Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    segment wifi traffic (guest, IoT, trusted)

    Scheduled Pinned Locked Moved General pfSense Questions
    46 Posts 7 Posters 7.8k Views 6 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JKnottJ Offline
      JKnott @farmerjohn
      last edited by

      @farmerjohn

      It's easy enough with a proper AP that supports multiple SSIDs and VLANs. I have a Unifi AC-Lite AP that does that, as does my Cisco switch.

      PfSense running on Qotom mini PC
      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
      UniFi AC-Lite access point

      I haven't lost my mind. It's around here...somewhere...

      1 Reply Last reply Reply Quote 0
      • JKnottJ Offline
        JKnott @AKEGEC
        last edited by

        @akegec

        Yeah, $35 is a lot of money! šŸ˜‰

        BTW, avoid TP-Link, as some models don't properly support VLANs. Same with some of their APs.

        PfSense running on Qotom mini PC
        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
        UniFi AC-Lite access point

        I haven't lost my mind. It's around here...somewhere...

        1 Reply Last reply Reply Quote 0
        • JKnottJ Offline
          JKnott @farmerjohn
          last edited by

          @farmerjohn said in segment wifi traffic (guest, IoT, trusted):

          According to this video , I don't need a managed switch to have multiple vlans via wireless AP and pfsense.

          I haven't watched that video, but you don't need a managed switch to support mulitple SSIDs on an AP. However, if you have wired devices on those VLANs, you will need a managed switch, as many devices can't be configured to use VLANs.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          F 1 Reply Last reply Reply Quote 1
          • T Offline
            Tzvia
            last edited by

            I have one of those Netgear GS108Ev3 8 port switches, bought it many years ago, well under 50 bucks if memory isn't way off. Works fine for a home use product. Also have a Netgear GS724Tv4 which is the basically the same thing but with 24 ports. Paid 330 maybe 6 years ago, which again isn't bad if you need that many ports and just need the vlans and aren't looking to study to take Cisco classes. They work just fine in my application, using PFSense to do the routing and firewall between the vlans, with two Unifi WAPs that support multiple SSIDs/VLANs which made the whole setup painless.

            Tzvia

            Current build:
            Hunsn/CWWK Pentium Gold 8505, 6x i226v 'micro firewall'
            16 gigs ram
            500gig WD Blue nvme
            Using modded BIOS (enabled CSTATES)
            PFSense 2.72-RELEASE
            Enabled Intel SpeedShift
            Snort
            PFBlockerNG
            LAN and 5 VLANS

            1 Reply Last reply Reply Quote 0
            • F Offline
              farmerjohn @JKnott
              last edited by

              @jknott

              if you have wired devices on those VLANs, you will need a managed switch, as many devices can't be configured to use VLANs.

              If I have a VLAN capable AP connected to an unmanaged switch with 3 other wired devices (don't need these wired devices to be vlan tagged) and this unmanged switch connects to pfsense, will the AP traffic that is tagged match up with the VLAN's I have defined in pfsense and the 3 wired devices work as before, i.e., just LAN members?

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ Offline
                JKnott @farmerjohn
                last edited by

                @farmerjohn

                Yes, I used to do that here. The unmanaged switch will pass the VLAN tagged frames, so that the AP can sort things out. Wired devices that can't be configured to work directly with VLANs will still work on the native LAN and will ignore the tagged frames. Computers can be configured to work directly with VLANs.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ Online
                  johnpoz LAYER 8 Global Moderator @JKnott
                  last edited by johnpoz

                  While you can do that.. Understand that dumb switch doesn't understand vlans.. So there is no isolation. All the broadcast and multicast traffic from all the vlans as soon as hits switch will go to all the other ports.

                  While your dumb switch will pass the vlan tags.. Since he doesn't understand them doesn't know that broadcast/multicast traffic from vlan X, is not suppose to go to all the ports.

