A coupe routing questions.

lovingHDTV · Dec 17, 2017, 1:32 PM

I'm trying to take the next step on isolating guests and IOT devices from my LAN network. I attached a picture of what I'm trying to accomplish. Today I have it all working, except for the WAP device and being able to access Guest and IOT from LAN. Today the WAP device is just plugged into port 2, so it is all tagged as VLAN Guest.

Now I'd like to do a couple things.

1. how do I see everything on Guest and IOT from LAN? I did put in a firewall rule on both Guest and IOT to allow any connections that are not of destination LAN, so that keeps Guest and IOT traffic off LAN. I then did allow access to my PLEX server from those two networks. However, I cannot see anything on those networks from LAN. How do I add this? I thought I had read that with pfSense that should happen automatically?

2. I'd also like to add the multiple SSIDs to the WAP and get them working. I know how to setup the WAP with the SSIDs and get them tagged, but I'm just not sure what I need to do with port 8. Is it as simple as adding port 8 to the Guest and IOT VLAN definition and mark it as a tagged port? My expectation would be that all packets to the WAP will be tagged either 2, 10 coming in and everything else will get the default 1 (This would be the PVID setting I set for port 8).

thanks,
david

johnpoz · Dec 17, 2017, 2:27 PM

Why are you tagging 1 to lan of pfsense?

I would assume you have your lan interface native interface set to 192.168.1.x/24
Then on this physical interface of pfsense you have vlan 10 and 2 setup..

So port 1 of your switch would tag 10 and 2, and 1 would be untagged. Then the same setup would be on your port 8 to your AP..

lovingHDTV · Dec 17, 2017, 9:31 PM

The only way to get my TP-Link switch to work, was to set port 1 as a tagged port within each VLAN. The switch then tags any egress data from port 1 with the appropriate VLAN ID. I can verify this works using tcpdump.

For now I have a device plugged directly into port 4, so the packets coming in port 4 and leaving port 1 get tagged with VLAN 10. Additionally I also have the WAP with only 1 SSID (Guest). It is plugged into port 2 and when it leave port 1 get tagged with VLAN 2.

I now want to add wireless access to VLAN IOT because I'm getting a wireless thermostat installed. So I need to add the additional SSIDs to the WAP and get them hooked up to the switch correctly.

One way is to have each SSID on the WAP be directed out a dedicated port on the WAP and then connect the WAP to the switch with three cables, but that takes a lot of ports. I was hoping to be able to maintain a single connection between the WAP and the switch. I'm just not sure how to do it.

david

Derelict · Dec 17, 2017, 10:06 PM

Good ole tp-link

johnpoz · Dec 17, 2017, 10:44 PM

That is a tp-link 108e… Yeah get a different switch... Those are utter crap, they do not actually do vlans... Evey port has vlan 1 on it..