Creating a Guest Wired & Wireless Network for Guest & IoT Traffic

[johnpoz]

You have zero use of a carp setup with lacp and a downstream router in a HOME setup, or even a home business.. You don't even have a internet pipe that would suggest such a setup..

You have no need of lacp, nor L3 router in your setup.. Why do you not just let pfsense do what it was designed to do and that is route and firewall?  Use your switches as layer 2 only which really simplifies your setup.. And will allow for you to actually firewall between your segments and create guest wifi or wired networks in minutes, etc..

Sure looks to me like your behind a double nat and not sure what you think your carp setup is getting you either??  Other than cost, complexity - for what exactly??  You believe that hardware is going to fail?

So you have 5 interfaces total in 1 of your pfsense boxes?  That means you could have 4 network segments behind without having to do any vlan on pfsense at all.  Just let your switch do it at layer 2.. And setup untagged ports on your switch as uplinks to the the pfsense interfaces.  If you need to just vlan for multiple wifi networks since they prob have little use of 1 gig bandwidth and normally wireless clients do not talk to each other much anyway across segments.

Once you understand the basics - then you can move up to lacp, downstream routers, etc. when there is an actual NEED for it!!!

[Derelict]

The whole point in creating a guest/iot network is usually to PREVENT inter-VLAN traffic so hairpinning the VLAN on one interface with LAN is probably a non-issue.

Create VLAN 30 on the same pfSense physical interface (or lagg) as VLAN 2000.

Interfaces > (assign) Create a GUEST interface on the VLAN 30 pfSense interface. That traffic will be TAGGED on that physical port/lagg.

Create DHCP server, firewall rules, outbound NAT (if not auto/hybrid) for the GUEST interface.

TAG VLAN 30 through your switches but DO NOT create an SVI/RVI.

TAG VLAN 30 to the access points.

Create a GUEST SSID on the Unifi with the VLAN set to 30.

And you're done.

I would consider the same procedure for a separate IoT network as that might require different rules, etc.

[pglover19]

@Derelict:

The whole point in creating a guest/iot network is usually to PREVENT inter-VLAN traffic so hairpinning the VLAN on one interface with LAN is probably a non-issue.

Create VLAN 30 on the same pfSense physical interface (or lagg) as VLAN 2000.

Interfaces > (assign) Create a GUEST interface on the VLAN 30 pfSense interface. That traffic will be TAGGED on that physical port/lagg.

Create DHCP server, firewall rules, outbound NAT (if not auto/hybrid) for the GUEST interface.

TAG VLAN 30 through your switches but DO NOT create an SVI/RVI.

TAG VLAN 30 to the access points.

Create a GUEST SSID on the Unifi with the VLAN set to 30.

And you're done.

I would consider the same procedure for a separate IoT network as that might require different rules, etc.

Derelict … So these are the steps..

Juniper Switch Configuration
1.   Create a Guest wired/wireless VLAN (VLAN 30)
2.   Do not configure the VLAN as a RVI (Routed VLAN interface)
3.   Assign the Guest VLAN to port 13,14,15, and 16 on the switch. Note: These ports will have the Home Network VLAN (VLAN 1) as well as the Native VLAN (untagged traffic). These ports will be a trunk port. So these ports will have VLAN 1 and VLAN 30 assigned to them. VLAN 30 will tagged and the Native VLAN will be untagged.
4.   Create DHCP server on the Guest Network (Vlan 30).

Ubiquiti UAP-AC-Pro APs
1.   Connect the APs to Port 13,4,15, or 16 on the Juniper Switch. These ports are trunk ports carrying traffic from VLAN 30 (tagged traffic) and the native VLAN (VLAN 1 – untagged traffic).
2.   Create the Guest SSID on the UniFi AP and assign it to VLAN 30.
3.   The Home Network SSID on the UniFi AP already exist and I don’t need to assign this SSID to a VLAN.

Pfsense Configuration
1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

[Derelict]

Looks right to me.

IDK if you can do DHCP on the switch without an RVI on that VLAN but if you can and you want DHCP there, that's fine. Else do it on pfSense.

[johnpoz]

Already told you could do it that way…  Now Derelict has validated it... Do it already..

[pglover19]

Thanks everyone for your help.. I truly appreciate it..

I will deploy the changes tonight and let you know. I may need some help on the firewall rules for Guest interface (VLAN 30) on the pfSense box.

Essentially, I want the Guest interface on the pfSense box to do the following:
1. Allow access to the internet
2. Block access to all or specific subnets

However, I do want to allow my other subnets access to the Guest network, but the Guest network cannot access my internal subnets.

I hope this is not confusing.

[Derelict]

Rules allowing access from the other subnets to the guest network will be on the transit interface (vlan 2000).

The attached is pretty basic but generally works for limiting guest access.

