Not able to block PING to an AP

neobauer

Ohh ok I see, except I create a Subnet just with two hosts possible :)
There were are discussing about, is there a way on Psense to force the clients to retrieve their IPs over the DHCP sothat no one can add manually an IP?

GruensFroeschli

That's not possible in networking.
You can not control the computer of anyone connecting to your wireless network.

Derelict

There are switches that can snoop DHCP and will drop traffic from any IPs not leased from a trusted DHCP server.

Everything OP is talking about is better accomplished at layer 2 (ie not in pfSense).

johnpoz

are you wanting to stop people from the wired network the ap is connected to or the wireless network if they connect to the AP wireless network? With a real AP the management interface would be on different network that the wireless ssids. Be it the management is the native vlan without tagging, and ssids tagged or with management and ssids all in their own tagged vlans.

This would allow you to prevent access to the AP management interface be it a gui, ssh, ping etc..

From the wired side nobody should be able to access this wired network that would not be authed either with 802.1x or just physical security to the network were no ports on that network are in open areas, etc.

neobauer

Thanks,
but you are talking about a "a real AP the management interface".
For now, I'm just using a self-made-AP with Raspiberry. Also I'm not familar with creating VLANs within Pfsense. can someone guide me please ?

johnpoz

your AP is a raspberryPI? What wireless did you connect to it? What OS are you running? Why would you do that? When you could use any wireless router as an AP. They can be had for 20$ that I would have to assume would blow away the usb wireless that you could add to a raspberryPI box..

I can understand not having the budget/money for an enterprise class AP.. Can your home made pi AP do vlans, what OS is is running Raspbian, Pidora, Risc, Arch, other??

Enable firewall and block it on the AP would be your other option.

neobauer

Yes RaspberryPI. It's for home and also for a miniproject at the school. So we need to do it byself :)
Raspbian is running on.
So you mean create rules in Raspbian right ? I though also about it, but I don't which rule to write or which rule will correspond to that ? Meaning blocking Pings etc.. to the AP. on this Raspi, I have also apache server.

johnpoz

here is simple guide on setting up firewall on raspbian

http://www.heystephenwood.com/2013/06/setting-up-firewall-on-your-raspberry-pi.html

Setup rule to only allow your management IP to ping (icmp) to ssh and if your serving up the gui for the AP in apache then block all but your IP, etc.

AIMS-Informatique

A good login/Pass on the AP would do the trick ? :)

Seriously, while in the same subnet (thus not firewalled) everything happens locally into that subnet. You should protect your AP with its built-in options : AN option like "block admin / management from Wireless side" "Block wireless management" often populate APs for that reason.

And yes, you should concider a dedicated subnet for your WLAN subnet. Do not bridge it if you want to use PFSense features.

neobauer

Hi Guys,Thanks for your advice !