Blocking on VLAN not working properly (pfSense <–> OpenWrt)
-
Like I suggested before put your AP on its own network say 192.168.2.0/24 and then your ssid vlans on that so 192.168.10/24 and 192.168.20/24 like you created. Now your AP is on its own isolated network and 192.168.2.0 and anything from your lan network would have to transverse pfsense to get to the AP gui or ssh, etc. Which you can limit in pfsense - your only concern then would be someone plugging into the 192.168.2.0 directly. But I would "guess" you have your openwrt plugged directly into a pfsense interface?? Or you have smart switch between so what other ports would be on this 192.168.2.0/24 untagged network?
But since openwrt router has its own switch - someone would be able to plug directly into its other lan ports ;) But is that really a concern??
-
Ok, I think I get it.
And yes, the pfSense box is connected directly to the OpenWrt router/ap.
pfSense box --> OpenWrt ap - port 1 OpenWrt ap - port 2 --> computer OpenWrt ap - port 3 --> computer OpenWrt ap - port 4 --> unmanaged/dumb switch -
oh shit your using its switch as well and then have another dumbswitch off of that.. Yeah that makes it harder.. All of those devices would have access to the gui no matter what network you put it on..
If you had something like this is becomes very easy to limit what can access it..
-
Well that's not a big problem for me. LAN users may access the gui.
As long as the wireless guest vlan (with semi-untrusted devices) is excluded from accessing the gui I'm happy. :D
That's already working. So I'm cool.Many thanks for all the help and info!
-
Anytime - what I am here for ;)
-
Hi John,
I wanted to update you a little on my configuration. 8)
I just ordered a managed switch to replace my unmanaged switch.
This will be the new setup:pfSense box --> OpenWrt ap1 - port 1 OpenWrt ap1 - port 2 --> device OpenWrt ap1 - port 3 --> device OpenWrt ap1 - port 4 --> managed switch - port 1 managed switch - port 2 --> device managed switch - port 3 --> device managed switch - port 4 --> OpenWrt ap2This way I can use my LAN as "admin" network (put the 2 OpenWrt aps in here) and create a VLAN for all the cabled devices (NAS, computers, etc) in my network.
Sounds good?
-
Wouldn't it be better
pfsense - managed switch - ap(s)
-
That's not possible in my setup.
My internet connection starts in my living room (1st floor) , so there for the pfSense box is there as well.
I want to have wifi coverage on all 3 floors in my house. So the first wifi ap is on the 1st floor as well.
The second wifi ap is on the 3rd floor. To connect the 1st, 2nd and 3rd floor to each other there is an unmanaged switch now.
That one will/can be replaced with the managed switch.Care to explain why your setup would be better?
OpenWrt on my devices are fully supported, so VLAN's do work. In other words the wifi aps (equipped with OpenWrt) are managed switches as well with wifi as a plus. -
well if you have the full support of vlans and other features you need on the switches in your old routers via openwrt, then it really doesn't matter. But if you have managed switches where you need them then your AP then you don't have to leverage the switch ports on the old wifi routers and would give better control "maybe" ?
If your saying the "smart/managed" feature set you need are available in the openwrt and hardware your running on then your good.
-
I should be good to go than, I think. 8)
Once everything is setup I'll post back and let you know, if you're interested of course.
Also that tutorial on OpenWrt <–> pfSense is coming as well. But bare with me, pretty darn busy atm. ;D
But promise is a promise so I'll make one for sure. -
Hi John,
I've finally created the tutorial!
You can check it here: https://forum.pfsense.org/index.php?topic=116980.0
