Pfsense new install topology

smithr99

Hi All,
First of all let me apologise if this seems like it's "noob" questions or if I'm not as technically competent as probably the vast majority of users on here. I'm what you would call a hobbyist just looking for some guidance really.

Currently I have a home network comprising 2 x Netgear GS724T(v4) switches, 1 x DD-WRT running on an old Linksys router (as my primary router/dhcp) and 3 x Unifi AP access points (using PoE injectors).

I'm looking at improving and securing my currrent network as follows:

Use of VLANs to segregate traffic onto separate networks as follows:
a) Internal network (VLAN ID 10) for all internally connected "wired" devices (10.0.5.0/24)
b) External WiFi network for all clients connected via Unifi APs (VLAN ID 20) (10.0.7.0/24)
c) Internal/external VoIP network for my FreePBX server (VLAN ID 30) (10.0.9.0/24)
d) Management VLAN for all management of switches/pfsense/WAN (VLAN ID 1) (192.168.1.0/24)
Using a SP-1000 as my firewall/DHCP/VLAN management interface (and remove the DD-WRT router altogether) to sit inbetween my WAN modem (I'm in UK and will be using a BT Homehub with DHCP/WiFi etc disabled on it) and my first GS724T switch (I have 2)
Using a newly bought (eBay second-hand so dont know the version yet v1/2/3 etc) Netgear FS728TP (PoE managed switch) to power my Unifi APs as well as some Cisco SPA504G phones I plan to implement as part of my FreePBX rollout
I have a Synology NAS that is currently Link aggregated (2 x NICs) to 2 of the ports on one of my switches. Ideally I'd like to split 1 x NIC on the NAS to internal access only (able to access ALL content on it) and another NIC on a different VLAN for guests/external WiFi clients to only access certain portions/file shares on the NAS

Current questions/problems I can foresee… :

(again, please excuse my ignorance!) I'm not sure on VLANs and how to implement them. What is the best way to "trunk" (I think that's the correct term?) my switches together with the SP-1000 and my BT Homehub ?
I have literally no idea on how to setup pfsense. I'm a quick learner and was hoping that with a lot of help from Google I'd be able to figure it out but any pointers here I'd really appreciate it!

Really as a first step I'd like some idea of what topology to use (connection diagrams??) in order that I can start wiring this baby up properly. Once I've got the wiring sorted I can then concentrate on configuring it to work efficiently.
I'm happy to pay someone to sort all this stuff out but also want to try and learn to do it (and understand it) myself. Preferably I'd love to do it myself and if anyone fancies a challenge to help me along the way then I'd love to document it and provide it as a source of information for future "noobs" like myself.
Alternatively if you think this is all far beyond the realms of possible for a hobbyist and requires professional intervention then please let me know sooner rather than later!!

Many thanks for your understanding

heper

some questions:

whats is an "SP-1000" ?
why 4) ?? Is it even possible to give permission based on what NIC the request enters on the synology? (i highly doubt it). Use username/passwords to limit access to content

some answers:

(again, please excuse my ignorance!) I'm not sure on VLANs and how to implement them. What is the best way to "trunk" (I think that's the correct term?) my switches together with the SP-1000 and my BT Homehub ?

Read up on vlans. There is too much info about it, to reply to on a simple forum post.
Get familiar with terms like "Tagged"/"Untagged"/"PVID"
A vlan-trunk generally consists of multiple tagged vlans on a single port.

I have literally no idea on how to setup pfsense. I'm a quick learner and was hoping that with a lot of help from Google I'd be able to figure it out but any pointers here I'd really appreciate it!

https://doc.pfsense.org/index.php/Installing_pfSense

smithr99

some questions:

whats is an "SP-1000" ?

Apologies, I meant SG-1000

why 4) ?? Is it even possible to give permission based on what NIC the request enters on the synology? (i highly doubt it). Use username/passwords to limit access to content

I've re-thought this and will just allow access on private subnet 10.0.20.0/24 (VLAN 20)

Read up on vlans. There is too much info about it, to reply to on a simple forum post.
Get familiar with terms like "Tagged"/"Untagged"/"PVID"
A vlan-trunk generally consists of multiple tagged vlans on a single port.

thanks for the tips, I've read as much as my brain will absorb at the moment (!) so I'm a little clearer. I have also made a topology diagram for someone to criticise/help me with. I'm hoping I've got it almost right if not perfect (1st attempt!). I've also detailed what devices will be on which subnet/vlan

