"Poor man" home network first try
-
This setup (if it works) is bad because your WAN and LAN traffic are traveling over the same connection and there is no separation between them such as VLANs which would create 2 layer 2 segments.
https://en.wikipedia.org/wiki/OSI_modelThat said it could be worse, at least one connection is PPPoE.
If this is just for your own use/experimentation then just be aware of that issue.
Steve
-
@stephenw10 said in "Poor man" home network first try:
This setup (if it works) is bad because your WAN and LAN traffic are traveling over the same connection and there is no separation between them such as VLANs which would create 2 layer 2 segments.
https://en.wikipedia.org/wiki/OSI_modelThat said it could be worse, at least one connection is PPPoE.
If this is just for your own use/experimentation then just be aware of that issue.
Steve
thanks for the article.
This is just a prototype for experimentation, i live in an appartment so it does not really need a network, i just felt like experimenting with what i have to get accustomed to the different things in it and what can be done with it, this is in no way a "red alert" critical thing, but a hobby instead.
i'm doing this to learn the basics and function of pfsense and networking in general since i'm planning to create a full fledged network in the new house for different devices with 2+ nics instead to not use this vlan but it's not the time to talk about hardware really now since it's too early ^^
-
Well break stuff and fix it.
Just be aware that what you're doing is not normal or recommended in a anyway. You will see things that you would not expect to in a correct network setup.
Steve
-
@stephenw10 said in "Poor man" home network first try:
Well break stuff and fix it.
Just be aware that what you're doing is not normal or recommended in a anyway. You will see things that you would not expect to in a correct network setup.
Steve
since you both said that going through the same ethernet port is a bad idea, i started exploring other solutions.
i'm exploring the idea of using the built-in wifi to act as either the lan or the wan part of this network but i doubt this will be functional in any way possible, i'm googling if it is possible in the first place lol.
The other option is somehow getting a second ethernet on this laptop (express34 or usb should suffice)
Any of these methods would fix the security problems right ?
P.S: the future setup will obligatory have a switch and access point to not overcomplicate stuff and for easy management i guess.
-
Yes, any of those options would separate the WAN and LAN of different layer 2 segments.
Wifi support in FreeBSD and hence pfSense is not great. But it may be possible if that is an older device.
What wifi hardware do you have the laptop exactly?Try running
pciconf -lv
to see the exact pci vedot and device ID.Steve
-
@stephenw10 said in "Poor man" home network first try:
Yes, any of those options would separate the WAN and LAN of different layer 2 segments.
Wifi support in FreeBSD and hence pfSense is not great. But it may be possible if that is an older device.
What wifi hardware do you have the laptop exactly?Try running
pciconf -lv
to see the exact pci vedot and device ID.Steve
in the wireless interface, Pfsense detects it as a Ralink RT3090 and gives the following informations on the command shell :
ral0@pci0:5:0:0: class=0x020000 card 0x68911462 chip=0x30901814 rev=0x00 hdr=0x00 rt3090RT3090 RT3090 wireless 802.11n 1T/1R PCIe
-
That will probably work, and it supports hostap mode (running as an access point).
Don't expect very good performance! But for testing it should be OK.
Steve
-
This post is deleted! -
@stephenw10 said in "Poor man" home network first try:
That will probably work, and it supports hostap mode (running as an access point).
Don't expect very good performance! But for testing it should be OK.
Steve
ok good, i'll go look around how to set everything up ^^
And for a 4/1 or a 8/1 internet speed, no matter what i'll throw as minimum equipments it'll be overkill for it that's for sure
-
@aoikite said in "Poor man" home network first try:
I'm sorry if i sound like a stupid person but all the terms you have used, as in layer 2 and layer 3 network are completely stranger to me,
If you don't know the difference between the two, you're going to have difficulty understanding what you're doing. Perhaps you need a basic course in networking. Layer 2 refers to Ethernet these days, and layer 3 is IPv4 and IPv6. Layer 2 refers only to how the frames move between adjacent devices networks and layer 3 is about how packets move between networks.
It might pass the tagged VLAN packets through the switch
Why do so many people think unmanaged switches will have problems passing VLAN frames? The only difference between a VLAN tagged frame and any other Ethernet frame is the contents of the Ethertype field, along with 4 more bytes. A switch should pass all valid Ethernet frames, no matter what the Ethertype is, though some ancient gear may choke on frames with more than 1500 byte payload. If you ever run into that problem, just reduce the MTU by 4 bytes to work around it.
However, configure VLANs and separate them, you need a managed switch.
-
@jknott said in "Poor man" home network first try:
@aoikite said in "Poor man" home network first try:
I'm sorry if i sound like a stupid person but all the terms you have used, as in layer 2 and layer 3 network are completely stranger to me,
If you don't know the difference between the two, you're going to have difficulty understanding what you're doing. Perhaps you need a basic course in networking. Layer 2 refers to Ethernet these days, and layer 3 is IPv4 and IPv6. Layer 2 refers only to how the frames move between adjacent devices networks and layer 3 is about how packets move between networks.
