Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Help with my pfsense + unifi AP setup

    Scheduled Pinned Locked Moved General pfSense Questions
    24 Posts 4 Posters 9.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rogerkamp8817
      last edited by rogerkamp8817

      I'm trying to setup a new home network using pfsense and a unifi AP nanoHD access point and I think I'm missing some important or obvious steps to get my access point going... here's what I'm working with:

      Fitlet2 mini-pc with 4 NIC ports:
      -"Eth1" port = wan = igb2 = disconnected (haven't connected to modem yet)
      -"Eth2" port = opt1 = igb1 = disconnected
      -Facet 2 added LAN "left" port = opt1 = LAN = igb0 = connected to LAN port of desktop PC
      -Facet 2 added LAN "right" port = opt2= LAN = igb3 = connected to Unifi AP nanoHD

      I've installed pfsense on the fitlet2 PC (with the 3 bios settings disabled as required for this mini pc) and can login into the pfsense accnt thru the desktop PC (LAN igb0) and static IP address of the fitlet2 PC.

      I've physically/directly connected the nanoHD to opt2 and setup a firewall rule to pass all (action "pass" and protocol "any" for OPT2 in Firewall > Rules > OPT2)

      I've got the Unifi controller software installed on my desktop PC (connected via ethernet on igb0), but when i go to "devices" within the Unifi controller, I don't see the access point. I've also tried the android mobile app on my phone to setup the nanoHD (underneath standalone devices where it appears), but when I click on it while its physically connected to the pfsense mini pc, I get an error (couldn't connect to the device, retry error)). I know the access point works fine because it works as it should when I connect it to my pre-existing home network/router that I'm trying to replace. I'm not totally clear on the purpose of the Unifi Network controller honestly and why I can't seem to just setup the access point thru the android mobile app as a standalone device, like I've done successfully with an Access Point Pro that's currently on my existing/current running home network.

      I'm wondering if the pfense mini PC is really assigning an IP address to the nanoHD.

      I've been watching hours of youtube videos and I'm stuck. I've tried reinstalling pfsense completely on the mini PC once as well. I've tried the reset button on the nanoHD a couple times. Thanks for your help in advance.

      My goals are to:

      1. Get the access point working first of all...
      2. Setting up internal LAN wifi thru this access point
      3. Setting a guest wifi with limited access to internal LAN wifi thru this access point
      4. Setup PIA VPN (with all connections going thru VPN as default, killswitch if VPN is off, and select devices that don't go thru VPN)

      Screenshot 2020-05-09 08.06.20.png

      Screenshot 2020-05-09 08.09.14.png Screenshot 2020-05-09 08.08.44.png Screenshot 2020-05-09 08.08.14.png Screenshot 2020-05-09 08.15.09.png

      1 Reply Last reply Reply Quote 0
      • R
        rogerkamp8817
        last edited by

        I setup a 2nd computer (Dell Optiplex 9010 w/ intel gig 4 port nic) to try instead the Fitlet2 and running into the same problem. What am I missing here?

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Check Status > DHCP leases to make sure the AP is pulling an IP address from pfSense.

          The issue here is that by default the AP tries to find the controller in the same subnet but because you have put it on a different interface you need to tell it the IP address if the controller.

          Two ways I'm aware of to do this:
          You can SSH to the AP and edit the config file there to include a line for the unifi controller.

          You can add a host override for unifi in the pfSense DNS resolver and set that for the address of the controller. The AP will try to resolve it and then find the controller as long as you have firewall rules to allow it. Which you do as long as you apply those changes.

          Steve

          1 Reply Last reply Reply Quote 0
          • R
            rogerkamp8817
            last edited by

            Thank you for the reply.

            It sounds more complicated than I thought.

            Would using a Unifi Switch 8 fix my issue? Would I just connect this switch to one of the pfsense computer's LAN ports, then connect the AP & the desktop PC to the that switch?

            If that's the case, I guess I didn't need to buy the Facet add-on card for the Fitlet2 to add 2additional ports (4 total) to the Fitlet2 & could have just the 2 ports it came with (1 Wan, 1 LAN).

