Guestwifi setup
-
I have a question regarding setting up a guest wifi.
My Pfsense box has 2 LAN ports. port 0 being WAN and port 1 being LAN.
LAN is connected to a TP LINK VR900 in router mode but turned DCHP off on it so it act as a wireless access point. The VR900 has capability of running a guest wifi network in 2.4GHz and 5GHz band.
But when i switch on the guest wifi, I cannot get IP addresses for the devices connected to the guest wifi.
so I setup VLAN 2 on port 1 for guest wifi on pfsense box. but how do I link the VR900 guest wifi to VLAN 2?
LAN is setup as 192.168.1.254/24 pool being 1-245
VLAN 2 is setup as 192.168.2.254/24 pool being 1-245DHCP both active on LAN and VLAN.
thanks in advance. and please excuse my complete newbieness on this.
would a better thing to do is to use the DHCP server on the VR900 and turn DHCP off on pfsense?
-
"LAN is connected to a TP LINK VR900"
Is the LAN port on TP LINK VR900 a member of both vlans?
I think you need a switch and an AP.
I use a LGS308P 8-Port Gigabit PoE+ Smart Switch & UniFi AP-AC-Pro.
You're better off leaving your DHCP as is, I'd bet if you connect via the Guest SSID with a fixed IP address from the Guest subnet you won't be able to ping the default gateway.
Does the non Guest SSID work fine ?
Post a screenshot from Interfaces -> Interface Assignments.
-
non guest SSID is fully working.
the VR900 puts the guest wifi under the same network subnet so I am not sure how it can be differentiated. So I am thinking I need to have wifi capability on the pfsense box to have a separate wifi subnet
-
The way wifi routers "guest" works is it only lets that use the WAN, and not talk to the other lan or wifi devices on the normal ssid. When used as just an AP guest ssid normally will not work. I can not say this for every wifi router out there.. But they all pretty much do everything the same way, so everyone I have ever looked at the "guest" is only viable when your actually using it as your gateway to the internet.
If you want to setup a "guest" or any other wifi networks that are isolated from your other networks you really need an AP that supports vlans.. Say a unifi AP. They can do 4 different ssids.. per band, ie 2.4 and 5. So you could do 8 different networks if you wanted.
For this to work you need a smart switch or need to connect your AP direct to pfsense interface and tag your different SSID to different vlans. They also have support for dynamic assigned vlans so you could run 1 ssid and place the user in a specific vlan based upon their auth to your radius server, etc.
-
I dont think you can set VLAN on a consumer based router like that, and I never heard TP link supports VLAN out-of-the-box in their consumer based networking gears.
Luckily that router supports OpenWRT and it seems that the switch on that router supports VLAN so good for you. So flash it with OpenWRT unless your router is already locked down due to FCC regulation.
-
The way wifi routers "guest" works is it only lets that use the WAN, and not talk to the other lan or wifi devices on the normal ssid. When used as just an AP guest ssid normally will not work. I can not say this for every wifi router out there.. But they all pretty much do everything the same way, so everyone I have ever looked at the "guest" is only viable when your actually using it as your gateway to the internet.
That's pretty much what i figured. I have now setup the guest wifi directly off a wireless card on the pfsense box. I only need 1 guestwifi channel so it works for me.
The reason for not opting for unifi AP is the cost. My current modem/router offers AC1900 and I can get very good speed across the wifi and to get the same performance on unifi I need to fork out a significant amount more, which really defeats the point of using a cheap and cheerful box for pfsense. also the modem/router acts as a network storage so even less plugs and hardware required.
my essential need is a router level anti-virus (squid clamav), openVPN client and server mode with 50/10 speed and the ability to separate my critical IT assets from phone/tv/IoT/guest devices. My ultimate goal is to have the pfsense box running as virtual machine then I can run hard wires and get rid off all other stuff. but the celeron N3910 doesn't behave too well with VMware and there is workaround but a bit too much flaff for me at the moment.
-
Luckily that router supports OpenWRT and it seems that the switch on that router supports VLAN so good for you. So flash it with OpenWRT unless your router is already locked down due to FCC regulation.
there is no openwrt for VR900 atm