                  If your doing it that way because you can not afford say $30-50 switch... You shouldn't be running so many freaking devices in the first place. I mean the electric cost alone must eat up your whole budget ;)

                  Give up couple $10 coffee's at starbucks and get a switch that actually understands vlans.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 25.07 | Lab VMs 2.8, 25.07

                  JKnottJ F 2 Replies Last reply Reply Quote 0
                  • JKnottJ Offline
                    JKnott @johnpoz
                    last edited by

                    @johnpoz said in segment wifi traffic (guest, IoT, trusted):

                    So there is no isolation. All the broadcast and multicast traffic from all the vlans as soon as hits switch will go to all the other ports.

                    There is some isolation in that the devices won't receive the packets for other VLANs. They will appear at the NIC, where they will be promptly ignored.

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • F Offline
                      farmerjohn @johnpoz
                      last edited by

                      @johnpoz

                      So there is no isolation. All the broadcast and multicast traffic from all the vlans as soon as hits switch will go to all the other ports.

                      seems not optimal, but what is the downside to this? will this cause a noticeable hit to network performance or other issues?

                      johnpozJ JKnottJ 2 Replies Last reply Reply Quote 0
                      • johnpozJ Online
                        johnpoz LAYER 8 Global Moderator @farmerjohn
                        last edited by johnpoz

                        The downside is your sending broadcast/multicast to somewhere it doesn't need to go.

                        While the nic might drop it. You also can join any vlan you want with any device just be tagging. So no security at all.

                        If your to the point you wanting to segment your network into different vlans, yet not willing to spend the few bucks required to do it correctly - your doing it F'ing Wrong! ;)

                        If its a stop gap until your smart switch gets delivered, or you want to do it on purpose as say a easy tap into viewing traffic.. Or your using the dumb switch as sort of relay to extend length of a run or something.. Sure ok..

                        While there may be some scenarios you need/want to do it - overall its a borked way to do it.

                        There is one correct answer to want to run vlans on a switch - the switch should understand the tags ;) It doesn't need to be some super managed everything under the sun sort of networking magic that can be done sort of switch.. But it should at least understand what the tag is, and how to process them and isolate them correctly.. So that you actually get the L2 isolation that vlans are meant to do..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 25.07 | Lab VMs 2.8, 25.07

                        JKnottJ F 2 Replies Last reply Reply Quote 1
                        • JKnottJ Offline
                          JKnott @farmerjohn
                          last edited by

                          @farmerjohn

                          It will waste some bandwidth on the wire, but devices will not recognize packets on a VLAN they're not configured for. Those packets will be discarded by the NIC.

                          PfSense running on Qotom mini PC
                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                          UniFi AC-Lite access point

                          I haven't lost my mind. It's around here...somewhere...

                          1 Reply Last reply Reply Quote 0
                          • JKnottJ Offline
                            JKnott @johnpoz
                            last edited by

                            @johnpoz said in segment wifi traffic (guest, IoT, trusted):

                            You also can join any vlan you want with any device just be tagging. So no security at all.

                            Assuming:

                            a) You have admin rights¹ and
                            b) Know how to do that

                            1. Yeah, I know many people run their computers as admin because they don't know better and that's the way it came.

                            PfSense running on Qotom mini PC
                            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                            UniFi AC-Lite access point

                            I haven't lost my mind. It's around here...somewhere...

                            bingo600B 1 Reply Last reply Reply Quote 0
                            • bingo600B Offline
                              bingo600 @JKnott
                              last edited by

                              @farmerjohn
                              I totally agree w. @johnpoz here.
                              Get a cheap managed switch for the job.
                              As a "bonus" you could use the 6 other ports for other vlans, and treat it as an additional 6 Lan interfaces.

