Blocking on VLAN not working properly (pfSense <–> OpenWrt)

johnpoz

Well it would allow you to better isolate your wifi networks from your wired network.. Which better control is always better!

You also now reduce the number of clients on the same broadcast domain, which while prob not a lot since you don't have hundreds of devices less broadcast/multicast traffic going out your wifi network and vice versa.

Depending on what OS your using, multicast can be pretty chatty - out of the box windows machine is a noisy freaking thing! ;) Spouting all kinds of garbage on the wire looking for shit it has no real need to find ;) SSDP, LLTD, LLMNR just to name 3 chatty katty protocols spewing out shit that nobody normally has any use for.. I disable all 3 of those on my windows machines for sure first thing. Then don't forget all the IPv6 shit it will be spewing for teredo, 6to4, isatap, etc. Just noise if your not actually using them..

Every packet on your wifi is just taking up air time that a packet you want to be sending/getting can not be on the air.. While in the big picture your not talking anything of real significance.. I am just not a big fan of putting stuff on the wire that serves no actual purpose ;)

Panja

Many thanks again John, really appreciated.

I guess I will be changing my network to this now:

LAN: 192.168.1.1 /24
pfSense box: 192.168.1.1
OpenWrt router/ap: 192.168.1.2
Normal SSID: connected to VLAN 10: 192.168.10.1 /24
Guest SSID: connected to VLAN 20: 192.168.20.1 /24

Than make firewall rules for VLAN 10 to allow LAN access.
After that make firewall rules for VLAN 20 to block LAN access.

Because I installed Avahi I can see my Synology while connected to VLAN 10.

Sounds good? Or do you have any suggestions?

johnpoz

That would work, but since your openwrt gui is still on your normal lan, any device on that lan would be able to access it. If your fine with that and only want to prevent wifi users from accessing it your good.

Just a side not on your nomenclature use ;) 192.168.1.1/24 is host address if you want to represent the /24 network it would be 192.168.1.0/24

When you see a IP with /cidr presented depending on the /cidr you can tell if its a network or a host address. since 192.168.1.1/24 is not a wire address so seeing 192.168.1.1/24 is a host address.. So for example if I gave you 192.168.1.128/25 is that a host or a network? since /25 would break at 128 that is the network while 192.168.1.129/25 would be the first host.

so when you start getting into the smaller networks it helps to understand where your subnet breaks are so for example 192.168.1.4 is what?? You would assume that is a host say on /24 if no mask is given. But if the mask is /30 it now becomes a network or wire address. Where 192.168.1.5/30 would be the first host in that subnet.

What about say 192.168.1.0 it would be quite easy to guess that is 192.168.1.0/24 network - but if the mask was /23 then that becomes a valid host address.

Panja

You are absolutely right John regarding the host/network story.
I was indeed referring to: 192.168.1.0/24
My bad! :o

If I don't want my LAN clients to access the OpenWrt gui what would you suggest?

johnpoz

Like I suggested before put your AP on its own network say 192.168.2.0/24 and then your ssid vlans on that so 192.168.10/24 and 192.168.20/24 like you created. Now your AP is on its own isolated network and 192.168.2.0 and anything from your lan network would have to transverse pfsense to get to the AP gui or ssh, etc. Which you can limit in pfsense - your only concern then would be someone plugging into the 192.168.2.0 directly. But I would "guess" you have your openwrt plugged directly into a pfsense interface?? Or you have smart switch between so what other ports would be on this 192.168.2.0/24 untagged network?

But since openwrt router has its own switch - someone would be able to plug directly into its other lan ports ;) But is that really a concern??

Panja

Ok, I think I get it.

And yes, the pfSense box is connected directly to the OpenWrt router/ap.


pfSense box --> OpenWrt ap - port 1
                OpenWrt ap - port 2 --> computer
                OpenWrt ap - port 3 --> computer
                OpenWrt ap - port 4 --> unmanaged/dumb switch

johnpoz

oh shit your using its switch as well and then have another dumbswitch off of that.. Yeah that makes it harder.. All of those devices would have access to the gui no matter what network you put it on..

If you had something like this is becomes very easy to limit what can access it..

networkopenwrtgui.jpg_thumb

Panja

Well that's not a big problem for me. LAN users may access the gui.
As long as the wireless guest vlan (with semi-untrusted devices) is excluded from accessing the gui I'm happy. :D
That's already working. So I'm cool.

Many thanks for all the help and info!

johnpoz

Anytime - what I am here for ;)

Panja

Hi John,

I wanted to update you a little on my configuration. 8)

I just ordered a managed switch to replace my unmanaged switch.
This will be the new setup:


pfSense box --> OpenWrt ap1 - port 1
                OpenWrt ap1 - port 2 --> device
                OpenWrt ap1 - port 3 --> device
                OpenWrt ap1 - port 4 --> managed switch - port 1
                                         managed switch - port 2 --> device
                                         managed switch - port 3 --> device
                                         managed switch - port 4 --> OpenWrt ap2

This way I can use my LAN as "admin" network (put the 2 OpenWrt aps in here) and create a VLAN for all the cabled devices (NAS, computers, etc) in my network.

Sounds good?

johnpoz

Wouldn't it be better

pfsense - managed switch - ap(s)

Panja

That's not possible in my setup.

My internet connection starts in my living room (1st floor) , so there for the pfSense box is there as well.
I want to have wifi coverage on all 3 floors in my house. So the first wifi ap is on the 1st floor as well.
The second wifi ap is on the 3rd floor. To connect the 1st, 2nd and 3rd floor to each other there is an unmanaged switch now.
That one will/can be replaced with the managed switch.

Care to explain why your setup would be better?
OpenWrt on my devices are fully supported, so VLAN's do work. In other words the wifi aps (equipped with OpenWrt) are managed switches as well with wifi as a plus.

johnpoz

well if you have the full support of vlans and other features you need on the switches in your old routers via openwrt, then it really doesn't matter. But if you have managed switches where you need them then your AP then you don't have to leverage the switch ports on the old wifi routers and would give better control "maybe" ?

If your saying the "smart/managed" feature set you need are available in the openwrt and hardware your running on then your good.

Panja

I should be good to go than, I think. 8)

Once everything is setup I'll post back and let you know, if you're interested of course.
Also that tutorial on OpenWrt <–> pfSense is coming as well. But bare with me, pretty darn busy atm. ;D
But promise is a promise so I'll make one for sure.

Panja

Hi John,

I've finally created the tutorial!
You can check it here: https://forum.pfsense.org/index.php?topic=116980.0