Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Help with my pfsense + unifi AP setup

    Scheduled Pinned Locked Moved General pfSense Questions
    24 Posts 4 Posters 9.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rogerkamp8817
      last edited by

      Thanks guys, this is a great community. I'm learning as I go and the explanations are very helpful.

      I have a "Ubiquiti UniFi Switch 8 US-8-60W 8-Port Gigabit Ethernet Managed Switch" on the way. I plan to do vlans.

      1 Reply Last reply Reply Quote 0
      • R
        rogerkamp8817
        last edited by

        I'm playing with what I've got for now as I wait for the new switch. I'm having some issues connecting to my pfsense gateway thru my existing router. Here's how I've got it connected:

        -modem to WAN port of pfsense machine (pulling public IP fine & internet working on my devices)
        -LAN port (192.168.69.1, see earlier post screenshot #1) of the pfsense PC is connected to WAN port of Asus router (current router)
        -Asus router has wifi enabled, with a gateway IP address of 192.168.50.1 and seems to be an IP of 192.168.69.12 from the pfsense machine (wifi works fine and devices connected to this wifi can connect to the internet)
        -Unifi AC pro connected to a LAN port off the Asus router (this wifi connects fine to Asus gateway 192.168.50.1 and internet)

        After I got all this connected, I was intermittently able to connect to the pfsense gateway (192.168.69.1) thru my wifi devices (connected to Asus or Unifi AC Pro wifi). Now, it doesn't seem like I can connect to the pfsense gateway (192.168.69.1) at all thru my wifi devices. Any advice on how I can access the pfsense gateway?

        Thanks in advance!

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          You will want to use your Asus router in access point mode if it has that. Alternatively do this:
          https://docs.netgate.com/pfsense/en/latest/wireless/use-an-existing-wireless-router-with-pfsense.html

          Adding a host override to use the Unifi controller is pretty easy. Go to Services > DNS Resolver. Add a new override something like:
          Selection_835.png

          You probably want the UAP connected directly to pfSense to make sure it's not using the Asus for DNS which may or may not pass that request to pfSense.

          Steve

          1 Reply Last reply Reply Quote 0
          • R
            rogerkamp8817
            last edited by

            I switched my Asus router to access point, but now i can't seem to access its gateway (192.168.50.1) and my IP addresses for my clients are coming from the pfsense. I'd like to maintain access to the Asus gateway and use other features of the Asus router for now (VPN, etc.) and I'm sure i can undo this change (connecting LAN cable to a computer to, going back to the Asus gateway and changing it back to router mode).

            If i did the 2nd option, what would I enter for:
            Parent domain to host?
            IP to return to house (IP address of the Asus router or IP address of the LAN port the Asus router is connected to on the pfsense box?)?

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              If the router is in trues Access Point mode it will no longer have a second subnet. It will only have an IP in the subnet it's connecting to, 192.168.69.0/24 in this case.

              If you leave the Asus in router mode and have the UAP behind it the UAP will probably be using the Asus for DNS. The Asus may forward requests to pfSense or not. To be sure you would want to put the host override in the Asus config.
              The domain used in the host override is usually the default domain pfSense is using. That domain is passed to dhcp clients to use for lookup so the UAP tries to resolve unifi.localdomain or whatever domain is passed to it.

              Steve

              1 Reply Last reply Reply Quote 0
              • R
                rogerkamp8817
                last edited by rogerkamp8817

                I was able to change my Asus router from AP mode back to router mode. I will keep the Unifi AP unplugged for now to remove that from the equation and just use the wifi from my Asus router.

                How can I access my pfsense gateway (192.168.69.1) thru a client (192.168.50.X) connected to the Asus router/wifi (192.168.50.1)?

                I've tried:
                Services > DNS Resolver > added Host override using:
                Host: pfSense (same as System> general setup > host)
                Domain: localdomain (from System > general setup > domain)
                IP to return for host: 192.168.69.1 (is this correct?)

                When I punch in 192.168.69.1 on a client (connected thru the Asus router as 192.168.50.X), I can't get to the pfsense gateway (192.168.69.1). I can get to the Asus router gateway just fine (192.168.50.1).

                Thanks for the patience. I'm sure I'm over complicating this with 2 routers running together. I dont want the pfense to assign IP's yet because various clients have been assigned static IP's my Asus router and I don't want to mess this setup up for now (i.e., wifi printers that were a pain for me to configure).

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  If the Asus is in router mode it should be connected to pfSense via it's WAN port. In that setup you should be able to access the pfSense webgui at it's LAN IP, 192.168.69.1, without making any changes in pfSense.

                  Is the Asus pulling an IP from pfSense on it's WAN via DHCP? Or is it set statically in that subnet correctly?

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • R
                    rogerkamp8817
                    last edited by

                    Connecting to the pfsense gateway thru a device connected to the Asus would work on some device but not others. Weird... The Asus seems to have better speed and range on the 2.4Ghz band than both the nanoHD and the Pro AP's.

