What's needed
-
To create a basic setup of
-
Half a dozen vLans (say 2 - 6), which are all separate to each other, but use a shared internet connection.
-
A shared VoIP vLan (64) that any of the vLans can access and has access to the internet.
What rules have to be created? I have them in 'long form' for PF on freeBSD, but not sure what I need to create in pfSense.
-
-
Basically three steps:
-
Setup all interfaces with correct vlans id(don't use id 1)
-
assing ip/netmask on each one
-
create allow/deny rules on interface that traffic begins
Samples:
vlan 10 wants to go to internet, so you create at vlan10 interface a rule to allow internet from vlan10.
vlan 10 dont need to talk to vlan 15, so yoy create at vlan10 interface a rule before internet access to block traffic from vlan10 to vlan15You can also create an alias and include all vlans networks you do not need to intercomunicate and then create rules based on this alias.
-
-
Thanks,
Out of interest, why not a 1? Is that just because I said 2-6 or is there something special about 1?
Also, what rules would you make?
-
Vlan id 1 is already in use by switch.
Start your Setup at id 10.The rules is up to you and the security level you want to reach.
Allow only traffic you will need is a good start point. -
Vlan id 1 is already in use by switch.
By what switch? Nothing wrong with using ID 1 unless pfSense specifically blocks it. ???
-
Vlan id 1 is already in use by switch.
By what switch? Nothing wrong with using ID 1 unless pfSense specifically blocks it. ???
Any switch. You can use ID1 but that is the default vlan when there is no vlan setup. you can start anywhere you like. Even start at 101 if you like.
-
To create a basic setup of
-
Half a dozen vLans (say 2 - 6), which are all separate to each other, but use a shared internet connection.
-
A shared VoIP vLan (64) that any of the vLans can access and has access to the internet.
What rules have to be created? I have them in 'long form' for PF on freeBSD, but not sure what I need to create in pfSense.
2-6 is 5 VLANs, so I will go with 5 VLANs + VoIP VLAN for 6 total.
The following is essentially how I set up my pfSense box for my network. It works well for me.
I have 4 configured VLANs and one default management LAN for the Cisco switches I use.
The following would work well in your case, based on your stated requirements, just skip steps you have already done:Create VLANs in VLAN tab of Assign Interfaces section of the Interface menu
Details depend on the physical layout of your network, but I assume you need to assign all 6 VLANs (2-6, and 64 for VoIP) to the same physical interface on this tab.
Enable, assign, and rename new Opt(N) interfaces
In the first (default) tab of the Assign Interfaces section of pfSense web admin page, add/enable an Opt(ional) interface and assign it to one of the 6 VLANs you created in the VLAN tab earlier. Update the name of the Opt(N) interface to something more useful, like VLAN2, VLAN64, or VoIP. Repeat for all 6 VLANs
Create Firewall Alias for each non-VoIP VLAN:
Alias name: notFromVLANtwo
Alias description: Networks to be inaccessible from VLAN2 by firewall rule
Alias includes “networks”:
<vlan3subnet>(example: 192.168.3.1/24)
<vlan4subnet>(example: 192.168.4.1/24)
<vlan5subnet>(example: 192.168.5.1/24)
<vlan6subnet>(example: 192.168.6.1/24)Alias name: notFromVLANthree
Alias description: Networks to be inaccessible from VLAN3 by firewall rule
Alias includes “networks”:
<vlan2subnet><vlan4subnet><vlan5subnet><vlan6subnet>Alias name: notFromVLANfour
Alias description: Networks to be inaccessible from VLAN4 by firewall rule
Alias includes “networks”:
<vlan2subnet><vlan3subnet><vlan5subnet><vlan6subnet>Alias name: notFromVLANfive
Alias description: Networks to be inaccessible from VLAN5 by firewall rule
Alias includes “networks”:
<vlan2subnet><vlan3subnet><vlan4subnet><vlan6subnet>Alias name: notFromVLANsix
Alias description: Networks to be inaccessible from VLAN6 by firewall rule
Alias includes “networks”:
<vlan2subnet><vlan3subnet><vlan4subnet><vlan5subnet>Create Firewall Rules for each non-VoIP Interface assigned to a VLAN to block access to other non-VoIP VLANs and to allow access to Internet and VoIP VLAN (and allow access to other interfaces present, if any):VLAN2 (in order):
(top rule) Block, any protocol, source VLAN2net, port any, destination unique host or alias: alias ‘notFromVLANtwo’, port any
(bottom rule) Allow any protocol, source VLAN2net, port any, destination any, port anyVLAN3 (in order):
(top rule) Block, any protocol, source VLAN3net, port any, destination unique host or alias: alias ‘notFromVLANthree’, port any
(bottom rule) Allow any protocol, source VLAN3net, port any, destination any, port anyVLAN4 (in order):
(top rule) Block, any protocol, source VLAN4net, port any, destination unique host or alias: alias ‘notFromVLANfour’, port any
(bottom rule) Allow any protocol, source VLAN4net, port any, destination any, port anyVLAN5 (in order):
(top rule) Block, any protocol, source VLAN5net, port any, destination unique host or alias: alias ‘notFromVLANfive’, port any
(bottom rule) Allow any protocol, source VLAN5net, port any, destination any, port anyVLAN6 (in order):
(top rule) Block, any protocol, source VLAN6net, port any, destination unique host or alias: alias ‘notFromVLANsix’, port any
(bottom rule) Allow any protocol, source VLAN6net, port any, destination any, port anyCreate Firewall Rule for VoIP VLAN Interface to allow access to all non-VoIP VLANs and to allow access to Internet (and allow access to other interfaces present, if any):
(only or bottom rule on VoIP VLAN interface) Allow, any protocol, source VoIP-VLANnet, port any, destination any, port any
…Like I said, this is how I have done it and it works well.</vlan5subnet></vlan4subnet></vlan3subnet></vlan2subnet></vlan6subnet></vlan4subnet></vlan3subnet></vlan2subnet></vlan6subnet></vlan5subnet></vlan3subnet></vlan2subnet></vlan6subnet></vlan5subnet></vlan4subnet></vlan2subnet></vlan6subnet></vlan5subnet></vlan4subnet></vlan3subnet>
-
-
Rich,
I'll have a detailed read (and test) later. But, at first glance, your answer seems just what I was looking for. Thank you so much.