                              @jknott
                              Just because you could ... Doesn't mean you should. 😊
                              And certainly not for saving $50

                              /Bingo

                              If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                              pfSense+ 23.05.1 (ZFS)

                              QOTOM-Q355G4 Quad Lan.
                              CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                              LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                              1 Reply Last reply Reply Quote 0
                              • bingo600B Offline
                                bingo600 @farmerjohn
                                last edited by

                                @farmerjohn

                                I suppose you're thinking about dd-wrt

                                Hw-Rev A1
                                https://wiki.dd-wrt.com/wiki/index.php/Asus_RT-AC66U

                                Hw-Rev B1
                                https://wiki.dd-wrt.com/wiki/index.php/Asus_RT-AC66U_B1

                                If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                                pfSense+ 23.05.1 (ZFS)

                                QOTOM-Q355G4 Quad Lan.
                                CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                F 1 Reply Last reply Reply Quote 0
                                • bingo600B Offline
                                  bingo600
                                  last edited by

                                  There might be some "Trickery" in connecting the managed switch to the Lan IF , and enable tagging , wo. loosing Lan (that you need for configuring).

                                  I suppose you could keep Lan as untagged.

                                  Maybe one of the others have trued to run untagged & tagged on a pfS IF.
                                  I haven't yet

                                  /Bingo

                                  If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                                  pfSense+ 23.05.1 (ZFS)

                                  QOTOM-Q355G4 Quad Lan.
                                  CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                  LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                  johnpozJ JKnottJ 2 Replies Last reply Reply Quote 0
                                  • johnpozJ Online
                                    johnpoz LAYER 8 Global Moderator @bingo600
                                    last edited by

                                    @bingo600 said in segment wifi traffic (guest, IoT, trusted):

                                    Maybe one of the others have trued to run untagged & tagged on a pfS IF.

                                    I run one of my interfaces with native (untagged) and then vlans on it.. There really isn't anything tricky about ;)

                                    here.png

                                    You can see that native network my wlan is untagged and on the igb2 interface. While then 2 other networks (vlans) are on that physical interface igb2

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 25.07 | Lab VMs 2.8, 25.07

                                    1 Reply Last reply Reply Quote 2
                                    • JKnottJ Offline
                                      JKnott @bingo600
                                      last edited by JKnott

                                      @bingo600 said in segment wifi traffic (guest, IoT, trusted):

                                      Maybe one of the others have trued to run untagged & tagged on a pfS IF.
                                      I haven't yet

                                      That's what I have here. My guest Wifi is connected via VLAN3 and the main Wifi is on the native LAN. This is quite common with things like VoIP phones and office computers. On the pfsense end, once the VLANs are enabled, there's no difference with a native LAN when configuring them.

                                      eda3d4df-a08c-4b95-b359-5dd756aa7108-image.png

                                      PfSense running on Qotom mini PC
                                      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                      UniFi AC-Lite access point

                                      I haven't lost my mind. It's around here...somewhere...

                                      1 Reply Last reply Reply Quote 1
                                      • F Offline
                                        farmerjohn @bingo600
                                        last edited by

                                        @bingo600

                                        I suppose you're thinking about dd-wrt

                                        That was my original plan, but also considering a Ubiquity UAP-AC-PRO - not sure if flashing and configuring the Asus router will be as simple as buying a Ubiquity.

                                        bingo600B 1 Reply Last reply Reply Quote 0
                                        • bingo600B Offline
                                          bingo600 @farmerjohn
                                          last edited by

                                          @farmerjohn

                                          I like the UAP AC Pro šŸ‘
                                          I have 5 sites with that model installed.

                                          Then i also assume that $50 for a Vlan switch isn't an issue.

                                          /Bingo

                                          If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                                          pfSense+ 23.05.1 (ZFS)

                                          QOTOM-Q355G4 Quad Lan.
                                          CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                          LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                          1 Reply Last reply Reply Quote 1
                                          • F Offline
                                            farmerjohn @johnpoz
                                            last edited by farmerjohn

                                            @johnpoz

                                            There is one correct answer to want to run vlans on a switch - the switch should understand the tags ;)

                                            I currently have 3 unmanged switches in the house
                                            one: trendnet TEG-S80G
                                            two: HP procurve 1410-8G

                                            I'll be attaching the VLAN capable AP into one of the HP procurve switches - until I save up for a managed switch ;)

                                            Are there advantages of replacing the other two dumb switches if I don't intend to run VLAN tagged traffic through them?

                                            if so, I may go with a 3-pack of these Ubiquiti USW-Flex-Mini for $28 each.

                                            bingo600B 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.