Home network to keep wife happy + VPN (TV 4k netflix) + reduce intranet downtime

ChefRayB

Greetings Everyone,

I am kinda new here and would appreciate feedback & suggestion on home network and routing.

Current Setup:

Linksys e4200 with DD-WRT
12 Port Ethernet Switch
OpenVPN (route-nopull + Ip Policy Based to 1 ip address for TV for Netflix 4k directly using TV App)
LAN ethernet (Sonos Sound Bar, Synology NAS, AndroidBox TV, ObiTalk Obi110, Xbox, etc…)
2.4GHZ (Sonos play1 speakers, HP Printer)
5.0GHZ (Tablets, mobile, Amazon Alexa)
Tablet & mobile uses OpenVPN android app and Laptop uses Viscocity for OpenVPN

Problem with Current Setup:

Each time I experiment with linksys e4200 or OpenVPN I can potentially create an internal network or internet outage which means no more Sonos music, no more netflix, no more internet, no access to synology, no Android TV, Phone, Printer and then the wife starts nagging…. then the headache starts.... then I have to fix the network and I can only re-try when the wife either sleeps or is away....

The first time I installed OpenVPN, I used the default instruction redirect-gateway which routes ALL traffic. Automatically you loose internet access. I would like to play with a router and still have internet so that I an google stuff and listen to music and watch shows recorded on my Synology NAS.... Get the picture ? :D

Current Linksys e4200 has a 4Mbits OpenVPN bandwidth limitation which is barely enough for TV with netflix 4k and I don't want to configure each device for OpenVPN.... call me lazy....

What am I looking to achieve:

Ability to play with a router/OpenVPN without screwing up my home network
Have a dedicated my home network that works even if internet is down because I have Sonos, Synology, Android TV, Printer, etc…
Ability to switich to a VPN easily, higher VPN bandwidth
Smallest size possible ( I am renting a small apartment, I don't have space)
Silence and fanless is a must ( no fans)
Budget $1k USD ?

My suggested design:

Solution #1: Use 1 router with DHCP Server on each port

1)Internet Router(pfsense running on Hardware:qotom-q355g4)
a) WAN: ISP public internet by DHCP or PPPOE
b) Lan: 192.168.10.1 is for management / DMZ / testing
- DHCP Disabled
c) Opt1: 192.168.20.1 for home network
- DHCP Enabled 192.168.20.128-255
- switch 1 = 8 ports (Sonos, Synology, Android TV Box, Obitalk, Xbox, etc…)
Port1: AP-> linksys e4200 running DD-WRT
-2.4GHZ
-5.0GHZ
d) Opt2: 192.168.30.1 with DHCP Enabled for OpenVPN
- DHCP 192.168.30.128-255
- switch 2 = 4 port
Port1-> AP 5.0GHZac for VPN ?
OpenVPN with route-nopull, Policy Based Routing 192.168.30.128/25
- This means that only DHCP range is routed through VPN, any ip under 128 should go through internet
- If TV is setup DHCP, I automatically get VPN ( Netflix in USA)
- If TV is setup static ip on Switch 2, TV bypass VPN and goes through ISP directly

Pros:

1 hardware purchase
Easiest to manage / Centralized DHCP ip address
Linksys e4200 is just AP

Cons:

If Internet Router has an issue (I screw it up ) then I might loose my home intranet (Sonos, Synology, Android TV)

Solution #2: Use 2 routers but Home Router has it's own DHCP Server

1)Internet Router(pfsense running on Hardware:qotom-q355g4)
a) WAN: ISP public internet by DHCP or PPPOE
b) Lan: 192.168.10.1 is for management / DMZ / testing
- DHCP Disabled
c) Opt1: 192.168.20.1 is for the Home Router
- DHCP Enabled only for 1 ip address 192.168.20.2 (Reserved by MAC Address?)
- Can I put 1 cat6 cable from Opt1 directly to WAN to Home Router?
d) Opt2: 192.168.30.1 with DHCP Enabled for OpenVPN
- DHCP 192.168.30.128-255
- switch 2 = 4 port
- AP 5.0GHZac for VPN ?
OpenVPN with route-nopull, Policy Based Routing 192.168.30.128/25
- This means that only DHCP range is routed through VPN, any ip under 128 should go through internet
- If TV is setup DHCP, I automatically get VPN ( Netflix in USA)
- If TV is setup static ip on Switch 2, TV bypass VPN and goes through ISP directly

