MAC Binding with IP in pfsense 2.0

turiyain · Sep 17, 2011, 11:59 AM

dhcp static reservations and user privileges so low, that they can't change ip-addresses manually.

Thanks for giving candle light. I was searching this facility for a long time. My users are student & wi-fi connected. It is not possible for me to make these setting on (Admin or Normal User Privileges). Kindly explain in detail or any URL.

Metu69salemi · Sep 17, 2011, 3:48 PM

Okay now it's time to ask, what benefit students get when they change ip-address

turiyain · Sep 18, 2011, 6:29 AM

@Metu69salemi:

Okay now it's time to ask, what benefit students get when they change ip-address

The are stealing some IPs which are having all access facility.

Using pfSense 2.0 RC

Metu69salemi · Sep 18, 2011, 2:47 PM

and you have no possibilities to use vlans or something else to this access handling?

turiyain · Sep 18, 2011, 4:31 PM

@Metu69salemi:

and you have no possibilities to use vlans or something else to this access handling?

I have read in forum that VLAN is not possible in pfsense 2.0 RC without Layer 2/3 Switch. It is true or is there any possibility. If yes then how ?

Thanks in advance.

Metu69salemi · Sep 18, 2011, 7:22 PM

vlan does require managed switches.
Do you have multiple interfaces on that firewall itself?

cmb · Sep 19, 2011, 5:52 AM

@turiyain:

I have read in forum that VLAN is not possible in pfsense 2.0 RC without Layer 2/3 Switch. It is true or is there any possibility. If yes then how ?

That's true of every product in the world, VLANs require managed switches. You can't have any good control over your network without having managed switches anyway, if people are smart enough to change their IPs, they're almost certainly smart enough to change their IPs and MACs. It's impossible to prevent that with an unmanaged switch, and that has to be controlled at the switch level. Moving such things to VLANs is an absolute requirement to properly protect against that and other mischief, everything on the broadcast domain accessible by untrusted users has to be separate.

turiyain · Sep 20, 2011, 1:25 PM

@Metu69salemi:

vlan does require managed switches.
Do you have multiple interfaces on that firewall itself?

I have 1 NIC for LAN and 1 NIC for WAN only

turiyain · Sep 20, 2011, 1:34 PM

Thanks for detailed information. In nutshell, I want to know that how can i make and use VLAN in pfSence. What will be the requirement. Kindly help me.

@cmb:

@turiyain:

I have read in forum that VLAN is not possible in pfsense 2.0 RC without Layer 2/3 Switch. It is true or is there any possibility. If yes then how ?

That's true of every product in the world, VLANs require managed switches. You can't have any good control over your network without having managed switches anyway, if people are smart enough to change their IPs, they're almost certainly smart enough to change their IPs and MACs. It's impossible to prevent that with an unmanaged switch, and that has to be controlled at the switch level. Moving such things to VLANs is an absolute requirement to properly protect against that and other mischief, everything on the broadcast domain accessible by untrusted users has to be separate.

Metu69salemi · Sep 20, 2011, 6:54 PM

Vlans can be added to pfsense via interface assign, but you can't use those securely without manageable dot1q capable switch

turiyain · Sep 21, 2011, 6:01 AM

@Metu69salemi:

Vlans can be added to pfsense via interface assign, but you can't use those securely without manageable dot1q capable switch

How can i implement this in pfsense 2.0 RC 3. I have followed this steps:

(1) Added VLAN
(2) Assign Interfaces
(3) Give IP pool to VLAN Interfaces.

From Firewall LAN Port Cable inserted in 24 Port Switch. From switch my desktop is connected. When i give i IP to a Desktop, it is pinging to its pool other system but not going to internet. and not ping to its pools gateway. Indicate where i am wrong.

Metu69salemi · Sep 22, 2011, 8:27 AM

Have you setted up vlans also in that switch?
i didn't notice, that you've done firewall rules to allow access to internet or anywhere else

turiyain · Sep 22, 2011, 2:06 PM

@Metu69salemi:

Have you setted up vlans also in that switch?
i didn't notice, that you've done firewall rules to allow access to internet or anywhere else

Sorry, I have done all setup at firewall level. But i do not know how to do it at switch level. At switch level, things are not clear for me. What type of switch is required. Can i use a simple cheap switch for this testing.

Kindly guide in detail.

With Regards

Metu69salemi · Sep 22, 2011, 8:02 PM

unmanaged no way, managed only if it support IEEE802.1Q vlan tagging

turiyain · Sep 24, 2011, 3:53 AM

@Metu69salemi:

unmanaged no way, managed only if it support IEEE802.1Q vlan tagging

Will you suggest me available cheap brands & Model of switch with having this facility.

wallabybob · Sep 24, 2011, 4:31 AM

I'm happy with my HP/Procurve 1700-8 (7x 10/100 ports, 1x10/100/1000 port). Other cheap VLAN capable switches I know of (but no experience with) are Mikrotik RB250GS (5 x 10/100/1000 ports), TP-Link TL-SL2210WEB (8 x 10/100 ports, 1 x 10/100/1000 port, 1 SPF port).