                    I received the Unifi Switch 8 and have the nanoHD connected to it now. Currently experimenting on this separate network w/ a few devices then will transitioning most if not all devices onto it.

                    1 Reply Last reply Reply Quote 0
                    • R
                      rogerkamp8817
                      last edited by

                      I'm having some issues getting my WLAN clients to ping to my wireless VLAN clients network... I suspect it has something to do with how the vlan and the unifi switch 8 is talking to each other (conflicting firewall rules or how vlan is being separated from main WLAN?). Here's what I'm doing:

                      -Using pfsense (192.168.69.1, igb0, default "LAN"port), connected to Unifi switch 8 (port 1), connected to Unifi nanoHD access point (POE port 5)
                      -Regular WLAN and VLAN both being broadcasted by the same nanoHD
                      -Raspberry pi 4b as a Unifi controller is connected to Unifiswitch port 8 as 192.168.69.2
                      -I'd like the pfsense to assign IP's and not the Unifi switch 8

                      In pfsense, I've setup a vlan as follows:
                      -Interfaces > interface assignments > vlans > vlan config: parent interface igb0 (same port unifi switch is plugged into), vlan tag: 30, vlan priority 0 (default), description: vlan30 > saved
                      -Interfaces > assignments > assigned VLAN30 to new OPT and renamed it, enabled it, static ipv4 of 192.168.30.1 / 24, saved
                      -Services > DHCP server > VLAN30 > enabled yes > range from 192.168.30.100 to 192.168.30.200, saved
                      -Firewall > Rules > VLAN30> pass, interface vlan30, any, any, any

                      In the Rpi4b Unifi Controller (192.168.69.2 static)
                      -At first, I initially only went to Settings > Wifi Networks > Create New Wireless Network >Named the SSD, entered password, and assigned vlan 30; however wifi devices connected to vlan 30 wasn't getting assigned a proper IP. From the tutorials I was watching, I think this should have worked, but it didn't seem to.
                      -In addition to doing the above bullet, I went to Settings > Wifi Networks > Networks > Named it vlan 30, kept corporate bubble filled, entered vlan ID of 30... After taking this additional step, then it started to assign proper IP's to the vlan connected device.

                      When I ping from the RPi Unifi controller to my WLAN clients (not VLAN clients), it'd ping fine.

                      When I ping from the RPi Unifi controller or ping from other WLAN clients to VLAN clients, there is no connection

                      I would like to see that the VLAN network pings (transfers data) with other networks, before I setup additional firewall rules to prevent transfer (i.e., IoT devices).

                      Screenshot 2020-05-17 16.17.25.png

                      Screenshot 2020-05-17 16.17.22.png

                      Screenshot 2020-05-17 16.17.29.png

                      Screenshot 2020-05-17 16.17.33.png

                      Screenshot 2020-05-17 16.17.53.png

                      Screenshot 2020-05-17 16.23.23.png

                      Screenshot 2020-05-17 16.23.13.png

                      Screenshot 2020-05-17 16.23.01.png

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @rogerkamp8817
                        last edited by

                        What rules do you have on the interfaces... Showing us the specific 1 rule doesn't help... For all we know you have block rfc1918 enabled on that interface..

                        Keep in mind local devices firewalls as well... Just because pfsense allows traffic from 1 vlan to the other, doesn't mean the other devices firewall allows you to ping from that remote network.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        1 Reply Last reply Reply Quote 0
                        • R
                          rogerkamp8817
                          last edited by

                          Thanks for chiming in.

                          The tutorials I was following, it didn't mention anything about RFC 1918 (I left it as default/untouched). As you eluded to, it might be doing something that's preventing my vlan from communicating to non-vlan devices? What should I be changing with my settings to make the vlan devices ping with the non-vlan devices, without opening up my network to the entire internet by mistake? Should I be unchecking one or both of the resrved network check boxes within my WAN?

                          If you need to see any other screenshots, please let me know.

                          Screenshot 2020-05-18 08.43.27.png

                          Screenshot 2020-05-18 08.35.04.png

                          Screenshot 2020-05-18 08.41.50.png

                          Screenshot 2020-05-18 08.45.25.png

                          Screenshot 2020-05-18 08.44.19.png

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @rogerkamp8817
                            last edited by

                            @rogerkamp8817 said in Help with my pfsense + unifi AP setup:

                            If you need to see any other screenshots, please let me know.

                            How about the firewall rules on the interfaces.. You know the ones I specifically asked for ;)

                            What rules do you have on the interfaces.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            1 Reply Last reply Reply Quote 0
                            • R
                              rogerkamp8817
                              last edited by

                              here you go! let me know if i'm still missing something...

