Blocking on VLAN not working properly (pfSense <–> OpenWrt)
I have setup a VLAN on my pfSense box and on my wireless router equipped with OpenWrt.
All is working. When connected to the wireless network I get an IP within the VLAN.
But I want to block the IP address of the OpenWrt admin page.
So I went to my firewall rules, go to the VLAN interface and created a rule to block port 80/443 for the OpenWrt router IP.
If I go to the admin page when connected to the VLAN it should be blocked, because of the rule, but this is NOT the case…
What am I doing wrong?
"If I go to the admin page when connected to the VLAN it should be blocked, because of the rule, but this is NOT the case…"
Says who?? Traffic only goes to your gateway when it it wants OFF the vlan, pfsense is a gateway/router - why would client A on vlan X, send traffic to pfsense to talk to client B on vlan X??
It arps for the mac, and sends the traffic direct to that mac.. If you want to block access to your admin page you would have to do it on the openwrt.. You can block access to the admin page from your other network segments/vlans that get routed through pfsense. Pfsense could be off and devices on same network can still talk to each other.
Ahh you are right!
My wireless client talks to the OpenWrt router directly and does not go through the pfSense box.
I'll have a look on my OpenWrt router to block access.
Cheers again John. 8)
blocking wifi clients to wifi router is normally simple checkbox.. Blocking it from the wired side is more difficult, have not played with openwrt in quite some time its possible they have limit to what source IP can hits its web gui.. This is a common feature when you enable remote and hit it from the wan side. But not sure if same rules work when on the same network as the lan IP, etc.
I made a firewall rule on the OpenWrt router blocking port 80 (and 443) for the VLAN subnet (192.168.x.1/24).
This works as advertised.
Disadvantage is that I have to enable the firewall package on the OpenWrt router.
I disabled the package before because I only use the router as a "dumb (w)ap".
So I had to re-enable it again.
well if your wifi is on specific vlan, what network/vlan is your openwrt router lan IP on that you manage it from? What devices are on this same network that you would need to block.
If you isolated this network from your other networks, which is a typical sort of setup..
lets say your normal wired lan is 192.168.0.0/24
Network you connect your AP on might be 192.168.2.0/24
Your ssid vlans mgith be 192.168.3/24 and 192.168.4/24 etc..
What other devices would be on the 192.168.2.0/24 other than the AP?? If so then you create a rule on pfsense on the lan that only allows your workstation to talk to the openwrt IP on 192.168.2.100 for example..
I have my setup like this:
LAN: 192.168.1.1 /24
pfSense box: 192.168.1.1
OpenWrt router/ap: 192.168.1.2
Normal SSID: gets IP within LAN subnet
Guest SSID: connected to VLAN: 192.168.2.1 /24
The normal SSID is used for trusted devices and need access to the regular LAN.
On the normal SSID I need to be able to open the web admin page of OpenWrt.
On the guest SSID I want to block it.
Well yeah with that setup anything on lan would be able to talk to openwrt gui.
You could move openwrt to another network say 192.168.5/24
Then setup your normal ssid for 192.168.2/24 and guest on 192.168.3/24 unless you have some specific need for your normal wifi to be on the same L2 as your lan??
That's the thing…
I want my wireless clients to be on the same subnet as my LAN.
My Synology is on my LAN and I want to "talk" directly to it through wifi as well as cable.
(this is an home setup)
why would you not be able to talk directly to it?? If it was on another network.. Just create the firewall rule that allows your wifi vlan or even your wifi clients specific IP to talk to the nas IP on the lan on whatever ports you want to talk too.
I doubt there would be an issue with pfsense routing performance hit being an issue with a wifi client. The only reason to be on the same layer 2 network would be some sort of need to broadcast for its name or some sort of multicast traffic that would not route. Or pfsense was not able to route/firewall at sufficient speed as being on the same network and switching speeds. For example my pfsense is on a vm, on older hardware and it just can not route the packets at gig wire speed.. But your wired client would also be on the lan.. Are you saying that pfsense can not route your wifi network fast enough?
