Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Creating a Guest Wired & Wireless Network for Guest & IoT Traffic

    Scheduled Pinned Locked Moved General pfSense Questions
    51 Posts 3 Posters 8.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pglover19
      last edited by

      Thanks everyone for your help.. I truly appreciate it..

      I will deploy the changes tonight and let you know. I may need some help on the firewall rules for Guest interface (VLAN 30) on the pfSense box.

      Essentially, I want the Guest interface on the pfSense box to do the following:
      1. Allow access to the internet
      2. Block access to all or specific subnets

      However, I do want to allow my other subnets access to the Guest network, but the Guest network cannot access my internal subnets.

      I hope this is not confusing.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Rules allowing access from the other subnets to the guest network will be on the transit interface (vlan 2000).

        The attached is pretty basic but generally works for limiting guest access.

        My local_nets_v4 includes some repetition. Blocking RFC1918 is probably sufficient unless you have inside networks on public IP space.

        ![Screen Shot 2017-08-06 at 2.26.11 PM.png](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.26.11 PM.png)
        ![Screen Shot 2017-08-06 at 2.26.11 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.26.11 PM.png_thumb)
        ![Screen Shot 2017-08-06 at 2.27.13 PM.png](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.27.13 PM.png)
        ![Screen Shot 2017-08-06 at 2.27.13 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.27.13 PM.png_thumb)

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • P
          pglover19
          last edited by

          I was looking over my pfSense configuration and I think it is not totally correct.

          Pfsense Configuration
          1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
          2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
          3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

          If I trunk the Transit network (VLAN 2000) and add VLAN 30  (Guest VLAN) to it, both VLANs will be tagged. So in addition to creating a subinterface on the LAN interface in pfSense for VLAN 30, I will now need to create VLAN 2000 in pfSense as well. VLAN 2000 will be the assigned to the original LAN interface. Does that sound correct? Please advise.

          1 Reply Last reply Reply Quote 0
          • P
            pglover19
            last edited by

            @pglover19:

            I was looking over my pfSense configuration and I think it is not totally correct.

            Pfsense Configuration
            1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
            2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
            3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

            If I trunk the Transit network (VLAN 2000) and add VLAN 30  (Guest VLAN) to it, both VLANs will be tagged. So in addition to creating a subinterface on the LAN interface in pfSense for VLAN 30, I will now need to create VLAN 2000 in pfSense as well. VLAN 2000 will be the assigned to the original LAN interface. Does that sound correct? Please advise.

            Got pfSense working.. I created VLAN 2000 in pfSense as well and assigned it to the original LAN interface. All the routing and firewall is now working for the LAN interface. Will be configuring the GUEST interface (VLAN 30) shortly.

            1 Reply Last reply Reply Quote 0
            • P
              pglover19
              last edited by

              @pglover19:

              @pglover19:

              I was looking over my pfSense configuration and I think it is not totally correct.

              Pfsense Configuration
              1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
              2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
              3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

              If I trunk the Transit network (VLAN 2000) and add VLAN 30  (Guest VLAN) to it, both VLANs will be tagged. So in addition to creating a subinterface on the LAN interface in pfSense for VLAN 30, I will now need to create VLAN 2000 in pfSense as well. VLAN 2000 will be the assigned to the original LAN interface. Does that sound correct? Please advise.

              Got pfSense working.. I created VLAN 2000 in pfSense as well and assigned it to the original LAN interface. All the routing and firewall is now working for the LAN interface. Will be configuring the GUEST interface (VLAN 30) shortly.

              I can't get the Guest network in pfSense working. I am testing using a wired connection. I configure a static IP address on my laptop (192.168.30.10) and connected directly into the switch port that is configured for VLAN 2000 (Transit network) and VLAN 30 (Guest network).

              I have attached all the Guest network configuration in pfSense. It seems as though pfSense is not receiving VLAN 30 traffic.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                So tag VLAN 30 through to the client. Client should be on an untagged port on VLAN 30.

                This isn't rocket science.

                If pfSense is not receiving traffic on that port on VLAN 30 then it's your switch/layer 2 that isn't passing it.