                              Screenshot 2020-05-18 08.45.25.png

                              Screenshot 2020-05-18 08.54.05.png

                              Screenshot 2020-05-18 08.54.12.png

                              Screenshot 2020-05-18 08.54.26.png

                              Screenshot 2020-05-18 08.54.53.png

                              Screenshot 2020-05-18 08.55.27.png

                              Screenshot 2020-05-18 08.55.42.png

                              Screenshot 2020-05-18 08.55.43.png

                              Screenshot 2020-05-18 08.56.02.png

                              Screenshot 2020-05-18 08.56.06.png

                              Screenshot 2020-05-18 08.56.13.png

                              Screenshot 2020-05-18 08.56.16.png

                              Screenshot 2020-05-18 08.56.18.png

                              Screenshot 2020-05-18 08.56.39.png

                              Screenshot 2020-05-18 08.56.51.png

                              Screenshot 2020-05-18 08.56.54.png

                              Screenshot 2020-05-18 08.56.59.png

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by johnpoz

                                OMG!!! dude post up the rules so we can see their order

                                rules.jpg

                                I shouldn't have to scroll through a hundred pages to see the info needed ;)

                                So your vlan rule is any any.. So if you can not ping some device in your lan - it would SCREAM that devices firewall.. Can you ping the pfsense lan IP from your vlan?

                                Simple test sniff on your lan interface while you say try and ping something in the lan from you vlan.. Do you see the traffic go out to the device from pfsense.. If so - if there is no answer, then its firewall on the device your trying to talk too.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                1 Reply Last reply Reply Quote 0
                                • R
                                  rogerkamp8817
                                  last edited by

                                  Turns out I couldn't ping from one network to the next due to my client's firewall blocking it. Temporarily turning off windows 10 firewall allowed it to ping from 192.169.69.XX to 192.169.30.XX.

                                  Over the past couple weeks, I've been trying to get my PIA VPN setup but I am running into significant slow down issues when the VPN is turned on. I've tried MANY different combinations and followed 5-6 different tutorials from scratch and still not finding a VPN config that gets me more reasonable VPN speeds.

                                  My internet is 1gig down and 36mpbs up. The up seems okay, but when the VPN is turned on, the down speed drops to anywhere from 10mpbs to ~80 mpbs at best. This is on a hardwared lan connection and running a fitlet2 minipc w/ Celeron J3455, 4gb of ram, and 32gb of SSD. It seems I can get it to work closer to 80 mpbs down when I mess with the encryption settings but 80 mpbs is way too slow for what I think this CPU was capable of. The upload speed seems fine.

                                  I've tried different settings, ranging from AES-128-CBC, GSM, diff hardware cryptos (BSD crypto... & IntelRDAND), different VPN servers, different ports...

                                  Can anyone provide some feedback on what I might be doing wrong?

                                  Thanks in advance!! Sorry for all the screenshots.

                                  Screenshot 2020-05-28 20.33.11.png

                                  Screenshot 2020-05-28 20.29.41.png

                                  Screenshot 2020-05-28 20.29.50.png

                                  Screenshot 2020-05-28 20.29.55.png

                                  Screenshot 2020-05-28 20.30.20.png

                                  Screenshot 2020-05-28 20.30.23.png

                                  Screenshot 2020-05-28 20.30.28.png

                                  Screenshot 2020-05-28 20.30.31.png

                                  Screenshot 2020-05-28 20.30.53.png

                                  Screenshot 2020-05-28 20.32.23.png

                                  Screenshot 2020-05-28 20.32.11.png

                                  Screenshot 2020-05-28 20.32.19.png

                                  Screenshot 2020-05-28 20.32.34.png

                                  Screenshot 2020-05-28 20.44.59.png

                                  Screenshot 2020-05-28 20.45.08.png

                                  Screenshot 2020-05-28 20.45.12.png

                                  Screenshot 2020-05-28 20.45.14.png

                                  Screenshot 2020-05-28 20.47.44.png

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Using AES-128-GCM with hardware crypto set to none should be fastest there as long as the other end supports it and it looks like they do.
                                    You should enable FastIO and set Send/Recv buffers to 512K which will probably be faster.

                                    You CPU is showing a maximum frequency of 1501MHz which indicates 'turbo mode', is that actually enabled though? You could try enabling powerd which is required for some CPUs to see full speed.

                                    You need to run at the command line top -aSH whilst you're testing to see how the CPU is loaded. If it's hitting 100% on one core that's all you can get.

                                    Steve

                                    R 1 Reply Last reply Reply Quote 0
                                    • R
                                      rogerkamp8817 @stephenw10
                                      last edited by

                                      @stephenw10

                                      i started from scratch with the fitlet2 and an old dell optiplex w/ 4 port intel NIC, using the same vpn settinsg. the dell optiplex is having no issues with VPN on. I think its either the fitlet2 j3455 cpu not liking the encryption or perhaps one of the settings you mentioned will fix it...

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        The J3455 is not powerful CPU but I would expect it to push more then 100Mbps of OpenVPN given a reasonable connection to the server.
                                        You have to check top -aSH though to know what's limiting it.

                                        Steve

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.