Route 2 different subnets onto 2 interfaces.

legacysl

Hi, this is not really a pure pfsense question bit was hoping for some help.

Currently I am setting a 2 separate wifi networks (internal & guest) which are on 2 different subnets but come along the same cable to the pfsense unit.

The problem is that the pfsense has a captive portal interface for the guests and a LAN interface for the internal users. Aside from physically separately (cabling) them is there a way to send each subnet to its respective interface?

Thanks in advance.

johnpoz

Yeah that would be called a vlan.

VLAN10 - external - SSID guests - 192.168.5.0/24 (255.255.255.0) - Internet only
VLAN20 - internal - SSID employees - 192.168.6.0/24 - Internet & LAN & DMZ
WiFi client isolation "enabled"

but come along the same cable to the pfsense unit.

If the WLAN AP is an external one and it is supporting multi-SSIDs the VLANs must be "tagged".

legacysl

Thanks for the replies, how would the VLAN be needed to be setup, would the tagging have to be done by a L2 switch.

The AP's are not set for multiple SSID, so the employees would connect via one set of AP's and the guests via another.

Also the pfsense handles the DHCP for both subnets

johnpoz

yeah if you want to use 1 physical interface on pfsense that handles more than 1 network that would be a vlan. Yes a layer 2 switch with vlan support is needed be it you use multiple accesspoints or AP with vlan tags on their different SSIDs

Your switch port connected to pfsense that you want to have the different vlans on would tag the vlans on that physical port, the ports connected to your different AP would just need to be untagged in the vlan you want that ap clients to be on. Or if you would be tagged if to a ap that taggs the different ssids with different vlan Ids

legacysl

Thanks heaps, was going about this all wrong. Thank you for setting me on the correct path. xD.

johnpoz

So for example 1 of my ssids on my access points I have multiple is native or untagged, my other SSIDs are tagged.

So the port that connects to interface were the native untagged vlan is trunked to pfsense where it keeps the tags of the tagged networks, and the traffic that is native is untagged. Pfsense uses the untag traffic to the physical interface network, tagged traffic it knows goes to those vlans that run on the interface depending on the tag.

On the ports on the switch that connect to the AP, it has same untagged native pvid, and then it the other vlans are tagged on their ID..

So you can use one of the networks as untagged, and the other tagged or both as tagged. Just depends on how you want to set it up.

The AP's are not set for multiple SSID, so the employees would connect via one set of AP's and the guests via another.

Ah, ok that was not really clear to me in the opening post from you. Then the Ports need not to
be "tagged" with one SSID only.

Also the pfsense handles the DHCP for both subnets

Yes.