Create a guest network with VLAN tag 1003
-
My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..
https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs -
My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..
https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANsThanks. I think I’ve kinda got my head wrapped around the basics of the tag routing now. Having a family day today, but I’ll give it a shot tomorrow and see if I can get it to work.
Thanks to everyone for your help so far.
-
My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..
https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANsThanks. I think I’ve kinda got my head wrapped around the basics of the tag routing now. Having a family day today, but I’ll give it a shot tomorrow and see if I can get it to work.
Thanks to everyone for your help so far.
Well that didn't turn out too good. I created a VLAN10 (pvid 10) on my switch with associated ports tagged. Created VLAN10_MAIN on my firewall for approved laptops and other wireless devices and created VLAN1003_Guest for guest use.
VLAN1003 should have no access to local network. Only internet. I believe that's working.
VLAN10 needs to have full access to the local network as well as the internet. I can get access to the internet but not the local network.
I'm hoping I've just missed a rule or misconfigured one?
-
No way to know without knowing what that LOCAL_NETWORKS Alias and those port aliases are. Those rules don't make much sense.
What are you trying to do here?
I personally despise "blocking" traffic with pass ! rules. Hate it. Loathe it. Wish it would die in a fire.
If you want to block it, just block it. Then pass any.
 -
No way to know without knowing what that LOCAL_NETWORKS Alias and those port aliases are. Those rules don't make much sense.
What are you trying to do here?
I personally despise "blocking" traffic with pass ! rules. Hate it. Loathe it. Wish it would die in a fire.
If you want to block it, just block it. Then pass any.
local_subnets
These rules aren't mine really. Straight from a guide. Would be glad for any suggestions to simplify them.
As far as what I want to accomplish. I have 2 airports that are configured with a WPA2 “Home Network” which works and a “Guest Network” which shows “no internet”. I’m trying to setup a vlan that will allow guest connections to DHCP server and WAN only, without interfering with the “Home Network” which needs full access to local networks.
-
Just because it's in a "guide" doesn't mean it's correct.
You only gave half the picture. What destination ports are you passing?
-
Just because it's in a "guide" doesn't mean it's correct.
You only gave half the picture. What destination ports are you passing?
Not sure what you mean by destination ports?
-
-
I would disable those rules and add a pass any any rule. Does it work? Then you are not passing traffic you need to pass.
You do realize that you will be unable to ping with that configuration because it is not passed, right?
I can be confident that pfSense is behaving exactly as it is being instructed to behave.
Check the firewall logs for what is being blocked and evaluate whether it should be passed and pass it or don't.
-
I would disable those rules and add a pass any any rule. Does it work? Then you are not passing traffic you need to pass.
Thanks. Makes a lot of sense. Maybe one of these days I’ll learn to quit following these online step-by-step guides.
-
Think I've got everything working now. Thanks @Derelict. Guest network has access to DHCP Server and WAN but no access to firewall or LAN (only other local network currently).
The firewall rules may need some tweaking. Any advice? I checked pinging, that works.
Edit: Caught my mistake with the "Block LAN Access" rule order. It's now one above "Allow Any".
-
Your Allow any rule will pass all traffic and nothing below it will have any effect.
-
Your Allow any rule will pass all traffic and nothing below it will have any effect.
Are you saying I should modify “allow any” or delete the rules below it? Or both?
-
What he is saying is rules are evaluated top down, first rule to trigger wins - no other rules are evaluated.
Anything below an any any allow is pointless since no traffic will ever make it to that rule since the any any allow will pass the traffic. You need to place your rules in the correct order top down so they evaluate how you want them to evaluate.
-
Thanks. Actually, I understood that. Should have been more specific.
I can see that the default block rules aren’t going to do anything. If I move the any-any rule below them then it won’t do anything. Since I’m a noob at this, I’m not sure if I should modify the any-any rule or just delete the default block rules? My intent with this rule is to allow unlimited acces to the internet.
-
there is a default deny rule anyway.. There is no reason to create your own rule unless have turned off logging of the default rule and would still like to log stuff that makes it through your rules that you block that meet some specific criteria you setup in the block rule that would be different than default deny, etc. Or if you only want to log stuff on specific lan side interfaces and have turned off the logging of the default deny rule that is on all interfaces.
