from the 192.168.0.0/16 bank you could use a firewall rule to allow access to destination IP address NOT 192.168.0.0/16.
Connect a switch to LAN and a switch to OPT1, connect "trusted" computers to switch connected to LAN and "untrusted" computers to switch connected to OPT1 and you should be all ready to go.
@rsn:
Just want to be clear: do I actually need to separate the networks by putting them on different switches that are not connected to each other?
Despite a number of respondents advising you that you need to separate the networks you seem to want to connect the switches together. Maybe we are missing something about your requirements or you don't understand something about the way things work. Here's why you shouldn't connect the switches together if you want to keep the networks invisible to each other: Some network services involve the use of broadcast packets. Switches have to forward broadcast packets to all ports. If you connect the two switches together then all computers will see all broadcast packets hence a computer can discover at least the MAC address of computers on the other switch.
As suggested in a number of earlier replies, if you have a VLAN capable switch and at least one VLAN capable NIC on your pfSense box then you can have one physical switch (instead of two) provided the switch is appropriately configured.
You mentioned a requirement to be able to move computers between the groups. If you have two physical switches you move a computer from one group to another by changing the switch it is connected to. (Maybe it would be useful to have a patch panel.) On a VLAN capable switch you can move computers between groups by changing the VLAN the corresponding port belongs to.
-
I'll elaborate on some of the previous replies.
You have a number of computers you want to be able to access the internet through a pfSense box. The computers fall into two categories: a "trusted" group and an "untrusted" group. For the sake of illustration we'll say you want to deny access to the trusted group from the untrusted group and deny access to the untrusted group from the trusted group.
Configure all computers to get their IP address, default gateway and DNS by DHCP.
Connect all the "trusted" computers to the LAN port of a pfSense box through a switch. On pfSense configure the LAN interface with an IP address in the private IP address range (e.g. 192.168.11.0/24). Enable DHCP on the LAN interface, giving DHCP a subset of the addresses in the LAN network (192.168.11.0/24).
On pfSense configure OPT1 with a private IP address (say 192.168.21.1/24). Enable DHCP on OPT1 giving DHCP a subset of the addresses in the OPT1 network (192.168.21.0/24).
To deny access from LAN to OPT1 add a firewall rule to the LAN interface to block access to the OPT1 network (destination address in 192.168.21.0/24) but specify OPT1 network rather than IP address and network mask so if you change OPT1's IP address or netmask the rule will automatically adapt (restart might be required).
To deny access from OPT1 to LAN add a firewall rule to the OPT1 interface to block access to the LAN network.
By default LAN will have firewall rules to allow access to the internet but OPT1 won't so you will need to add firewall rules to OPT1 to allow internet access. If you take all your private IP address from the 192.168.0.0/16 bank you could use a firewall rule to allow access to destination IP address NOT 192.168.0.0/16.
Connect a switch to LAN and a switch to OPT1, connect "trusted" computers to switch connected to LAN and "untrusted" computers to switch connected to OPT1 and you should be all ready to go.
@rsn:
Just want to be clear: do I actually need to separate the networks by putting them on different switches that are not connected to each other?
Despite a number of respondents advising you that you need to separate the networks you seem to want to connect the switches together. Maybe we are missing something about your requirements or you don't understand something about the way things work. Here's why you shouldn't connect the switches together if you want to keep the networks invisible to each other: Some network services involve the use of broadcast packets. Switches have to forward broadcast packets to all ports. If you connect the two switches together then all computers will see all broadcast packets hence a computer can discover at least the MAC address of computers on the other switch.
As suggested in a number of earlier replies, if you have a VLAN capable switch and at least one VLAN capable NIC on your pfSense box then you can have one physical switch (instead of two) provided the switch is appropriately configured.
You mentioned a requirement to be able to move computers between the groups. If you have two physical switches you move a computer from one group to another by changing the switch it is connected to. (Maybe it would be useful to have a patch panel.) On a VLAN capable switch you can move computers between groups by changing the VLAN the corresponding port belongs to.
Thanks for this info. Requiring that each network run on a separate, isolated switch (or separate VLANs on the same switch) is not ideal and is a bit confining. I do have a patch panel, but there is not necessarily a 1:1 ratio between patch panel ports and devices. So, this will work fine is there is a 1:1 ratio or if all devices represented by a particular patch panel port are in one group or the other ("untrusted" or "trusted"). This is not necessarily the case though. I was really hoping that there was another way to do this without having to be conscious of what port a particular device is plugged in to.
I'd also like to mention that I am aware of the broadcast packets you speak of: ARP packets. I guess I'm hoping there is some way to restrict these packets to one network or another without physically separating them.