My local_nets_v4 includes some repetition. Blocking RFC1918 is probably sufficient unless you have inside networks on public IP space.


[pglover19]

I was looking over my pfSense configuration and I think it is not totally correct.

Pfsense Configuration
1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

If I trunk the Transit network (VLAN 2000) and add VLAN 30  (Guest VLAN) to it, both VLANs will be tagged. So in addition to creating a subinterface on the LAN interface in pfSense for VLAN 30, I will now need to create VLAN 2000 in pfSense as well. VLAN 2000 will be the assigned to the original LAN interface. Does that sound correct? Please advise.

[pglover19]

@pglover19:

I was looking over my pfSense configuration and I think it is not totally correct.

Pfsense Configuration
1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

If I trunk the Transit network (VLAN 2000) and add VLAN 30  (Guest VLAN) to it, both VLANs will be tagged. So in addition to creating a subinterface on the LAN interface in pfSense for VLAN 30, I will now need to create VLAN 2000 in pfSense as well. VLAN 2000 will be the assigned to the original LAN interface. Does that sound correct? Please advise.

Got pfSense working.. I created VLAN 2000 in pfSense as well and assigned it to the original LAN interface. All the routing and firewall is now working for the LAN interface. Will be configuring the GUEST interface (VLAN 30) shortly.

[pglover19]

@pglover19:

@pglover19:

I was looking over my pfSense configuration and I think it is not totally correct.

Pfsense Configuration
1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

If I trunk the Transit network (VLAN 2000) and add VLAN 30  (Guest VLAN) to it, both VLANs will be tagged. So in addition to creating a subinterface on the LAN interface in pfSense for VLAN 30, I will now need to create VLAN 2000 in pfSense as well. VLAN 2000 will be the assigned to the original LAN interface. Does that sound correct? Please advise.

Got pfSense working.. I created VLAN 2000 in pfSense as well and assigned it to the original LAN interface. All the routing and firewall is now working for the LAN interface. Will be configuring the GUEST interface (VLAN 30) shortly.

I can't get the Guest network in pfSense working. I am testing using a wired connection. I configure a static IP address on my laptop (192.168.30.10) and connected directly into the switch port that is configured for VLAN 2000 (Transit network) and VLAN 30 (Guest network).

I have attached all the Guest network configuration in pfSense. It seems as though pfSense is not receiving VLAN 30 traffic.

[Derelict]

So tag VLAN 30 through to the client. Client should be on an untagged port on VLAN 30.

This isn't rocket science.

If pfSense is not receiving traffic on that port on VLAN 30 then it's your switch/layer 2 that isn't passing it.

You obviously need DHCP on GUEST (unless provided from something else) and firewall rules passing the traffic into GUEST for anything to work.

[pglover19]

@Derelict:

So tag VLAN 30 through to the client. Client should be on an untagged port on VLAN 30.

This isn't rocket science.

If pfSense is not receiving traffic on that port on VLAN 30 then it's your switch/layer 2 that isn't passing it.

You obviously need DHCP on GUEST (unless provided from something else) and firewall rules passing the traffic into GUEST for anything to work.

For some reason, my DHCP setup on VLAN 30 on the Juniper switch is not working. Maybe because VLAN 30 is not setup for inter-vlan routing.

I created the Guest SSID on the UniFi AP and assigned it to VLAN 30. I went ahead and setup DHCP on the pfSense box and when I connect to the Guest SSID, I can now access the internet. Traffic to the other subnets is blocked as well. So, major progress. I will tinker with it more tomorrow. Thanks everyone…

[Derelict]

I said earlier that you can probably not run a DHCP server on the switch without an RVI.

[pglover19]

Is there any reason to assign an IP address to the Guest Vlan (VLAN 30) created on the Juniper switch? Right now I assigned it "192.168.30.1" but I am not sure if it is serving any purpose. On the pfSense box, the Guest interface (VLAN 30) has been assigned IP address "192.168.30.2".

[Derelict]

No. I specifically said NOT to create one. You want the firewall to route traffic, not the switch.

[pglover19]

@Derelict:

No. I specifically said NOT to create one. You want the firewall to route traffic, not the switch.

Everything is working now. Thanks for the help.

[pglover19]

@Derelict:

Rules allowing access from the other subnets to the guest network will be on the transit interface (vlan 2000).

The attached is pretty basic but generally works for limiting guest access.

My local_nets_v4 includes some repetition. Blocking RFC1918 is probably sufficient unless you have inside networks on public IP space.

How did you create the local_nets_v4 table?

[pglover19]

I created a Firewall Alias and it worked for me…

[pglover19]

Got everything working.. I may tinker with the firewall rules on the Guest network some more…

Here is the final drawing. Thanks everyone.

[johnpoz]

Why are you calling it lan vip and dmz vip?  Sounds like to me you are running 2 different layer 3 networks on the same layer 2??