Pfsense new install topology

heper

some questions:

whats is an "SP-1000" ?
why 4) ?? Is it even possible to give permission based on what NIC the request enters on the synology? (i highly doubt it). Use username/passwords to limit access to content

some answers:

(again, please excuse my ignorance!) I'm not sure on VLANs and how to implement them. What is the best way to "trunk" (I think that's the correct term?) my switches together with the SP-1000 and my BT Homehub ?

Read up on vlans. There is too much info about it, to reply to on a simple forum post.
Get familiar with terms like "Tagged"/"Untagged"/"PVID"
A vlan-trunk generally consists of multiple tagged vlans on a single port.

I have literally no idea on how to setup pfsense. I'm a quick learner and was hoping that with a lot of help from Google I'd be able to figure it out but any pointers here I'd really appreciate it!

https://doc.pfsense.org/index.php/Installing_pfSense

smithr99

some questions:

whats is an "SP-1000" ?

Apologies, I meant SG-1000

why 4) ?? Is it even possible to give permission based on what NIC the request enters on the synology? (i highly doubt it). Use username/passwords to limit access to content

I've re-thought this and will just allow access on private subnet 10.0.20.0/24 (VLAN 20)

Read up on vlans. There is too much info about it, to reply to on a simple forum post.
Get familiar with terms like "Tagged"/"Untagged"/"PVID"
A vlan-trunk generally consists of multiple tagged vlans on a single port.

thanks for the tips, I've read as much as my brain will absorb at the moment (!) so I'm a little clearer. I have also made a topology diagram for someone to criticise/help me with. I'm hoping I've got it almost right if not perfect (1st attempt!). I've also detailed what devices will be on which subnet/vlan

I've also got a couple more questions…
• Do I need to set a VLAN ID for the grey connection between SG-1000 and the BT Homehub? If so is this something done in pfSense? I’ve “presumed” that the default VLAN 1 would suffice here?
• My Unifi AP’s seem to be only able to be controlled via an untagged VLAN as per attached info from their website…I’m not quite sure how to go about configuring this to work within both VLAN 20 (private network) and VLAN 50 (guest wifi). I know how to create the SSID’s and configure the VLANS on the AP’s but I’m unclear on how to tag/untag the switch to allow access to the control interface

Any help greatly appreciated...

unifi.PNG_thumb

topology.PNG_thumb
![topology detail.PNG](/public/imported_attachments/1/topology detail.PNG)
![topology detail.PNG_thumb](/public/imported_attachments/1/topology detail.PNG_thumb)

smithr99

should have also mentioned, where there's an IP next to a device it's a static IP. Everything else is assumed to be on DHCP

smithr99

PS I've put "T" on all the ports for now as that's another bridge I need to cross (*figuring out whether to tag/untag or leave blank!!

mhertzfeld

You only want to tag ports where you plan on trunking.

For the most part you are going to want untagged ports.

For example, if you plan on setting up the vlans in pfsense for intervlan routing ect… then you would tag the port connecting pfSense.

Or if your APs supports VLANs (and are using that functionality) you would want to tag the port connecting to your AP.

if you are connecting a computer or printer to the port you would want to set that as untagged.

smithr99

@mhertzfeld:

You only want to tag ports where you plan on trunking.

For the most part you are going to want untagged ports.

For example, if you plan on setting up the vlans in pfsense for intervlan routing ect… then you would tag the port connecting pfSense.

Or if your APs supports VLANs (and are using that functionality) you would want to tag the port connecting to your AP.

if you are connecting a computer or printer to the port you would want to set that as untagged.

I am planning on trunking (as per original topology digram) in order to connect 3 x switches and pfsense SG-1000 together. I will also probably be planning on "some" intervlan routing although I can live without it for now. The APs are Unifi UAP-LR which "do support" VLAN's but the more I read into them it would appear you're supposed to leave them untagged and just use the VLAN option on their controller software to set the VLAN tagging up (I guess they tag themselves rather than relying on a switch to do so?)

Excuse my ignorance but why wouldn't you want to tag a computer (a printer I understand), especially if I'm planning on being able to access other VLANs from there?

thanks for you help :)

johnpoz

"The APs are Unifi UAP-LR which "do support" VLAN's but the more I read into them it would appear you're supposed to leave them untagged and just use the VLAN option on their controller software to set the VLAN tagging up"

You would assign different vlans to your different SSID either via the controller directly or via dynamically assigned vlans and radius, etc.

End devices normally do not need to be tagged, think your confused about how a device in 1 vlan accesses devices in another vlan. To access another vlan from a device in vlan A, the device would go through the router/firewall to access this other network.

Only time you would need to tag vlans to an end device like a printer or a pc would be if you were going to send it traffic from multiple vlans at the same time and it had to sort out what vlan the traffic was in based up on the tag. You do this on a switch, AP, router etc.. Where traffic from multiple vlans is entering the device via an "uplink"..