2) Home Router (DD-WRT running Hardware: linksys e4200)
a) WAN: 192.168.20.2 ?
b) Lan 192.168.20.3 ?
- DHCP Enabled 192.168.20.128-255
- switch 2 with 8 ports
c)2.4GHZ
d)5.0GHZ

Pros:

1 hardware purchase
Easy to manage
If Internet Router goes down, my Home network looses internet but my intranet still works (Synology, Sonos, Android TV, etc…) Which means I can still access sono music, play movies on Android TV, access my synology data)

Cons:

There is still a risk of internet access going down because of me playing with OpenVPN

Solution #3: Use 3 routers with each router running DHCP Servers
1)Internet Router (pfsense running on Hardware: netgate SG 2440)
a) WAN: ISP public internet by DHCP or PPPOE
b) Lan: 192.168.10.1 is for management / DMZ / testing
- DHCP Disabled
c) Opt1: 192.168.20.1 is for the Home Router
- DHCP Enabled only for 1 ip address 192.168.20.2 (Reserved by MAC Address?)
- Can I put 1 cat6 cable from Opt1 directly to WAN to Home Router ?
d) Opt2: 192.168.30.1 is for the VPN Router
- DHCP Enabled only for 1 ip address 192.168.30.2 (Reserved by MAC Address?)
- Can I put 1 cat6 cable from Opt2 directly to WAN to OpenVPN Router ?

2) Home Router (DD-WRT running Hardware: linksys e4200)
a) WAN: 192.168.20.2 ?
b) Lan 192.168.20.3 ?
- DHCP Enabled 192.168.20.128-255
- switch 2 with 8 ports
c)2.4GHZ
d)5.0GHZ

2) VPN Router (pfsense running on Hardware:qotom-q355g4)
a) WAN: 192.168.30.2 ?
b) lan: 192.168.30.3 for VPN network
- DHCP Enabled 192.168.30.128-255
- switch 2 with 4 ports
b)opt1-> AP 5.0GHZ ac for VPN ?
c)opt2 -> ????

OpenVPN with route-nopull, Policy Based Routing 192.168.30.128/25
- This means that only DHCP range is routed through VPN, any ip under 128 should go through internet
- If TV is setup DHCP, I automatically get VPN ( Netflix in USA)
- If TV is setup static ip on Switch 2, TV bypass VPN and goes through ISP directly

Pros:

2 hardware purchase
Both Home and OpenVPN Network are operating fully independently from my Internet Router.
I won't require to go inside the Internet Router because it's more of a gateway/firewall.
OpenVPN is running in an independent machine, I can reset the box, reformat, try different VPN, test new stuff, etc…

Cons:

More expensive, 2 new router hardware, 3 routers for manage…. Overkill ?

Questions:

Which is the most appropriate solution based on my criteria ?
How will the routing work ? Did I get it right ? (Theoritcally )
Can we have separate DHCP servers on each router ? Pros/Cons

After a solution is selected I will start shopping for hardware and try it out !

Thank you everyone for your feedback

Please keep in mind I am not a network expert and I want something easy to manage because sometimes I might not connect to these routers for months…. need to keep it simple.

Regards,

ChefRayB

Reference:

Some thread I read before asking my question about the routing
https://forum.pfsense.org/index.php?topic=76465.msg417893#msg417893

johnpoz

Why do you think if your edge router your local network goes down? You do understand that pfsense has ZERO to do with devices talking to themselves on local network.. Pfsense is the gateway/router - to get off their network!

Other than providing dhcp, which is only needed once per how ever long your lease is.. And dns if you are using pfsense for it - but most of your shit would just broadcast for name anyway..

ChefRayB

Hi John,

I didn't really think of it that way because most of the time my router/gateway/wifi AP/switch is all in 1 box.

Basically you are saying that pfsense has absolutely nothing to do with devices talking to themselves on local network beside allocating ip address via DHCP (optional) and pushing DNS (optional). The purpose of edge router running pfsense is to be a gateway/router.

