Router only, no internet on OPT1
-
Okay,
What we have now is a network with layer 2 switches with vlans for wifi with a gateway of 192.168.5.253 which is the IP of the smoothwall UTMb
The smoothwall UTM does intervlan routing with zone bridging as well as radius and DHCP. We also use a raspberry pi to route MDns trafficWe plan on swapping out the Smoothwall for maybe a Lightspeed rocket or a IBoss filtering system (these are both inline) neither of these boxes can do routing nor radius etc.
Options are to replace Smoothwall with a layer 3 switch which goes to the lightspeed / Iboss then to a pfsense firewall. However we cannot afford a layer 3 switch so I came up with the genius idea of using a pfsense as a router - maybe this was a bad idea - might just be better off getting a HP 1920-8G
I'm having to try all this side by side on a live system as we have no hardware for a lab - making it harder than it should be
-
layer 3 switches don't have to be 1000's of dollars. But you still would have the same routing problem.. Upstream routers always have to know how to get to downstream networks.. You can manually do it or run a routing protocol.
How many ports do you need on this L3 switch? You can get a cisco sg300 10 port for example that will do L3 for less then 200$, what hardware you running pfsense on currently?
If your pfsense was to replace your smoothwall, why is the smoothwall still in the network?
-
I'm currently testing with an old desktop just to see if I can achieve this for as little as possible before investing
PFSense isn't replacing the smoothwall, I'm replacing the smoothwall with another filtering solution (think of smoothwall as dansguardian / squid which is what it basically is) - the other solutions are not UTM's so I need to sort out a firewall (again as cheap as I can)
routing –--> smoothwall -----> firewall
I may have to throw some cash at one of those ciscos (or the HP) instead
-
I would probably:
Internet <–-> pfSense <---> Content filter <---> L3 Switch <---> Local segments
Unless you need significant filtering between local segments - in which case the L3 switch would be another pfSense.
-
Here's an image from the lightspeed manual, which is what I'm trying to achieve
I intend to use a pfsense box as the core switch, the management nic there is basically the extra nic I put in the smoothwall to enable management and AD authentication
-
pfsense would not be my choice for a "core" switch.. Its a router, you will see much better speeds using a L3 switch.. Do you need to control access between these segments with firewall rules? If not then L3 switch is the way to go..
-
I know, I'm going to request one of those cisco switches you recommended, although with using PFSense I can install avahi and send MDns traffic around the lan and vlans and also setup a WIFI portal with radius so PFSense has some benefits over a layer 3
In the meanwhile, I seem to have got everything working okay authentication is working and passing traffic via both non transparent and transparent proxy through the pfsense. It's been a learning curve but I've learnt quite a bit!
-
The sg300 line can do multicast routing, which would take care of your mdns stuff.
As to a wifi portal – yeah you would normally do that on your actual wifi controller.. What are you using for wifi? Pfsense makes a horrific access point.. Why would you not just get a 70$ ap from unifi run their free controller on a vm and there you go all the wifi portal shit you could want, vouchers, pay with cc, time limits, etc. etc..
While I am big fan of getting by with what you have on a small budget when need too, and you can do some amazing things with really no money, etc. In a work setup - its much better to spend a few dollars.. For example the unifi AP are 70$ or the pro versions are 200$ This is pretty small budget items for a company.. Shit I have the AC 300$ model in my house ;) I would think a company could afford 70 for stable wifi.
-
We are running unifi, I've not played around with the portal too much but I need it to have stuff like import certs for HTTPS inspection policies on the portal screen.
I still think you need to run avahi to route MDNS /bonjour , cisco have a document on it - I'm running AVAHI on a raspberry pi and its serving us well (inc. printer sharing via cups) so this can be moved to pfsense
-
You can customize the unifi portal to your hearts content so putting a link to a CA cert should not be a problem. Or just using a trusted signed cert should remove that problem all together.
You are correct mdns can be a pita, think the ttl is 1, etc. I solved it even easier way by just putting my printer on the wlan segment ;) Before that I had done it with cups, where my cups server just had an interface in the wlan segment as well. Then I didn't have to worry about running cups.
