Building my lan: do I need a managed switch for my VLANs?
-
First off, you have to decide what's going on the VLANs and then plan from there. For example, I use a VLAN for guest WiFi and the 2nd SSID connects via a VLAN. In offices, VLANs are often used for VoIP phones, etc..
Then, once you've done that you have to ensure you use the same VLANs throughout, from pfsense to the switches, to whatever devcie, such as AP, etc..
-
@valepe69
How is it going , with the switch & Vlans -
@bingo600 Sorry, I haven't do anything yet. My times are stretching sometimes due to four little kids
-
@valepe69 said in Building my lan: do I need a managed switch for my VLANs?:
@bingo600 Sorry, I haven't do anything yet. My times are stretching sometimes due to four little kids
Whoaa
Configuring a few Vlans should be easy, compared to 4 small kids
Take care
/Bingo
-
@bingo600 yeah, I think so but some evenings I prefer the sofa to the pfSense box...
After VLANs, my next goal is to set the hairpin equivalent: DNS resolver (I read that I can't use forwarder because resolver is used by pfblockerng).
Luckily holidays are coming...
-
@valepe69 said in Building my lan: do I need a managed switch for my VLANs?:
set the hairpin equivalent: DNS resolver
huh? Resolver works and is the default out of box - there is nothing to do really. What do you mean by hairpin?
-
@johnpoz now I have an edgerouter. The hairpin Nat allows the clients to reach an internal server using the public domain.
I read that I should use DNS resolver to do that in pfSense. Am I right? -
ah you mean nat reflection..
You can continue to do nat reflection if you want. But better solution is just split dns, ie a host override. This can be done with unbound or the forwarder.
BTW, while unbound resolves out of the box. If you really have your heart set on forwarding - unbound can be set to forward as well.
-
@johnpoz well, I went to Nat reflection due a edgeos constraint.
Which is the best solution in pfSense? -
Best solution is always split dns.. No matter what your using as your router.
How would it ever be optimal to hairpin any traffic? It gets you nothing.. The only time it makes sense as a work around to do nat reflection. Is when the client on the same network as the services is forced to use some external dns. Or for whatever reason the IP your trying to access is hardcoded in some app your using or something.
If what your trying to access is via a fqdn, and whatever it is accessing it is using your local dns - then split dns and pointing the client to the local IP vs the public is the better solution.
-
@valepe69 Have a look at the Netgear GS350 Series of Smart Managed Pro switches. I've used the GS308T, GS310TP and the GS324T. All solid. And the price is right. I have some spare GS308T's (I consolidated several switches) if that's all you need and are interested.