It might pass the tagged VLAN packets through the switch
Why do so many people think unmanaged switches will have problems passing VLAN frames? The only difference between a VLAN tagged frame and any other Ethernet frame is the contents of the Ethertype field, along with 4 more bytes. A switch should pass all valid Ethernet frames, no matter what the Ethertype is, though some ancient gear may choke on frames with more than 1500 byte payload. If you ever run into that problem, just reduce the MTU by 4 bytes to work around it.
However, configure VLANs and separate them, you need a managed switch.
thank you for your explanations, your explanation and the wiki article posted by Steve did help me understand that concept ^^.
To avoid using Vlans at all, i am experimenting with Wireless now , that will make me avoid using vlans, and hopefully it will work if i can establish a PPPOE over wireless.
-
Because this is not an unmanaged switch. Almost all built in switches in soho routers are VLAN capable and can be configured with internal VLANs to separate ports for a second WAN etc. Except no manufacturer firmware allows you to configure that or even see it.
So if that switch is in port vlan mode then sure I expect it to pass tagged traffic but it might be in dot1Q mode just all on the same VLAN in which case it will not. No way to know.Steve
-
Coming back for feedback :
I managed to get it to work, so far so good, not throught Wifi for the second interface, but throught a USB adapter that i used as WAN interface instead, not ideal but hey, at least it's viable for a little project.
the basic setup was like this :
it was sluggish to access the interface of Pfsense for some reason i don't know why but well, i did access it after, but i had no internet on the PC in the beginning, even tho the WAN did establish connection and got an IP.
i did did bridge the WAN and LAN interfaces in Pfsense, and i got internet on the PC after that, but i wonder if it is the best thing to do, i have not touched anything related to NAT or things like that, telling myself maybe Pfsense do it alone ?.
Best regards .
-
You should not bridge the WAN and LAN in pfSense.
The default setup should give you internet connectivity on LAN clients.
Did you get an IP address on the client via DHCP?
Could you ping external sites by IP? By URL?
Could you ping out from the pfSense webgui in Diag > Ping?
Steve
-
@stephenw10 said in "Poor man" home network first try:
You should not bridge the WAN and LAN in pfSense.
The default setup should give you internet connectivity on LAN clients.
Did you get an IP address on the client via DHCP?
Could you ping external sites by IP? By URL?
Could you ping out from the pfSense webgui in Diag > Ping?
Steve
you are right actually, i removed the bridge and it's all working fine without it, the client has access to the internet, pinging google, tested every website i use, all i working fine.
Time to explore packages and more guides about PFsense then.
I have one question tho on the lan side. if i get a dumb or smart switch that has gigabyte ports and stick it to the 10/100 ethernet of the laptop, and wanna transfer files between the lan devices, will it be slowed by the 10/100 port as in they need to go through the router first ? or they do go directly from one device to the other only via the ports of the switch.
P.S: i may still use this laptop as the router in the future house, after some research i did find that i can upgrade its P6100 cpu to a mobile i5-5X0m as they all have Aes support, and dual core with hyperthreading should be enough.
i can't get an expresscard 34 for a gigabyte ethernet for now tho, so i'll use a USB ethernet until that happens.
As for a managed switch, it is not available in my area so i may have to order one online in the future.
-
@aoikite said in "Poor man" home network first try:
I have one question tho on the lan side. if i get a dumb or smart switch that has gigabyte ports and stick it to the 10/100 ethernet of the laptop, and wanna transfer files between the lan devices, will it be slowed by the 10/100 port as in they need to go through the router first ? or they do go directly from one device to the other only via the ports of the switch.
Traffic between devices on the same local LAN will not pass through the router. Bandwidth will be limited by the slowest device involved. So, if your laptop was transferring files through a gigabit switch to a gigabit port on another device, then you'll only get 100 Mb. If between two gigabit devices, then you'd get gigabit throughput.
-
Hello, and Thank you all for your help. now that i made the prototype work, i started working on the real network of our new house and hopefully everything will be okey ^^ and this is how it's gonna look in the end hopefully.
The extra port in the second floor is in case we need mort port to the third floor, and those on the Access point in case we need more in the first floor too.
i'm positive this is gonna work fine, at least i hope and like this i'm gonna have the control i need over the network for bandwidth balancing hopefully.:) .
-
When you say pfsense with AP activated.. Your not thinking of running AP with some wifi nic in pfsense are you? That is just pain waiting to happen... And slow - even in latest freebsd 11.2 that 2.4.4 uses I do not believer there is any AC support even if your card supports it..
-
@johnpoz said in "Poor man" home network first try:
When you say pfsense with AP activated.. Your not thinking of running AP with some wifi nic in pfsense are you? That is just pain waiting to happen... And slow - even in latest freebsd 11.2 that 2.4.4 uses I do not believer there is any AC support even if your card supports it..
Thank you for your feedback ^^.
yes that what i was think about doing for since it has an RT3090 Wireless N Card 802.11 B/g/n , and apparently it supports AP mode, but if it does not work or is just not worth the hassle then i will not do it then , the first floor AP is positioned in such a way that it will cover all the House hopefully (needs testing).
-
@aoikite said in "Poor man" home network first try:
apparently it supports AP mode
Doesn't mean it works in freebsd? You can try it - but it is just so much easier and cleaner to use an actual AP.. Or for that matter some $20 wifi router as just an AP..