Therefore:

Edge Router (pfsense with DHCP Enabled on Opt1)
-> Opt1 (192.168.20.1)
-> AP Wifi router dd-wrt (linksys e4200) with DHCP disabled, all DHCP request are managed by EdgeRouter Opt1)
-> lan port 1 -> static ip address 192.168.20.2
-> lan port 2 -> switch -> lan port 1 Device 1 (dhcp ip address 192.168.1.20.128) leased for 1 year
-> lan port 2 Device 2 (dhcp ip address 192.168.1.20.129) leased for 1 year
-> lan port 3 -> Device 3 (dhcp ip address 192.168.1.20.130) leased for 1 year
-> 2.4GHZ -> Device 4 (dhcp ip address 192.168.1.20.131) leased for 1 years\

If AP wifi router is powered off then
- Device 1 & 2 should still communicate because they are on a powered switch, already have an IP address assigned
- Device 3 is no longer accessible ( linksys switch is power off)
- Device 4 is no longer accessible ( linksys switch is power off )

Question:

So there is no way, shape of form I can mistakenly screw up something in my Edge Router to STOP Device 1,2, 3 & 4 from talking to each other if they already have an ip address leased for 1 year ? Can you please confirm this ?
My gut feeling is telling me to setup the DHCP server on the WIFI router and completely abstract as much as possible my home network from my edge router. Is there any drawback with that approach ? Meaning is there an advantage to have Edge Router manage the DHCP addresses for my home network (e.g. firewall features, anti virus ?)

Just found 1 advantage: If I need to update my Edge Router, I simply take my wifi router, unplug the RJ45 connected from wifi router WAN port to Edge Router Opt1 and plug it directly in my modem. Basically by passing my Edge Router. All my home device still work and also keep having internet which is useful when reading online documentation while working on pfsense Edge Router. If I would have kept the DHCP Server on pfsense Edge Router Opt1 any device that doesn't wifi ip address wouldn't be able to get ip address (e.g. Wife comes back form grocery shopping and mobile is looking for wireless connection) Does this mean sense ?

So seem to have narrow it down to either Solution #2 or Solution #3

Thank you

ChefRayB

johnpoz

There is nothing you could do on the edge router (pfsense) other than giving it an IP that conflicts with one of your devices that would prevent them from talking to each other.

Users seem to think dhcp has to be running 24/7 for some strange reason. Your clients when they turn on will ask for an IP.. They will not then ask to renew that lease until the lease has reached 50% of its life. If it does not get a renewal.. It will continue to ask until lease fully expires.. So if your using a lease of a year.. You could in theory turn off pfsense for a year and those devices would continue to use the same IP.

Most devices once they have a lease and reboot, will continue to use that IP until the the lease has expired.. Normally they will ask for renewal on reboot - just in case they moved networks and get told to use a different IP, info, etc.. But if no dhcp answers them they would just continue to use that IP.

Now a lease of 1 year is a bit over the top. Something like 1 or 2 days or whatever is good enough - that way if you want to hand out new info like different dns, different gateway, different ntp, etc.. you wouldn't have to wait 6 months for clients to ask to get the new info.

While it is best to use dns.. If your clients, especially windows are looking for a FQDN, and they do not get an answer from dns - they will broadcast for the name. And the device with that name on the same local network would respond hey here I am this is my IP.

There is NO reason to run dhcp on your wifi router - but sure if you wanted to, as long as you set it up to point to pfsense as your gateway and or dns you should be fine doing that.

Your solutions with multiple routers are just pointless.. There is zero reason to have multiple routers in the setup and are just more points of failure. If you were worried about having HA (high availability) you would have multiple AP and or even multiple switches with your devices having multiple connections (lagg) and for your internet connection - ie pfsense you would/could setup a CARP setup ie 2 pfsense boxes.

But this is really over the top for a home connection. Other than the Multiple AP - but this is not really for HA, but just for sharing the load so you can maximize wifi bandwidth and have better wifi coverage over your whole house - I for example have 3 AP in my small 2k square foot house.

If you have concerns - just unplug pfsense connection to your switch.. Can your machines still talk to each other..

ChefRayB

Hi John,

Thanks for the reply. Just got home, Blue Jays lost against Tampa Bay 7-1.

So basically having 3 routers seems an overkill.

The concerns I have is that when I installed OpenVPN Client on DD-WRT router for the 1st time, the instructions required I put the command redirect-gateway, it makes OpenVPN redirect all traffic to VPN. Because the OpenVPN wasn't working, I lost internet access. I had to disable VPN and reboot to get internet works again to be able to read OpenVPN documentation. (Many VPN providers have their own DNS and over-complicated OpenVPN configurations, some have scripts, etc…)

After reading on OpenVPN, I learned you remove "redirect-gateway" and put "route-nopull" and use Policy Based Routing to have a specific range.

I guess it's all about my risk appetite and the level of control/flexibility I want.