            R 1 Reply Last reply Reply Quote 0
            • R
              riften @rogerkamp8817
              last edited by

              @rogerkamp8817
              Extra ports on the PFSense box provides you different networks, so if your goal is to have the wireless on a different network from the desktops, that it will do. But the controller software and access points need to be on the same network by default. Otherwise, as stephenw10 said, you would need a host override in PFSense DNS to 'direct' the AP to the controller computer. I just setup my new AC PRO yesterday and yep, my controller computer is on a different vlan from the AP. I use Microsoft DNS servers and setup their version of a host override on DNS and it worked great. In your case, it sounds like a switch might be the way to go.
              I just took a look at the PFSense host override setting and it looks like you need to set a static IP on the computer, then set the host override on the DNS Resolver/General Settings page. Fill in the computer name, domain name ("local" if not on a domain) and IP, then below the additional name of 'unifi'. That should work. You might want to give it a try. But if having different networks is not the goal here, getting a switch is probably a better way to go overall. It does not need to be a Ubiquity switch BTW. I use Netgear switches and have been very happy with them.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                As others have mentioned there are many ways to get the L3 adoption to work.. When your going to put the controller on different L2 than the AP... You have to use L3 adoption.

                https://help.ui.com/hc/en-us/articles/204909754-UniFi-Device-Adoption-Methods-for-Remote-UniFi-Controllers

                But its much easier to put the controller on the same L2.. If you need a switch to do that, they are cheap.. It does not have to be unifi.. Any smart switch will work, if your going to run AP that can do vlans, its just stupid to not get a switch that can also do them... A smart 8 port gig switch can be hand for like $40.. just stay away from tplink.. They should have it fixed by now, but their low end didn't actually do vlans.. they wouldn't let you remove vlan 1 from ports..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • R
                  rogerkamp8817
                  last edited by

                  Thanks guys, this is a great community. I'm learning as I go and the explanations are very helpful.

                  I have a "Ubiquiti UniFi Switch 8 US-8-60W 8-Port Gigabit Ethernet Managed Switch" on the way. I plan to do vlans.

                  1 Reply Last reply Reply Quote 0
                  • R
                    rogerkamp8817
                    last edited by

                    I'm playing with what I've got for now as I wait for the new switch. I'm having some issues connecting to my pfsense gateway thru my existing router. Here's how I've got it connected:

                    -modem to WAN port of pfsense machine (pulling public IP fine & internet working on my devices)
                    -LAN port (192.168.69.1, see earlier post screenshot #1) of the pfsense PC is connected to WAN port of Asus router (current router)
                    -Asus router has wifi enabled, with a gateway IP address of 192.168.50.1 and seems to be an IP of 192.168.69.12 from the pfsense machine (wifi works fine and devices connected to this wifi can connect to the internet)
                    -Unifi AC pro connected to a LAN port off the Asus router (this wifi connects fine to Asus gateway 192.168.50.1 and internet)

                    After I got all this connected, I was intermittently able to connect to the pfsense gateway (192.168.69.1) thru my wifi devices (connected to Asus or Unifi AC Pro wifi). Now, it doesn't seem like I can connect to the pfsense gateway (192.168.69.1) at all thru my wifi devices. Any advice on how I can access the pfsense gateway?

                    Thanks in advance!

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      You will want to use your Asus router in access point mode if it has that. Alternatively do this:
                      https://docs.netgate.com/pfsense/en/latest/wireless/use-an-existing-wireless-router-with-pfsense.html

                      Adding a host override to use the Unifi controller is pretty easy. Go to Services > DNS Resolver. Add a new override something like:
                      Selection_835.png

                      You probably want the UAP connected directly to pfSense to make sure it's not using the Asus for DNS which may or may not pass that request to pfSense.

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • R
                        rogerkamp8817
                        last edited by

                        I switched my Asus router to access point, but now i can't seem to access its gateway (192.168.50.1) and my IP addresses for my clients are coming from the pfsense. I'd like to maintain access to the Asus gateway and use other features of the Asus router for now (VPN, etc.) and I'm sure i can undo this change (connecting LAN cable to a computer to, going back to the Asus gateway and changing it back to router mode).

                        If i did the 2nd option, what would I enter for:
                        Parent domain to host?
                        IP to return to house (IP address of the Asus router or IP address of the LAN port the Asus router is connected to on the pfsense box?)?

