Isolation IPs from the wired network of the same subnet
-
At work, I currently have a MikroTik up and running. But for several reasons, I intend to switch to PfSense, but I have a difficulty, even by not mastering it.
Today the devices of the wired network only have connection to the internet, do not communicate with each other.
The configuration on MikroTik is done with a / 32 on DHCP, but I can not change this configuration in PfSense, nor create effective firewall rules for the same subnet.
How do I stop devices from communicating? -
Devices on the same subnet communicate directly with each other, simply through the switch they hang of off. No router involved, that only begins to work for communications outside the subnet.
Depending on your switch you might be able to configure something like "Private VLANs" or private ports which does what you want: hosts can only reach the gateway. But it's a switch thing.
Trying to do this with netmask-fiddling is only wannabe, not know-how. -
Good morning Jahonix,
Is that in MikroTik settings when using a "fake mask" / 32, devices that receive ip from the DHCP server, will get the mask 255.255.255.255.
So, they are isolated and even having the communication through the switch, they can not see. And now how it works with MikroTik, it's complicated for me to justify that to migrate to PfSense it will be necessary to acquire a manageable switch (which in our case is 48 ports) for the creation of vlans.
I've really tried everything and I did not get this same result with PfSense. -
@jotagsoares said in Isolation IPs from the wired network of the same subnet:
they are isolated
Actually they aren't, they just seem to be.
Imagine a room with 10 people standing in a row, all having binoculars and all they can see is the same distant point. You could argue that, since they cannot see each other, everyone is alone in that space. Having the bigger picture you clearly see this is not the case.
Now you decide if you want it to look like being separated or actually being separated.Having said that, why do you need all devices on a 48-port switch to be separated from each other, what's the use case?
-
I need devices connected to the wired network cannot communicate, just browsing the internet. As in the isolation of the AP, no matter how many are connected, just ping the Gateway and access the cloud.
It's a security issue, which as I said earlier, today it works, but with other software. -
Isolating wired devices in the same network would be done with a private vlan - any decent managed/smart switch would should support this. AS jahonix already mentioned.
What 48 port switch are you using?
A /32 mask with devices on the same layer 2 is not "isolation"..
-
Sorry johnpoz, I think expressed myself wrong. I don't know exactly if it is isolation, but it happens that today a desktop connected to the wired network can't ping or share folders with others. So theoretically it is "isolated", I just need it in PfSense to continue so I can migrate, but I still cannot solve this issue.
-
@jotagsoares said in Isolation IPs from the wired network of the same subnet:
As in the isolation of the AP
There it's already done the way I proposed. Why would you want to do it differently on a wired network?
@jotagsoares said in Isolation IPs from the wired network of the same subnet:
but I still cannot solve this issue
Get a managed switch that can do private VLANs.
Did you read and understand my previous post (then use
on that post) or was my time spent explaining it effectively useless? -
@jotagsoares said in Isolation IPs from the wired network of the same subnet:
but it happens that today a desktop connected to the wired network can't ping or share folders with others.
Not true at all.. Your just running multiple layer 3 on the same layer 2 with that mask.. It is no way isolated...
Lets ask again =- what 48 port switch are you currently using?? Or thinking of getting - your using what currently??
it will be necessary to acquire a manageable switch (which in our case is 48 ports) for the creation of vlans.
You could mask /32 all you want on your clients - It's not ISOLATED... its NOT!!! Just how your client can talk to the gateway which is NOT inside it's /32 mask - it could talk to ANY device on that same layer 2..
I can suggest a 48 port switch if you want that supports private vlans. You might also do it with port security - but be much more pita to setup and maintain if devices move around.
-
In short, you mean that the only way to isolate clients in a wired network is with VLANS?
-
You can isolate networks with vlans. What your wanting to do is isolate clients on the same network - this is called a private vlan..
https://en.wikipedia.org/wiki/Private_VLAN
-
@jotagsoares said in Isolation IPs from the wired network of the same subnet:
you mean that the only way to isolate clients in a wired network is with VLANS?
Didn't I tell you already? Man...
-
Yeah you did ;)
Maybe this analogy will help. You setting a /32 bit mask would be like putting blinders on a horse... While the horse might not think there are other horses next to it while its running. The jockey sure can see them - ie the user ;) So unless your user is as stupid as a horse ;)
Your not getting anything be using some mask trick to try and keep these machines from talking to each other. The users are still on the same wire, be it you change their mask or not.. If you want to isolated them that is down on the switch level. Has zero to do with pfsense or the dhpcd and what mask you hand out.
-
@jahonix This maybe a non-standard feature of Microtik that can't be easily replicated with a pfsense.
-
@sammywoo It's not a "non-standard feature", it's bullshit. Security by obscurity has never proven to be good.
-
bullshit is a good word to describe such nonsense for sure. Shit windows and many os'es would bitch at you trying to set a gateway when you have a /32 bit mask. Since any gateway you set would be outside your mask.
That fact that you can use the internet, ie talk to your gateway which is outside your mask - shows you that you can talk to other devices ;)
So why would you think you could not talk to other devices on the same wire?
-
What device is actually providing the WiFi?
Even with most dumb switches (as many pass VLAN tags without messing with them) you should be able to tell the the WiFi AP to use a different network and VLAN for the traffic back to the pfSense box where you can ensure isolation. Or plug it into its own LAN port on the pfSense box.
-
As others have said, the proper way to do this is at layer 2. In the switch or in the wifi gear.
MikroTik might have some mechanism for this, considering their attempted penetration into the WISP markets but, in some form or another, it will boil down to layer 2 isolation.
If you have host A on 192.168.1.100/24 and host B on 192.168.1.101/24 and both are on the same local network, the only way they cannot communicate is isolation at layer 2.
If you can come back with more details about what Mikrotik is actually doing we might be able to help develop an alternative. But it will likely be in your switching layer, not at the firewall itself.
-
Indeed, I have a bit of an isolation hack on my own network as I share it with some friends.
All four ports on pfSense are bridged and I enabled packet filtering on that bridge. I then have a firewall rule that allows my friends static IPs to only talk to the firewall itself, so while some broadcast traffic might slip through (I only have it blocked in one direction) they can't accidentally ChromeCast to my TV like they did once.
But honestly, if all you need is full isolation then its just easier to have it on a completely different LAN. Although that will not isolate the WiFi clients from each other, that has to be done in the WiFi access point itself.
-
Depends. Layer 2 isolation is a valuable tool especially in public access environments such as hotels, etc.
That said, any leverage of a pfSense bridge to accomplish the task is likely pretty far from an optimal solution.