My feeling is that, for rules, all I have to do is create a 'get through' so each vLan can get to the VoIP vLan (but not to each other). On top of that, I need to create any one-off rules for remote access to specific IP addresses (or global access) on a vLan.
If I didn't have the VoIP vLan and didn't need any specific rules (for remote access) - then I assume it works 'out of the box' with no further configuration required. Am I right (or am I sounding mad)?
-
Rich had a more detailed read - think I know what to do. Thank you so much.
It's a paid that you have to GUI everything - text editor would be so much quicker (I have 24 vLans!!!!).
Now, just got to get the internet connection to work!
-
You don't have to GUI. You can backup your config, modify it, and then restore it. Course that will cause a reboot, but you can make major additions and changes by copy paste or find and replace. Used that method several times to change internet ips while keeping the same rules.
-
Rich had a more detailed read - think I know what to do. Thank you so much.
It's a paid that you have to GUI everything - text editor would be so much quicker (I have 24 vLans!!!!).
Now, just got to get the internet connection to work!
You are welcome.
Wow, yes that is a lot of GUI work for that many VLANs.
Feel free to PM me is you would like specific assistance or recommendations.
-
You don't have to GUI. You can backup your config, modify it, and then restore it. Course that will cause a reboot, but you can make major additions and changes by copy paste or find and replace. Used that method several times to change internet ips while keeping the same rules.
That is an awesome recommendation. I have a few changes to make for further testing and will give this a try, myself.
Thanks.
-
pod….. is a genius - assuming it works!!
It makes perfect sense - I'm 100% cross with myself for not think of doing that myself (I must be getting old!).
-
Yes, as podilarius say, the easyest way to do some "major" changes is editing the config.XML
You make a bakup of your working config, then create a "copy" of that bakup and edit the "copy" then make the needed changes ( i used it to reasign my interfaces ) save it, then upload (restore) the config to your pfSense, "reboot" and "all" your changes are done.
-
Creating these rules will take a bit of time - technically, there are 64 vLans (1-64) and a LAN and a WAN. Only half a dozen vLans and the VoIP one (which is 64) are in use (I've created everything so far for the full 64 - a bit OTT, I guess!!)
-
I've just had a bit of a worrying thought whilst entering Rich's suggestions.
What I need is for the non VoIP vLans to be secure from access from each other - which he's covered.
I need each vLan to be able to access the VoIP vLan - this also seems covered.
Now the bit that has worried me a bit!! Anyone who is on the VoIP vLan cannot be allowed access to the vLans - this is the bit that, possibly, seems to still be allowed/possible. -
I've just entered it all - but hit a problem.
I have a computer on vLan64 and another on vLan7. They DHCP fine but can't ping each other. I don't want the 64 net to ping the 7, but I need 7 to have access to the 64.
If I run tracert on 10.7.0.101 'TRACERT 10.64.0.100', it gets to 10.7.0.1 as the first step - but it doesn't get any further.
This suggests a major problem - help!!!
-
If I run tracert on 10.7.0.101 'TRACERT 10.64.0.100', it gets to 10.7.0.1 as the first step - but it doesn't get any further.
Have you checked the firewall log (Status -> System Logs, click on the Firewall tab)?
Is 10.64.0.100 configured to respond to tracert?
-
Ahhh
My ping attempts are registering as coming from the WAN rather than vLan3.
I now think I know the problem - just not how to fix it!
-
Maybe it's not blocking my pings - but doing its job? All the entries are IGMPs with a source of the router a destination of 224.0.0.1 (haven't a clue on that) on the interface of wan