If you desire such layer 2 traffic just use avahi or igmp proxy, etc.
So for example my storage/plex server is on my lan.. And yeah I move large files to and from my normal workstation all the time. For this yes I want my full wire gig speed. This traffic never transverses pfsense.. But pfsense is more than capable of routing at around 400mbps from my testing between my wlan and my lan when everything is connected at wire speeds. My wifi clients are never going to be anywhere close to this ;) Even at AC where it might be physical possible with a 3x3 client, etc.. I don't have any 3x3 clients, the max real world speed of 2x2 at AC 80mhz with short gi even with all the stars aligned and perfect connection is not sufficiently fast enough to see the routing speed limit of pfsense as an issue. And anyway most of the time I am only every say streaming a movie or song to my wifi client from the plex, so the bandwidth to do that is a fraction of what its actual connection speed is, etc.
Well let me explain why I need it, or think I need it.
My Synology is connected to my LAN.
When I'm connected to my wifi network, that is on the same subnet as my LAN, with my MacBook and open Finder I can see the Synology directly.
I don't need to map/mount anything, not samba nor AFP. It's just there…
When I'm on a different subnet, but have access to the LAN, it's not there automatically and have to mount a SMB or AFP share
Well I am not a mac guy, but I would guess its finding it via mdns which yeah is layer 2.. Just setup avahi and you should be good to go. I take it working the same as finding say a printer via airprint which uses mdns.
So having to mount it via smb or afp.. So?? Why can you not just do that.. Once you setup a mount its not like you have to do that every single time, etc.
Never tried avahi.
Maybe this is something I'm looking for.
Well mounting shares is not really an issue.
But the nice thing about the auto discovery is that it "mounts" my Synology at the root.
So all shares are visible with one click.
When mounting shares manually I have to do:
Just installed the "AVAHI" package.
Seems to be doing what I want! Needs some further testing though, literally tested it for 2 or 3 mins but looks promising! :)
Well it would allow you to better isolate your wifi networks from your wired network.. Which better control is always better!
You also now reduce the number of clients on the same broadcast domain, which while prob not a lot since you don't have hundreds of devices less broadcast/multicast traffic going out your wifi network and vice versa.
Depending on what OS your using, multicast can be pretty chatty - out of the box windows machine is a noisy freaking thing! ;) Spouting all kinds of garbage on the wire looking for shit it has no real need to find ;) SSDP, LLTD, LLMNR just to name 3 chatty katty protocols spewing out shit that nobody normally has any use for.. I disable all 3 of those on my windows machines for sure first thing. Then don't forget all the IPv6 shit it will be spewing for teredo, 6to4, isatap, etc. Just noise if your not actually using them..
Every packet on your wifi is just taking up air time that a packet you want to be sending/getting can not be on the air.. While in the big picture your not talking anything of real significance.. I am just not a big fan of putting stuff on the wire that serves no actual purpose ;)
Many thanks again John, really appreciated.
I guess I will be changing my network to this now:
LAN: 192.168.1.1 /24
pfSense box: 192.168.1.1
OpenWrt router/ap: 192.168.1.2
Normal SSID: connected to VLAN 10: 192.168.10.1 /24
Guest SSID: connected to VLAN 20: 192.168.20.1 /24
Than make firewall rules for VLAN 10 to allow LAN access.
After that make firewall rules for VLAN 20 to block LAN access.
Because I installed Avahi I can see my Synology while connected to VLAN 10.
Sounds good? Or do you have any suggestions?
That would work, but since your openwrt gui is still on your normal lan, any device on that lan would be able to access it. If your fine with that and only want to prevent wifi users from accessing it your good.
Just a side not on your nomenclature use ;) 192.168.1.1/24 is host address if you want to represent the /24 network it would be 192.168.1.0/24
When you see a IP with /cidr presented depending on the /cidr you can tell if its a network or a host address. since 192.168.1.1/24 is not a wire address so seeing 192.168.1.1/24 is a host address.. So for example if I gave you 192.168.1.128/25 is that a host or a network? since /25 would break at 128 that is the network while 192.168.1.129/25 would be the first host.
so when you start getting into the smaller networks it helps to understand where your subnet breaks are so for example 192.168.1.4 is what?? You would assume that is a host say on /24 if no mask is given. But if the mask is /30 it now becomes a network or wire address. Where 192.168.1.5/30 would be the first host in that subnet.