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          If the router is in trues Access Point mode it will no longer have a second subnet. It will only have an IP in the subnet it's connecting to, 192.168.69.0/24 in this case.

                          If you leave the Asus in router mode and have the UAP behind it the UAP will probably be using the Asus for DNS. The Asus may forward requests to pfSense or not. To be sure you would want to put the host override in the Asus config.
                          The domain used in the host override is usually the default domain pfSense is using. That domain is passed to dhcp clients to use for lookup so the UAP tries to resolve unifi.localdomain or whatever domain is passed to it.

                          Steve

                          1 Reply Last reply Reply Quote 0
                          • R
                            rogerkamp8817
                            last edited by rogerkamp8817

                            I was able to change my Asus router from AP mode back to router mode. I will keep the Unifi AP unplugged for now to remove that from the equation and just use the wifi from my Asus router.

                            How can I access my pfsense gateway (192.168.69.1) thru a client (192.168.50.X) connected to the Asus router/wifi (192.168.50.1)?

                            I've tried:
                            Services > DNS Resolver > added Host override using:
                            Host: pfSense (same as System> general setup > host)
                            Domain: localdomain (from System > general setup > domain)
                            IP to return for host: 192.168.69.1 (is this correct?)

                            When I punch in 192.168.69.1 on a client (connected thru the Asus router as 192.168.50.X), I can't get to the pfsense gateway (192.168.69.1). I can get to the Asus router gateway just fine (192.168.50.1).

                            Thanks for the patience. I'm sure I'm over complicating this with 2 routers running together. I dont want the pfense to assign IP's yet because various clients have been assigned static IP's my Asus router and I don't want to mess this setup up for now (i.e., wifi printers that were a pain for me to configure).

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              If the Asus is in router mode it should be connected to pfSense via it's WAN port. In that setup you should be able to access the pfSense webgui at it's LAN IP, 192.168.69.1, without making any changes in pfSense.

                              Is the Asus pulling an IP from pfSense on it's WAN via DHCP? Or is it set statically in that subnet correctly?

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • R
                                rogerkamp8817
                                last edited by

                                Connecting to the pfsense gateway thru a device connected to the Asus would work on some device but not others. Weird... The Asus seems to have better speed and range on the 2.4Ghz band than both the nanoHD and the Pro AP's.

                                I received the Unifi Switch 8 and have the nanoHD connected to it now. Currently experimenting on this separate network w/ a few devices then will transitioning most if not all devices onto it.

                                1 Reply Last reply Reply Quote 0
                                • R
                                  rogerkamp8817
                                  last edited by

                                  I'm having some issues getting my WLAN clients to ping to my wireless VLAN clients network... I suspect it has something to do with how the vlan and the unifi switch 8 is talking to each other (conflicting firewall rules or how vlan is being separated from main WLAN?). Here's what I'm doing:

                                  -Using pfsense (192.168.69.1, igb0, default "LAN"port), connected to Unifi switch 8 (port 1), connected to Unifi nanoHD access point (POE port 5)
                                  -Regular WLAN and VLAN both being broadcasted by the same nanoHD
                                  -Raspberry pi 4b as a Unifi controller is connected to Unifiswitch port 8 as 192.168.69.2
                                  -I'd like the pfsense to assign IP's and not the Unifi switch 8

                                  In pfsense, I've setup a vlan as follows:
                                  -Interfaces > interface assignments > vlans > vlan config: parent interface igb0 (same port unifi switch is plugged into), vlan tag: 30, vlan priority 0 (default), description: vlan30 > saved
                                  -Interfaces > assignments > assigned VLAN30 to new OPT and renamed it, enabled it, static ipv4 of 192.168.30.1 / 24, saved
                                  -Services > DHCP server > VLAN30 > enabled yes > range from 192.168.30.100 to 192.168.30.200, saved
                                  -Firewall > Rules > VLAN30> pass, interface vlan30, any, any, any

                                  In the Rpi4b Unifi Controller (192.168.69.2 static)
                                  -At first, I initially only went to Settings > Wifi Networks > Create New Wireless Network >Named the SSD, entered password, and assigned vlan 30; however wifi devices connected to vlan 30 wasn't getting assigned a proper IP. From the tutorials I was watching, I think this should have worked, but it didn't seem to.
                                  -In addition to doing the above bullet, I went to Settings > Wifi Networks > Networks > Named it vlan 30, kept corporate bubble filled, entered vlan ID of 30... After taking this additional step, then it started to assign proper IP's to the vlan connected device.

