Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can this be done?

    Scheduled Pinned Locked Moved Captive Portal
    15 Posts 5 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      Panja
      last edited by

      I guess your reply makes sense! Unfortunately…
      The switches I have are both unmanaged/dumb switches and you cannot setup anything on them.

      Would it than be possible to just have the WIFI guest network with a captive portal and block access to the internal network?
      Or is that done by VLAN's as well?

      Or I could flash DD-WRT on to my wifi ap/router and use VLAN's?

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        They don't need to be Layer 3 switches.  They need to be managed, supporting 802.1q VLANs.

        You cannot block devices from communicating with other devices on the same subnet/segment. Such traffic never goes through the router so it can't be firewalled.

        I don't understand the problem.  Switches are not expensive.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • ?
          Guest
          last edited by

          The pfSense box has 2 network ports, so 1 for WAN and 1 for LAN.

          Would you tell us more about this pfSense box?

          I would like to run a captive portal on pfSense.

          This could be no problem because pfSense is capable to offer a well Captive Portal.

          Can this be done with this kind of setup?

          Perhaps, if you are the lucky one, and your dump unmanaged switches are looping through
          the VLAN tags it would perhaps going. But earlier or later you will be running in more
          or less trouble if something in the network is then changing or is coming on top then.

          Also is it possible to give it, it's own VLAN?

          This could be done but not directly on the switches because they are dump and unmanaged.
          If you are the lucky one they could be able to loop through the VLAN tags and then you be able
          to set up a VLAN between the WiFi AP and the pfSense, but this is in my poor opinion, standing
          on really wobbly or wonky ground! Not sable as in normally conditions. If this are very cheap ones
          and they are not looping through the VLAN tag you can´t do it because it will not work.

          your switches can't if they are not layer3.

          Supporting and routing are absolutely two different things!

          • For routing the VLANs it selfs you will need a Layer3 Switch
          • For supporting VLANs and the pfSense is routing the VLANs you will only need a Layer2 Switch

          Would it than be possible to just have the WIFI guest network with a captive portal and
          block access to the internal network?

          Please read the explanations above about your switches.

          Or is that done by VLAN's as well?

          You should have to set up the following things as I see it right:

          • VLAN1 for administrative VLAN for the admin with all devices inside.
          • VLAN10 for the 1st floor
          • VLAN20 for the 2nd floor
          • VLAN30 for WLAN SSID - private (internal network & Internet)
          • VLAN40 for WLAN SSID - guest (Internet only)

          Buying a small variant of the Cisco SG series likes the SG300-10 (Layer3)
          for the 1st floor and a Cisco SG200-10 (Layer2) for the 2nd floor.

          Or I could flash DD-WRT on to my wifi ap/router and use VLAN's?

          Would be a also a really good choice to flash this WLAN router with OpenWRT or
          DD-WRT, with an viewing eye to the VLAN and the other given features, options and functions.

          Your old switches can be sold by you or let them be outside until you will hug up some more LAN ports.

          1 Reply Last reply Reply Quote 0
          • P
            Panja
            last edited by

            Thanks for the answers guys! Appreciated.

            I will use an Zotac ZBOX ID91 as dedicated pfSense box.
            It has an i3 4130T processor, 8GB ddr3 ram and a 120GB ssd.

            The wifi router I have now is a Linksys/Cisco EA2700. (but will maybe be replaced by a new/better one).
            As far as I can see there is a DD-WRT version for it. OpenWRT is not supported I guess.

            Also will have a look at the managed switches.

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              This is generally what you need to do.

              Wi-Fi-VLANs-Apple.png
              Wi-Fi-VLANs-Apple.png_thumb

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • P
                Panja
                last edited by

                Would it be possible with this network setup: (assuming DD-WRT does the VLAN's)

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  If you have no concern or care in the world about reliability, do that.  Otherwise get some switches and do it right.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • P
                    Panja
                    last edited by

                    Do you mean DD-WRT is not stable/reliable? Or the Linksys EA2700?

                    It is still a home setup. Replacing my switched for managed switches will cost around 200 euro at least?
                    I'm planning on buying a new wifi router/ap as well…

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      I'm just saying making your AP a single point of failure for your whole network is stupid.  Again, if you don't care, go for it.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        Also note, the VLAN support in DD-WRT is model-specific.

                        1 Reply Last reply Reply Quote 0
                        • ?
                          Guest
                          last edited by

                          Do you mean DD-WRT is not stable/reliable? Or the Linksys EA2700?

                          For sure DD-WRT & OpenWRT will be both stable and reliable and also routers from other vendors
                          would be matching also fine! Buffalo, Netgear, TP-Link and some of them came with pre installed
                          DD-WRT or OpenWRT firmware so you must not flash it alone.

                          is still a home setup.

                          There are also switches out there that can be done all things for less money, but but routing
                          must be done then at the pfSense it selfs.

                          • Netgear GS105Ev2
                          • Netgear GS108Ev2
                          • Netgear GS108Tv3
                          • TP-Link TL-SG105E

                          Buy two of them and then replace the both you own, the TP-Link ones are able to get for cheap
                          as ~25 € each and are capable of VLANs.

                          Replacing my switched for managed switches will cost around 200 euro at least?

                          One Cisco SG300-10 for ~180 € and one TP-Link TL-SG105E on top for ~25 € will do the job and
                          routes the entire LAN by it selfs!

                          I'm planning on buying a new wifi router/ap as well…

                          Get a cheap used one with GB LAN Ports and if ac is not really urgent
                          for you it will do the job also fine.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.