Creating a Guest Wired & Wireless Network for Guest & IoT Traffic
-
No. I specifically said NOT to create one. You want the firewall to route traffic, not the switch.
-
No. I specifically said NOT to create one. You want the firewall to route traffic, not the switch.
Everything is working now. Thanks for the help.
-
Rules allowing access from the other subnets to the guest network will be on the transit interface (vlan 2000).
The attached is pretty basic but generally works for limiting guest access.
My local_nets_v4 includes some repetition. Blocking RFC1918 is probably sufficient unless you have inside networks on public IP space.
How did you create the local_nets_v4 table?
-
I created a Firewall Alias and it worked for me…
-
Got everything working.. I may tinker with the firewall rules on the Guest network some more…
Here is the final drawing. Thanks everyone.
-
Why are you calling it lan vip and dmz vip? Sounds like to me you are running 2 different layer 3 networks on the same layer 2??
-
Why are you calling it lan vip and dmz vip? Sounds like to me you are running 2 different layer 3 networks on the same layer 2??
Sorry about the confusion. The drawing is not correct. For the DMZ, I will have separate Layer 3 switch. It is currently not setup yet….
I will update the drawing the reflect the separate Layer 3 switch for the DMZ and it's uplink to pfSense.
-
Here is the correct drawing with the proposed DMZ setup. Once again, I have not installed the DMZ switch yet.
-
johnpoz … Do you see anything weird about my proposed DMZ setup?
-
Why are you doing layer 3 for 1 segment?
Still don't understand while on pfsense your calling lan and dmz VIPs?
Calling gateways out near your pfsense - looks like those are gateways setup on pfsense vs just the pfsense IP..
-
Why are you doing layer 3 for 1 segment?
Still don't understand while on pfsense your calling lan and dmz VIPs?
Calling gateways out near your pfsense - looks like those are gateways setup on pfsense vs just the pfsense IP..
Since I have an extra Juniper switch, my plan is to use it and perform routing on the switch. I guess I could purchase a cheap managed Layer 2 switch for the DMZ.
As for the VIP, I guess I should call it CARP or cluster IP and not virtual IP.
I will cleanup the gateway information on the drawing.
-
Routing to what? Just because a switch can do L3 doesn't mean you have to do it ;)
You have the DMZ segment on it, what exactly is it going to route to other than pfsense?
-
Routing to what? Just because a switch can do L3 doesn't mean you have to do it ;)
You have the DMZ segment on it, what exactly is it going to route to other than pfsense?
Updated drawing of the DMZ setup based on your recommendation. Opinion please.
-
idk why you are bothering with the separate DMZ switch. I'd probably just tag that on the existing trunk to the other switches.
-
idk why you are bothering with the separate DMZ switch. I'd probably just tag that on the existing trunk to the other switches.
Based on your recommendation I would:
1. Create a DMZ vlan (i.e. VLAN 70) on the existing Juniper switches. Do not create a RVI or assign the VLAN an IP address. Routing will be handled by pfSense.
2. Trunk the DMZ vlan (Vlan 70) on the existing uplink to pfSense.
3. Create a subinterface in pfSense over the LAN interface for the DMZ VLAN (Vlan 70). Just like I did for the Guest VLAN.
4. Create the firewall rules, NAT rules, etc. in pfSense for the DMZ interface.One more thought…
I do have an extra port on my pfSense boxes. So, I could create another uplink from my existing Juniper switches to the pfSense boxes. That why I am not trunking the DMZ Vlan on the LAN interface to pfSense. -
Especially since it seems your DMZ is all just VMs? So how do you have that connected to your vm host? Assume it has its own nics for the physical connection to the dmz switch.. So your using how many ports on this switch? Seems overkill for a few ports, etc.
-
Especially since it seems your DMZ is all just VMs? So how do you have that connected to your vm host? Assume it has its own nics for the physical connection to the dmz switch.. So your using how many ports on this switch? Seems overkill for a few ports, etc.
I guess it is overkill to use a dedicated 24 port Juniper switch for the DMZ switch since I will only be using a few ports and the servers in the DMZ will be VMs. However; I did want the DMZ network to have a physcial separation from the Home network. I do have a 6 port Asus router/switch I could use as my DMZ switch.
As far as the VM host, I do have dedicated Nics for the DMZ network. I will post a more detail showing once a decide on DMZ approach.
Please let know your thoughts.
-
1. Create a DMZ vlan (i.e. VLAN 70) on the existing Juniper switches. Do not create a RVI or assign the VLAN an IP address. Routing will be handled by pfSense.
2. Trunk the DMZ vlan (Vlan 70) on the existing uplink to pfSense.
3. Create a subinterface in pfSense over the LAN interface for the DMZ VLAN (Vlan 70). Just like I did for the Guest VLAN.
4. Create the firewall rules, NAT rules, etc. in pfSense for the DMZ interface.4. Simply reassign the existing DMZ interface to the new VLAN interface and all my firewall rules, NAT rules, dhcp, etc will be moved there.
I did want the DMZ network to have a physcial separation from the Home network.
If that is really important to you then leave it that way.
-
Especially since it seems your DMZ is all just VMs? So how do you have that connected to your vm host? Assume it has its own nics for the physical connection to the dmz switch.. So your using how many ports on this switch? Seems overkill for a few ports, etc.
I have decided not to use the extra Juniper EX3300 as my DMZ switch. Will save it for my home lab setup in the future. I found a Juniper EX2300-C switch on EBay last night at an incredible price. The price was so good I purchased 3 of the switches. The unit is fabless, 12 ports and all ports are POE. Will use 1 as my DMZ switch.
-
Especially since it seems your DMZ is all just VMs? So how do you have that connected to your vm host? Assume it has its own nics for the physical connection to the dmz switch.. So your using how many ports on this switch? Seems overkill for a few ports, etc.
I have decided not to use the extra Juniper EX3300 as my DMZ switch. Will save it for my home lab setup in the future. I found a Juniper EX2300-C switch on EBay last night at an incredible price. The price was so good I purchased 3 of the switches. The unit is fabless, 12 ports and all ports are POE. Will use 1 as my DMZ switch.
Attached is a drawing using the EX2300-C switch as my DMZ switch as well as using one of the EX2300 as a POE+ switch connected to my internal LAN network. The EX2300-C has 12 POE+ ports. Please let me know if you agree with how I have the EX2300-C connected to the EX3300 switches. I am trying to avoid any hairpins.