                                  When I ping from the RPi Unifi controller to my WLAN clients (not VLAN clients), it'd ping fine.

                                  When I ping from the RPi Unifi controller or ping from other WLAN clients to VLAN clients, there is no connection

                                  I would like to see that the VLAN network pings (transfers data) with other networks, before I setup additional firewall rules to prevent transfer (i.e., IoT devices).

                                  Screenshot 2020-05-17 16.17.25.png

                                  Screenshot 2020-05-17 16.17.22.png

                                  Screenshot 2020-05-17 16.17.29.png

                                  Screenshot 2020-05-17 16.17.33.png

                                  Screenshot 2020-05-17 16.17.53.png

                                  Screenshot 2020-05-17 16.23.23.png

                                  Screenshot 2020-05-17 16.23.13.png

                                  Screenshot 2020-05-17 16.23.01.png

                                  johnpozJ 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @rogerkamp8817
                                    last edited by

                                    What rules do you have on the interfaces... Showing us the specific 1 rule doesn't help... For all we know you have block rfc1918 enabled on that interface..

                                    Keep in mind local devices firewalls as well... Just because pfsense allows traffic from 1 vlan to the other, doesn't mean the other devices firewall allows you to ping from that remote network.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      rogerkamp8817
                                      last edited by

                                      Thanks for chiming in.

                                      The tutorials I was following, it didn't mention anything about RFC 1918 (I left it as default/untouched). As you eluded to, it might be doing something that's preventing my vlan from communicating to non-vlan devices? What should I be changing with my settings to make the vlan devices ping with the non-vlan devices, without opening up my network to the entire internet by mistake? Should I be unchecking one or both of the resrved network check boxes within my WAN?

                                      If you need to see any other screenshots, please let me know.

                                      Screenshot 2020-05-18 08.43.27.png

                                      Screenshot 2020-05-18 08.35.04.png

                                      Screenshot 2020-05-18 08.41.50.png

                                      Screenshot 2020-05-18 08.45.25.png

                                      Screenshot 2020-05-18 08.44.19.png

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @rogerkamp8817
                                        last edited by

                                        @rogerkamp8817 said in Help with my pfsense + unifi AP setup:

                                        If you need to see any other screenshots, please let me know.

                                        How about the firewall rules on the interfaces.. You know the ones I specifically asked for ;)

                                        What rules do you have on the interfaces.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          rogerkamp8817
                                          last edited by

                                          here you go! let me know if i'm still missing something...

                                          Screenshot 2020-05-18 08.45.25.png

                                          Screenshot 2020-05-18 08.54.05.png

                                          Screenshot 2020-05-18 08.54.12.png

                                          Screenshot 2020-05-18 08.54.26.png

                                          Screenshot 2020-05-18 08.54.53.png

                                          Screenshot 2020-05-18 08.55.27.png

                                          Screenshot 2020-05-18 08.55.42.png

                                          Screenshot 2020-05-18 08.55.43.png

                                          Screenshot 2020-05-18 08.56.02.png

                                          Screenshot 2020-05-18 08.56.06.png

                                          Screenshot 2020-05-18 08.56.13.png

                                          Screenshot 2020-05-18 08.56.16.png

                                          Screenshot 2020-05-18 08.56.18.png

                                          Screenshot 2020-05-18 08.56.39.png

                                          Screenshot 2020-05-18 08.56.51.png

                                          Screenshot 2020-05-18 08.56.54.png

                                          Screenshot 2020-05-18 08.56.59.png

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            OMG!!! dude post up the rules so we can see their order

                                            rules.jpg

                                            I shouldn't have to scroll through a hundred pages to see the info needed ;)

                                            So your vlan rule is any any.. So if you can not ping some device in your lan - it would SCREAM that devices firewall.. Can you ping the pfsense lan IP from your vlan?

                                            Simple test sniff on your lan interface while you say try and ping something in the lan from you vlan.. Do you see the traffic go out to the device from pfsense.. If so - if there is no answer, then its firewall on the device your trying to talk too.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.