New to pfSense, and need advice on configuration settings.
-
What speed is your WAN connection with Talktalk?
You will need to run some traffic shaping to prioritise LAN1 traffic over LAN2. Not too difficult. You will need to setup Squid and Squidguard (or similar) to filter the traffic on LAN2. Your hardware may be pushed to do that, depending on your bandwidth.
Also will you require a greater bandwidth between the two LANs at all? I see you want them isolated (also easy to acheive) but if you ever want to move a large file between them that would have to be routed through your pfSense box and that will limit it. It won't be able to push 1Gpbs for example.Steve
-
Thanks for the replies guys, much appreciated, my responses to you are at the bottom.
Ok, so far I have finally managed to install pfSense onto the machine, to find that one of the nics is either faulty or not supported by pfSense, but that's not really an issue at the moment, it still leaves me with 2 nics and the onboard interface.
I had made several to attempts to configure pfsense to run without success. To be fair I was mainly using the "trial and error" route, which is fine by me, as it's the best way to learn, but eventually I have managed to get a system running, with just one of the old wireless routers. I still have more to do to get the system running both routers and ultimately 2 separate networks.
The set up as it stands:
Modem
|
|
WAN interface (fxp0 ((default ISP gateway)
|
|
pfsense
|
|
LAN interface (dc0 (10.0.0.1/8)) DHCP enabled (range 10.0.0.10 - 10.0.0.100)
|
|
WAN port Router1 –-- LAN (192.168.2.1) DHCP enabled.Oh, and if it makes any difference, I have disabled the firewall and NAT on the Router1, because I want pfSense to handle that side of things.
This works brilliantly. I get very good internet access, I am able to access the webGUI's of pfsense and Router1 from a machine attached to Router1 either by ethernet cable or wireless and I can communicate with other machines attached to Router1
I don't know if anything is actually wrong with this configuration, but like I said, it works brilliantly.
Now, here comes the part where I need advice.
I tried to configure OPT1 (rl0) to work as a second LAN to connect Router2, but It caused problems. As soon as I had finishing the assignment and clicked apply changes, I got booted out of the webGUI and was unable to log back in. The only way to restore it to a previous state, was to remove the assigned IP from the card through the DOS configurator. This returned me back to a state where I could access the webGUI via 10.0.0.1.
What I had done. was to apply the same configuration to OPT1 as I had to LAN, but under the subnet 10.0.10.1/9.... so I guess by doing this I caused a conflict.
So, I have spent many hours trying to find a solution to this on these forums and google, but I couldn't find anything that seemed to fit the bill. Bearing in mind that I am trying to create 2 separate networks, that can not communicate with each other.
vlan lets you isolate devices on a network, but if you plan to use vlan make sure your devices support it, powerline adapters often dont and some routers dont either.
hth.
I have absolutely no intention of using PL adapters… I have some and they are useless in this house ;D
I am trying to stay away from VLANs if I can help it, but if that is my only option then so be it ;)What speed is your WAN connection with Talktalk?
You will need to run some traffic shaping to prioritise LAN1 traffic over LAN2. Not too difficult. You will need to setup Squid and Squidguard (or similar) to filter the traffic on LAN2. Your hardware may be pushed to do that, depending on your bandwidth.
Also will you require a greater bandwidth between the two LANs at all? I see you want them isolated (also easy to acheive) but if you ever want to move a large file between them that would have to be routed through your pfSense box and that will limit it. It won't be able to push 1Gpbs for example.Steve
With my package my speed was supposed to be 14Mb but was varying between 8Mb and 13Mb, but recently has been more consistently around 15Mb, and last night when I tested it through the pfsense set up, I got 18Mb :o
-
Ok. Your issue with adding the second 'lan' adapter is, as you guessed, a subnet conflict.
Your LAN interface is using 10.0.0.1/8 which is a huge subnet, everything from 10.0.0.0 to 10.255.255.255. You almost certainly don't need that! ;)
When you added your second NIC you gave it the address 10.0.10.1/9 which is inside the LAN subnet and also huge.