Thank you

ChefRayB

johnpoz

What does loosing internet access have to do with your concern of devices talking to each other.. Yeah for sure you could do something to pfsense that breaks internet.. That is not what you were asking about.

ChefRayB

It was one of my main concerns which I described on my 1st post under "Problem with Current Setup". I was concerned with both local network and internet outages. Turns out local network isn't really the problem…. it's loosing internet access.

Problem with Current Setup:

Each time I experiment with linksys e4200 or OpenVPN I can potentially create an internal network or internet outage which means no more Sonos music, no more netflix, no more internet, no access to synology, no Android TV, Phone, Printer and then the wife starts nagging…. then the headache starts.... then I have to fix the network and I can only re-try when the wife either sleeps or is away....

The first time I installed OpenVPN, I used the default instruction redirect-gateway which routes ALL traffic. Automatically you loose internet access. I would like to play with a router and still have internet so that I an google stuff and listen to music and watch shows recorded on my Synology NAS....

johnpoz

Well loosing internet access when you break the thing that gives internet access - how is adding routers to NAT yet again behind solve that issue?

If you want to play with pfsense without messing with your actual connection pfsense - then setup a lab/vm you run pfsense on to play with vs messing with the one that is currently providing your network with internet access..

ChefRayB

I've come to the same conclusion…. For now I'll keep it simple. Thanks

johnpoz

Also as to this

"WAN port to Edge Router Opt1 and plug it directly in my modem"

If your on a cable modem.. That doesn't work.. Unless your devices had the same mac.. So you would have to reboot your modem when the device connected too it changes. So internet outage. So you might as well just live through the few seconds/minute it takes to reboot your edge router on the update.

I am currently running beta of pfsense, and I update it every few days to current code.. Who cares if the internet is off line for 30 freaking seconds? Especially when I am playing with it most times which is early morning or late at night.. Not during primetime when the wife is streaming some video, etc.. ;)

ChefRayB

Yeah, forgot about resetting modem because of the mac address. About 20 years ago, when I required to change my public internet address (was testing dynamic dns), I used to use the "MAC clone" feature by in my router, I used to do WAN DHCP release, change the MAC address, perform DHCP get in order to get the modem to return a different public ip address.

Purely educational, assuming I clone my linksys WAN port with the MAC address of my edge router WAN port and statically set my current assigned public WAN IP address to my linkysys router (10 seconds), I would be able to simply unplug my edge router and put my linksys router (5 seconds) and the modem cable would never know that I just switched it thus not requiring to reboot. (assuming DHCP, lease has 2 days left) Would it work ? :-[

IF the MAC address of the WAN port NIC from the edge router (e.g. qotom Q355G4 4 ports) is identical to the WAN port NIC of the linksys router which happens to be connected to the LAN port of the edge router. Would the edge router function correctly ? I believe in an un-managed switch, it's the port with the latest update that will be receiving data (perhaps some manufacturer implements it differently). I have no idea how a router or a router with pfsense would behave ! Do you happen to know ? :-[

modem–->wan port [edge router] Lan port –-> wan port [linksys e4200] (DHCP Enabled)

johnpoz

Yes if you clone your mac.. Which how exactly is that going to work in the same network.. But guess it would be on different sides of pfsense.. So now to reduce your outage to 10 seconds, your going to double nat? Yeah that sounds like a great idea <rolleyes>I do the mac thing with my cable modem for other VMs, so if want to play with different firewall/router distro - or different version of pfsense, etc.. I just use the same mac on that VM.. Turn off old vm, boot up new vm with same mac and keep my same public IP this way.

I really do not understand what your concern is here?? If you really don't want your internet to go down - then get a 2nd line and use it for failover..</rolleyes>

ChefRayB

Hi John,

No concerns, it's my geeky curiosity and trying to find a balance between laziness, easiness and flexibility. It's a home network, I definitely don't need a fail over :)

Back to the home routing, I believe I require the following protocols on my home network to work across subnets

TCP
UDP
SSDP (for UPnP and DLNA)
- TCP port 2869 multicast (HTTPMU) (Windows hosts)
- UDP port 1900 multicast (HTTPMU)
- UDP (private port) unicast (HTTPU)

Overall Services

STP ( Sonos seems to require )
uPnP
NTP
OpenVPN Client (Mandatory: Watch NetFlix)
OpenVPN Server (Optional: I can connect from outside to my box, I have Synology NAS providing me [mymachinename].synology.me)

Question:

1) Is that hard to configure so that both the non-vpn and vpn hosts from each subnet can talk to each other ? I read I would require to install IGMP, UPnP & NAT and perhaps add some rules….