What about say 192.168.1.0 it would be quite easy to guess that is 192.168.1.0/24 network - but if the mask was /23 then that becomes a valid host address.
You are absolutely right John regarding the host/network story.
I was indeed referring to: 192.168.1.0/24
My bad! :o
If I don't want my LAN clients to access the OpenWrt gui what would you suggest?
Like I suggested before put your AP on its own network say 192.168.2.0/24 and then your ssid vlans on that so 192.168.10/24 and 192.168.20/24 like you created. Now your AP is on its own isolated network and 192.168.2.0 and anything from your lan network would have to transverse pfsense to get to the AP gui or ssh, etc. Which you can limit in pfsense - your only concern then would be someone plugging into the 192.168.2.0 directly. But I would "guess" you have your openwrt plugged directly into a pfsense interface?? Or you have smart switch between so what other ports would be on this 192.168.2.0/24 untagged network?
But since openwrt router has its own switch - someone would be able to plug directly into its other lan ports ;) But is that really a concern??
Ok, I think I get it.
And yes, the pfSense box is connected directly to the OpenWrt router/ap.
pfSense box --> OpenWrt ap - port 1 OpenWrt ap - port 2 --> computer OpenWrt ap - port 3 --> computer OpenWrt ap - port 4 --> unmanaged/dumb switch
oh shit your using its switch as well and then have another dumbswitch off of that.. Yeah that makes it harder.. All of those devices would have access to the gui no matter what network you put it on..
If you had something like this is becomes very easy to limit what can access it..
Well that's not a big problem for me. LAN users may access the gui.
As long as the wireless guest vlan (with semi-untrusted devices) is excluded from accessing the gui I'm happy. :D
That's already working. So I'm cool.
Many thanks for all the help and info!
Anytime - what I am here for ;)
I wanted to update you a little on my configuration. 8)
I just ordered a managed switch to replace my unmanaged switch.
This will be the new setup:
pfSense box --> OpenWrt ap1 - port 1 OpenWrt ap1 - port 2 --> device OpenWrt ap1 - port 3 --> device OpenWrt ap1 - port 4 --> managed switch - port 1 managed switch - port 2 --> device managed switch - port 3 --> device managed switch - port 4 --> OpenWrt ap2
This way I can use my LAN as "admin" network (put the 2 OpenWrt aps in here) and create a VLAN for all the cabled devices (NAS, computers, etc) in my network.
Wouldn't it be better
pfsense - managed switch - ap(s)
That's not possible in my setup.
My internet connection starts in my living room (1st floor) , so there for the pfSense box is there as well.
I want to have wifi coverage on all 3 floors in my house. So the first wifi ap is on the 1st floor as well.
The second wifi ap is on the 3rd floor. To connect the 1st, 2nd and 3rd floor to each other there is an unmanaged switch now.
That one will/can be replaced with the managed switch.
Care to explain why your setup would be better?
OpenWrt on my devices are fully supported, so VLAN's do work. In other words the wifi aps (equipped with OpenWrt) are managed switches as well with wifi as a plus.
well if you have the full support of vlans and other features you need on the switches in your old routers via openwrt, then it really doesn't matter. But if you have managed switches where you need them then your AP then you don't have to leverage the switch ports on the old wifi routers and would give better control "maybe" ?
If your saying the "smart/managed" feature set you need are available in the openwrt and hardware your running on then your good.
I should be good to go than, I think. 8)
Once everything is setup I'll post back and let you know, if you're interested of course.
Also that tutorial on OpenWrt <–> pfSense is coming as well. But bare with me, pretty darn busy atm. ;D
But promise is a promise so I'll make one for sure.
I've finally created the tutorial!
You can check it here: https://forum.pfsense.org/index.php?topic=116980.0