                You obviously need DHCP on GUEST (unless provided from something else) and firewall rules passing the traffic into GUEST for anything to work.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • P
                  pglover19
                  last edited by

                  @Derelict:

                  So tag VLAN 30 through to the client. Client should be on an untagged port on VLAN 30.

                  This isn't rocket science.

                  If pfSense is not receiving traffic on that port on VLAN 30 then it's your switch/layer 2 that isn't passing it.

                  You obviously need DHCP on GUEST (unless provided from something else) and firewall rules passing the traffic into GUEST for anything to work.

                  For some reason, my DHCP setup on VLAN 30 on the Juniper switch is not working. Maybe because VLAN 30 is not setup for inter-vlan routing.

                  I created the Guest SSID on the UniFi AP and assigned it to VLAN 30. I went ahead and setup DHCP on the pfSense box and when I connect to the Guest SSID, I can now access the internet. Traffic to the other subnets is blocked as well. So, major progress. I will tinker with it more tomorrow. Thanks everyone…

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    I said earlier that you can probably not run a DHCP server on the switch without an RVI.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • P
                      pglover19
                      last edited by

                      Is there any reason to assign an IP address to the Guest Vlan (VLAN 30) created on the Juniper switch? Right now I assigned it "192.168.30.1" but I am not sure if it is serving any purpose. On the pfSense box, the Guest interface (VLAN 30) has been assigned IP address "192.168.30.2".

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        No. I specifically said NOT to create one. You want the firewall to route traffic, not the switch.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • P
                          pglover19
                          last edited by

                          @Derelict:

                          No. I specifically said NOT to create one. You want the firewall to route traffic, not the switch.

                          Everything is working now. Thanks for the help.

                          1 Reply Last reply Reply Quote 0
                          • P
                            pglover19
                            last edited by

                            @Derelict:

                            Rules allowing access from the other subnets to the guest network will be on the transit interface (vlan 2000).

                            The attached is pretty basic but generally works for limiting guest access.

                            My local_nets_v4 includes some repetition. Blocking RFC1918 is probably sufficient unless you have inside networks on public IP space.

                            How did you create the local_nets_v4 table?

                            1 Reply Last reply Reply Quote 0
                            • P
                              pglover19
                              last edited by

                              I created a Firewall Alias and it worked for me…

                              1 Reply Last reply Reply Quote 0
                              • P
                                pglover19
                                last edited by

                                Got everything working.. I may tinker with the firewall rules on the Guest network some more…

                                Here is the final drawing. Thanks everyone.

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  Why are you calling it lan vip and dmz vip?  Sounds like to me you are running 2 different layer 3 networks on the same layer 2??

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pglover19
                                    last edited by

                                    @johnpoz:

                                    Why are you calling it lan vip and dmz vip?  Sounds like to me you are running 2 different layer 3 networks on the same layer 2??

                                    Sorry about the confusion. The drawing is not correct. For the DMZ, I will have separate Layer 3 switch. It is currently not setup yet….

                                    I will update the drawing the reflect the separate Layer 3 switch for the DMZ and it's uplink to pfSense.

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      pglover19
                                      last edited by

                                      Here is the correct drawing with the proposed DMZ setup. Once again, I have not installed the DMZ switch yet.

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        pglover19
                                        last edited by

                                        johnpoz … Do you see anything weird about my proposed DMZ setup?

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          Why are you doing layer 3 for 1 segment?

                                          Still don't understand while on pfsense your calling lan and dmz VIPs?

                                          Calling gateways out near your pfsense - looks like those are gateways setup on pfsense vs just the pfsense IP..

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            pglover19
                                            last edited by

                                            @johnpoz:

                                            Why are you doing layer 3 for 1 segment?

                                            Still don't understand while on pfsense your calling lan and dmz VIPs?

                                            Calling gateways out near your pfsense - looks like those are gateways setup on pfsense vs just the pfsense IP..

                                            Since I have an extra Juniper switch, my plan is to use it and perform routing on the switch. I guess I could purchase a cheap managed Layer 2 switch for the DMZ.

                                            As for the VIP, I guess I should call it CARP or cluster IP and not virtual IP.

                                            I will cleanup the gateway information on the drawing.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.