I've also got a couple more questions…
• Do I need to set a VLAN ID for the grey connection between SG-1000 and the BT Homehub? If so is this something done in pfSense? I’ve “presumed” that the default VLAN 1 would suffice here?
• My Unifi AP’s seem to be only able to be controlled via an untagged VLAN as per attached info from their website…I’m not quite sure how to go about configuring this to work within both VLAN 20 (private network) and VLAN 50 (guest wifi). I know how to create the SSID’s and configure the VLANS on the AP’s but I’m unclear on how to tag/untag the switch to allow access to the control interface

Any help greatly appreciated...

unifi.PNG_thumb

topology.PNG_thumb
![topology detail.PNG](/public/imported_attachments/1/topology detail.PNG)
![topology detail.PNG_thumb](/public/imported_attachments/1/topology detail.PNG_thumb)

smithr99

should have also mentioned, where there's an IP next to a device it's a static IP. Everything else is assumed to be on DHCP

smithr99

PS I've put "T" on all the ports for now as that's another bridge I need to cross (*figuring out whether to tag/untag or leave blank!!

mhertzfeld

You only want to tag ports where you plan on trunking.

For the most part you are going to want untagged ports.

For example, if you plan on setting up the vlans in pfsense for intervlan routing ect… then you would tag the port connecting pfSense.

Or if your APs supports VLANs (and are using that functionality) you would want to tag the port connecting to your AP.

if you are connecting a computer or printer to the port you would want to set that as untagged.

smithr99

@mhertzfeld:

You only want to tag ports where you plan on trunking.

For the most part you are going to want untagged ports.

For example, if you plan on setting up the vlans in pfsense for intervlan routing ect… then you would tag the port connecting pfSense.

Or if your APs supports VLANs (and are using that functionality) you would want to tag the port connecting to your AP.

if you are connecting a computer or printer to the port you would want to set that as untagged.

I am planning on trunking (as per original topology digram) in order to connect 3 x switches and pfsense SG-1000 together. I will also probably be planning on "some" intervlan routing although I can live without it for now. The APs are Unifi UAP-LR which "do support" VLAN's but the more I read into them it would appear you're supposed to leave them untagged and just use the VLAN option on their controller software to set the VLAN tagging up (I guess they tag themselves rather than relying on a switch to do so?)

Excuse my ignorance but why wouldn't you want to tag a computer (a printer I understand), especially if I'm planning on being able to access other VLANs from there?

thanks for you help :)

johnpoz

"The APs are Unifi UAP-LR which "do support" VLAN's but the more I read into them it would appear you're supposed to leave them untagged and just use the VLAN option on their controller software to set the VLAN tagging up"

You would assign different vlans to your different SSID either via the controller directly or via dynamically assigned vlans and radius, etc.

End devices normally do not need to be tagged, think your confused about how a device in 1 vlan accesses devices in another vlan. To access another vlan from a device in vlan A, the device would go through the router/firewall to access this other network.

Only time you would need to tag vlans to an end device like a printer or a pc would be if you were going to send it traffic from multiple vlans at the same time and it had to sort out what vlan the traffic was in based up on the tag. You do this on a switch, AP, router etc.. Where traffic from multiple vlans is entering the device via an "uplink"..

The management IP on a unifi AP has to be untagged, it can be in any vlan you want but it is untagged. It can place traffic from its different wireless networks (ssid) to different vlans via tagging yes. But its management interface would be on an untagged vlan.

smithr99

thanks johnpoz. Im a little clearer now (I was panicking that i'd have to use VLAN 1 for my AP's which kind of went against what I'm aiming at here!). Just so I'm clear does my topology diagram look ok to you? (albeit removing the vast majority of the "T" tags)

cheers

Derelict

The Ubiquiti devices really like to be managed on the untagged VLAN on the port they are connected to. In fact I'm pretty sure Ubiquitis do not support anything but the untagged VLAN as the management VLAN. Seems like I remember trying it before and the APs kept reverting to untagged. I think the capability to even try to set a management VLAN there has been removed.

That untagged VLAN does NOT have to be VLAN 1, however. It can be whatever you want. Just needs to be untagged (The PVID) on the switch port(s) going to the AP(s). So your management VLAN SSID should be untagged (if you have one) and other SSIDs should be tagged with a VLAN.