Try using, for example, 10.0.1.1/24 for LAN and 10.0.2.1/24 for OPT1.Once you have doen that you'll find you have no access from the OPT1 subnet. Only the LAN interface is 'ready to go' by default. You need to enable DHCP on OPT1 in Services: DHCP Server: and then add firewall rules to allow out traffic in Firewall: Rules: OPT1: Check the LAN rules for inspiration.
When you said you had a fibre connection I was imagining +100Mbps. Your P4 should have no problems with 18Mbps.
Is your WAN using PPPoE from the pfSense box?
Steve
-
Thank you Stephen, that bit of subnet info worked a treat :D
Within half an hour of me posting I realised exactly what I had done wrong, but couldn't work out the best way to correct it, but as soon as I read your reply, I was on it.
Initially, I could only access internet on the LAN based network, the OPT1 was blocking internet access, but I realised that the firewall was not set up, effectively blocking the internet. I have set the rules as per the rules that are automatically applied LAN, but I dare say that I am going to have apply more rules to both LAN and OPT1, but just or the moment I'm leaving everything as is for a few days just to test the system.
I haven't set traffic shaping yet either.It does appear to have improved the QoS already, even though I haven't set traffic shaping yet.
One more question that I have, is regarding my fallback service. If the pfsense box should fail, then I will be reconnecting to the previous network. The router for this is still in situ and transmitting SSID even though it doesn't have a wan connection and all of our devices are now connected to the new networks. All devices still have the settings saved for this network, so it's just a case of selecting the network and connecting, but obviously the router will not be connected to the modem, this will have to be done manually, but is there a device that I can connect the incoming wan from the modem to, that will automatically detect that my preferred router (pfsense) is not working, and route the wan to the back up router?
-
The correct way to do this, if you need this sort of uptime, is to use a pair of pfSense boxes in a CARP setup.
https://doc.pfsense.org/index.php/Configuring_pfSense_Hardware_Redundancy_(CARP)
That's probably beyond what you're looking for!It is possible to do what you're describing by using a LAN-bypass NIC. The NIC has two Ethernet ports that usually appear as two separate interfaces to pfSense but if the power fails the ports connect together bypassing the pfSense box. It can also be configured to go into bypass mode if the OS crashes using a watchdog timer but that requires some interaction with the OS.
Generally speaking bypass cards are more trouble than they're worth. If you search the forum you'll just find people trying to disable the by-pass mode.Steve
-
Hmmm, maybe I will just leave as is, and manually reconnect the wan, doesn't seem worth the hassle lol.
Oh well, now it's time for me start thinking about firewall rules… see how many hurdles I have to jump this time hahaJust want to say a big thanks for your prompt replies, your information has been very helpful ;)
-
I was just re-reading this thread, and noticed this question that you asked me:
Is your WAN using PPPoE from the pfSense box?
Steve
Sorry, I don't know how I missed it :-[
Anyhow, no, the WAN is using DHCP as I was under the impression that this is the protocol used by talktalk. If anybody can prove me wrong please let me know. However, I have not had any issues so far.
-
If the two choices are DHCP and PPPoE and one side is incorrect the link won't come up at all.
-
It was the wrong question anyway. What I should have asked was, does your pfSense WAN interface have a public IP? In other words is your modem acting as just a modem or is it routing and NATing which is much less desirable.
Steve
-
Hi Steve,
In all honesty, I don't know, how would I find this out?
Thanks
-
Look at the IPv4 address for WAN in status->interfaces. Go to a web page like www.wimi.com. Are the addresses the same?
-
Look at the IPv4 address for WAN in status->interfaces. Go to a web page like www.wimi.com. Are the addresses the same?
Yes, the addresses do match.
-
That's fine then. I was originally asking because it may have conflicted with the LAN subnet but that's not the case.
Steve
-
That's great, thanks guys ;)