If I stick with only 1 subnet under lan port1, I don't have to worry about all this but I then won't be able to switch between non-VPN to VPN on my tablets, mobiles, computers and my TV.

Is there a way to have only use 1 subnet but have the option not to route through VPN dynamically from the client ? Is that possible ? ( I know that I can have device run OpenVPN client but that's my last resort)

My method to switch from VPN to non-VPN was to change different AP (wlan) and have the TV switch from dhcp to static.

Thank you

johnpoz

"- SSDP (for UPnP and DLNA)"

Does not work across subnets..

Why do you think you need UPnP?? Do you host game via game consoles?? STP.. so you have a smart switch that does spanning tree?

ChefRayB

uPnP: I might do a bit of bitTorrent and I have Xbox/Wii
STP: okay, then I don't need it since I have a managed switch.

IF SSDP doesn't work across subnets then I won't be able to see my DLNA media accross subnets which is important for me

Do you know an elegant solution to accomplish the following:

AP 2.4GHZ Non-VPN
AP 5.0GHZ Non-VPN
AP 5.0GHZ VPN ( Go through VPN running on pfsense box)
LAN DCHP Non-VPN (e.g. sonos appliances, xbox, obiTalk VOIP)
All AP & LAN have DLNA/SSDP working (meaning all on the same subnet)
TV is connected on LAN and can easily switch between VPN vs non-VPN

New Solution ?

ALL AP + LAN on same subnet with 1 DHCP Server 192.168.20.128 to 255
For the TV, if I use DHCP I get non-VPN, if I set static I get VPN but I might need to setup the DNS rather using the DNS pushed by VPN provider ?
how do I route only users on AP 5.0GHZ VPN to OpenVPN on pfsense since they are now using the same DHCP server

Perhaps there is no solution to what I want to accomplish…..

Thanks

johnpoz

"STP: okay, then I don't need it since I have a managed switch"

Huh?? That would not be viable really unless you had a smart switch.. Why do you think you need that? Sonos do like to create loops on the network that is sure, since do they not talk to each other wireless and can be wired which creates a loop. STP can stop that for sure..

"For the TV, if I use DHCP I get non-VPN,"

Why would you do that? Just route it at pfsense, enable rule vpn, disable rule not vpn.. Clickity Clickity - 2 seconds..

" how do I route only users on AP 5.0GHZ VPN to OpenVPN on pfsense since they are now using the same DHCP server"

Why are they using the same dhcp server? But this is done with dhcp reservation so you client is always the same IP. You can then route them out the vpn or not route them out the vpn..

ChefRayB

(Keep in mind I am newbie)

STP: I thought I need it because I have a combinations of wired & wireless sonos appliances, the wireless ones use sonosnet which can potentially create a loop.

Switching TV from vpn to non-vpn should occur by going on the TV (vizio) and simply switch from DHCP to Static ip address. I don't want to connect to pfsense and disable a rule "clickity Clikity".

The whole purpose of this thread is to be flexible and lazy and deal with Netflix geo blocking. Can you suggest me a home solutions with the following criteria:

I would like to have 3 AP
- 2.4GHZ access via ISP provider
- 5.0GHZ access via ISP provider
- 5.0GHZ access via VPN ( IF I switch my mobile, tablet, computer to 5.0GHZ VPN, I am on VPN)
Despite which AP I am connected, I would like to access all my devices, see all DLNA, see printer, etc…
In my vizio TV, if I set to DHCP it routes to OpenVPN and if I set a static ip It routes to internet ( I don't want to go in pfsense and do "clickity Clikity")

I can buy whatever I need (within reason), I prefer to spend a few hundred dollars more and have flexibility, meaning I don't care if I need to buy one of more routers, one of more smart or L2 or L3 switches, AP, etc….

Question:

Would you be able to propose a solution that meets my requirement.
I read your thread on VLAN ( https://forum.pfsense.org/index.php?topic=103903.msg581183#msg581183 ). Can we use VLAN for the routing and DHCP allocations (e.g. each vlan has a dhcp server with a dhcp pool ?)
I also read that IGMP might help to resolve uPnP and DLNA accross subnets ( https://forum.pfsense.org/index.php?topic=36832.msg190581#msg190581)

Thank you

johnpoz

Sure you could use vlans and dhcp reservations to have complete control of what devices use specific rules.