ETA: (basically just repeating what johnpoz already said but I'll leave it. derp.)

smithr99

Thanks for all the help so far. I'm aware that I dont want to turn this thread into a Networking 101 session but I promise this is all leading to a good understanding of pfSense and how best to implement it in my network (!)

Ive done another diagram (or 3) attached which shows what I THINK should be the case for tagging and PVIDs on my Netgear switches. I've trunked all of them together on ports 23/24 and 28 (all GBit ports on these) and have tagged ALL VLANs on those ports with NO PVID.

I've then defaulted to using UNTAGGED on the relevant VLAN for each port that has a device on it and also set the PVID to the relevant VLAN for each of these. This may be way off but please be gentle as this is all new to me today!

One question I do have is should I delete the PVID for all the unused ports (they're currently all set to 1 which I dont want)

screenshots attached - if you fancy correcting me, the Google sheets copy is here…https://docs.google.com/spreadsheets/d/1-W4Mb7t5SEu1RDRopeu9z6CAIpEUnBB6azhGiZyO2qg/edit?usp=sharing

switch2.PNG_thumb

switch1.PNG_thumb

switch3.PNG_thumb

johnpoz

Your last picture where you have untagged multiple vlans 20, 50 and 60.. that is borked.. You don't run multiple vlans same connection untagged. So device connected to port 1 for example. He would see untagged traffic all three of those vlans..

smithr99

@johnpoz:

Your last picture where you have untagged multiple vlans 20, 50 and 60.. that is borked.. You don't run multiple vlans same connection untagged. So device connected to port 1 for example. He would see untagged traffic all three of those vlans..

Those ports are used to connect my unifi APs so in theory I need them to access vlans 20 50 and 60? Unless you mean I just leave them on 20 only as 50 and 60 will be managed by the APs themselves?

phil.davis

On a switch port that goes to a Unifi AP, you would make the VLAN that you want to use to mange the AP be untagged - those packets will then be sent as ordinary ethernet frames to the AP. Other VLANs that you want to use for carrying the traffic for each WiFi SSID you make tagged. Then the switch sends a tagged ethernet frame for packets in that VLAN. So the Unifi AP can listen for (and send) packets to/from each WiFi SSID from/to the corresponding VLAN.
This was the first thing that came up in my search, and shows what to do:
https://help.ubnt.com/hc/en-us/articles/219654087-UniFi-Using-VLANs-with-UniFi-Wireless-Routing-Switching-Hardware

johnpoz

^ exactly…

So what "vlan" is the management IP of your AP it, is it 20? Then 20 would be untagged.. And normally that would be the PVID of that port.. Then 50 and 60 would be tagged..

I can never think of any sort of setup where you would run more than 1 vlan untagged on the same port.. Other than maybe a span port that you were sniffing traffic on?

smithr99

@johnpoz:

^ exactly…

So what "vlan" is the management IP of your AP it, is it 20? Then 20 would be untagged.. And normally that would be the PVID of that port.. Then 50 and 60 would be tagged..

I can never think of any sort of setup where you would run more than 1 vlan untagged on the same port.. Other than maybe a span port that you were sniffing traffic on?

Thanks both,
Yes APs will be managed from vlan20 and there will be SSIds setup on each for access to 30 50 and 60. I've made the necessary changes to the Google spreadsheet (link above) if you wouldn't mind checking? (sorry for asking all this!)

johnpoz

what did you change - I still see multiple untagged vlans.. on switch 3 on the same port.

smithr99

@johnpoz:

what did you change - I still see multiple untagged vlans.. on switch 3 on the same port.

not sure why (maybe google drive didnt update?! Anyway, ive attached screens…

1.PNG_thumb

2.PNG_thumb

3.PNG_thumb

Derelict

Netgear switches are complete and utter piles of crap. See those ports (01-06) with both untagged and tagged VLANs on 10.0.10.12? Are those your Ubiquitis?

Try also manually setting the PVID to 20 on those ports. Not having the PVID shown there makes me think that might be your issue.

smithr99

@Derelict:

Netgear switches are complete and utter piles of crap.

I would concur!

See those ports (01-06) with both untagged and tagged VLANs on 10.0.10.12? Are those your Ubiquitis?

Try also manually setting the PVID to 20 on those ports. Not having the PVID shown there makes me think that might be your issue.

thanks, will give that a go..