The management IP on a unifi AP has to be untagged, it can be in any vlan you want but it is untagged. It can place traffic from its different wireless networks (ssid) to different vlans via tagging yes. But its management interface would be on an untagged vlan.

smithr99

thanks johnpoz. Im a little clearer now (I was panicking that i'd have to use VLAN 1 for my AP's which kind of went against what I'm aiming at here!). Just so I'm clear does my topology diagram look ok to you? (albeit removing the vast majority of the "T" tags)

cheers

Derelict

The Ubiquiti devices really like to be managed on the untagged VLAN on the port they are connected to. In fact I'm pretty sure Ubiquitis do not support anything but the untagged VLAN as the management VLAN. Seems like I remember trying it before and the APs kept reverting to untagged. I think the capability to even try to set a management VLAN there has been removed.

That untagged VLAN does NOT have to be VLAN 1, however. It can be whatever you want. Just needs to be untagged (The PVID) on the switch port(s) going to the AP(s). So your management VLAN SSID should be untagged (if you have one) and other SSIDs should be tagged with a VLAN.

ETA: (basically just repeating what johnpoz already said but I'll leave it. derp.)

smithr99

Thanks for all the help so far. I'm aware that I dont want to turn this thread into a Networking 101 session but I promise this is all leading to a good understanding of pfSense and how best to implement it in my network (!)

Ive done another diagram (or 3) attached which shows what I THINK should be the case for tagging and PVIDs on my Netgear switches. I've trunked all of them together on ports 23/24 and 28 (all GBit ports on these) and have tagged ALL VLANs on those ports with NO PVID.

I've then defaulted to using UNTAGGED on the relevant VLAN for each port that has a device on it and also set the PVID to the relevant VLAN for each of these. This may be way off but please be gentle as this is all new to me today!

One question I do have is should I delete the PVID for all the unused ports (they're currently all set to 1 which I dont want)

screenshots attached - if you fancy correcting me, the Google sheets copy is here…https://docs.google.com/spreadsheets/d/1-W4Mb7t5SEu1RDRopeu9z6CAIpEUnBB6azhGiZyO2qg/edit?usp=sharing

switch2.PNG_thumb

switch1.PNG_thumb

switch3.PNG_thumb

johnpoz

Your last picture where you have untagged multiple vlans 20, 50 and 60.. that is borked.. You don't run multiple vlans same connection untagged. So device connected to port 1 for example. He would see untagged traffic all three of those vlans..

smithr99

@johnpoz:

Your last picture where you have untagged multiple vlans 20, 50 and 60.. that is borked.. You don't run multiple vlans same connection untagged. So device connected to port 1 for example. He would see untagged traffic all three of those vlans..

Those ports are used to connect my unifi APs so in theory I need them to access vlans 20 50 and 60? Unless you mean I just leave them on 20 only as 50 and 60 will be managed by the APs themselves?

phil.davis

On a switch port that goes to a Unifi AP, you would make the VLAN that you want to use to mange the AP be untagged - those packets will then be sent as ordinary ethernet frames to the AP. Other VLANs that you want to use for carrying the traffic for each WiFi SSID you make tagged. Then the switch sends a tagged ethernet frame for packets in that VLAN. So the Unifi AP can listen for (and send) packets to/from each WiFi SSID from/to the corresponding VLAN.
This was the first thing that came up in my search, and shows what to do:
https://help.ubnt.com/hc/en-us/articles/219654087-UniFi-Using-VLANs-with-UniFi-Wireless-Routing-Switching-Hardware

johnpoz

^ exactly…

So what "vlan" is the management IP of your AP it, is it 20? Then 20 would be untagged.. And normally that would be the PVID of that port.. Then 50 and 60 would be tagged..

I can never think of any sort of setup where you would run more than 1 vlan untagged on the same port.. Other than maybe a span port that you were sniffing traffic on?

smithr99

@johnpoz:

^ exactly…

So what "vlan" is the management IP of your AP it, is it 20? Then 20 would be untagged.. And normally that would be the PVID of that port.. Then 50 and 60 would be tagged..

I can never think of any sort of setup where you would run more than 1 vlan untagged on the same port.. Other than maybe a span port that you were sniffing traffic on?

Thanks both,
Yes APs will be managed from vlan20 and there will be SSIds setup on each for access to 30 50 and 60. I've made the necessary changes to the Google spreadsheet (link above) if you wouldn't mind checking? (sorry for asking all this!)

johnpoz

what did you change - I still see multiple untagged vlans.. on switch 3 on the same port.

smithr99

@johnpoz:

what did you change - I still see multiple untagged vlans.. on switch 3 on the same port.

not sure why (maybe google drive didnt update?! Anyway, ive attached screens…

1.PNG_thumb

2.PNG_thumb

3.PNG_thumb

Derelict

Netgear switches are complete and utter piles of crap. See those ports (01-06) with both untagged and tagged VLANs on 10.0.10.12? Are those your Ubiquitis?

Try also manually setting the PVID to 20 on those ports. Not having the PVID shown there makes me think that might be your issue.

smithr99

@Derelict:

Netgear switches are complete and utter piles of crap.

I would concur!

See those ports (01-06) with both untagged and tagged VLANs on 10.0.10.12? Are those your Ubiquitis?

Try also manually setting the PVID to 20 on those ports. Not having the PVID shown there makes me think that might be your issue.

thanks, will give that a go..