I have read that yes sonos can create loops, and while its possible that some dumb switches have a basic implementation of STP.. without knowing the exact switch model it would be impossible to verify that. But to be honest I would be surprised if "dumb" switches actually support stp..

Here is some netgear dumb switch, gs108
https://www.netgear.com/business/products/switches/unmanaged/GS108.aspx#tab-techspecs

for loop detection, or stp is shows NA..

? 1) Yes it would be quite simple to draw up a solution for you ;) I have to leave for work in a few minutes - but if I get some free time at work can draw up some examples for you to work off of.

As to IGMP - sure that is possible do do some stuff with, but a much easy to implement and configure solution is to just put the devices that use DLNA/UPnP to discover devices like a TV or streamer on the same layer 2 network.

ChefRayB

Great ! Keen to see your proposal. I also created my proposal based on my last week readings and reading your historical posts. Keep in mind it's 15 years I didn't play in networks, never worked with VLAN and OpenVPN ! I started with 3com COAX cable network, Novell and HUBS !

Curious to see the difference ! :D

Hardware required:

pfsense box ( 2 port or 4 ports ? )
Switch 5 port L2 Managed ( Is there a L3 Managed under $200 worth it ?)
ubiquiti unifi AC Lite
8 port switch un-managed ( already have)
4 port switch un-managed ( already have)
DD-WRT Linksys e4200 (already have)

Wan - Modem
Lan -> Switch #1 (5 port L2 Managed)
-> Port 1 -> trunk connected Lan of Pfsense Box
-> Port 2 -> Access Switch #2 (8 port - Unmanaged)
-> Port 1 -> Port 2 of Switch #1
-> Port 2 -> router DD-WRT
-> AP 2.4GHZ (route to ISP internet)
-> AP 5.0GHZ (router to ISP internet)
-> port 3 to 7->(Sonos, Synology, Obitak VOIP, Xbox)
-> Port 8 -> Switch #3 (4 port - Unmanaged)
-> port 1-4 (Sonos)
->Port 3 -> trunk ubiquiti unifi ac lite
-> AP 5.0GHZ (route to VPN)
->Port 4 -> access TV
->Port 5 -> access empty

VLAN ID descriptions:
vlan1 default, I read don't touch it
vlan2 home internet via ISP
vlan3 vpn internet via OpenVPN

VLAN Configuration of switch #1 5 ports L2 Managed
Port1, Trunk, Tagged, vlan1,vlan2,vland3
Port2, Access, UnTagged, vlan2
Port3, trunk, Tagged, vlan3
Port4, Acccess, UnTagged, vlan3
Port5, Access, UnTagged, vlan2

Pfsense configuration:
vlan:

go to interfaces / VLANs, select em1 and add vlan2 home & vlan3 vpn
go to interfaces, add interfaces & associate VLAN & enable them.
set ip address & subnet for each interface
**home **
- home ip address 192.168.20.128/25 (62 hosts from 129 to 190)
- home dhcp server range 192.168.20.129-130 ( I might move the DHCP to the DD-WRT for the home network )
vpn
- vpn ip address 192.168.20.192/26 (62 hosts from 193 to 254)
- vpn dhcp server range 192.168.20.193-254
Firewall:
- rule #1 add home rule allow ipv4, source home 192.168.20.1/25 port *, dest *, port * , gateway * ( Router Port 2 home all static route to internet)
- rule #2 add home rule allow ipv4, source home 192.168.20.128/25 port *, dest *, port * , gateway * ( Router Port2 home DHCP address route to internet)
- rule #3 add GoViaVPN rule allow ipv4, source 192.168.20.192/26 , port *, dest *, port * , gateway * ( Router Port 3 & 4 VPN DHCP Address route to VPN)
(If TV on port 3 is set to static (e.g. 192.168.20.100), it will route based on Rule #1)

OpenVPN Client Setup:

Create OpenVPN Client, create interface & assign the OpenVPN Client connection, call it "openvpn_client"
Under Advanced Configuration, make sure you put route-nopull
OpenVPN Client NAT:
rule #4 add NAT rule source 192.168.20.192/26 , port *, gateway vpn address, port * ( All ip address from DHCP Server on 5.0GHZ VPN are routed to VPN)

Install IGMP

link vlan2 and vlan3 and make sure L2 Managed Switch has IGMP supported

Functionality:

Home static Lan, DHCP Lan, Home AP 2.4, AP 5.0 have access to home appliances + DLNA/UPnP available
VPN AP 5.0GHZ will allow me to route through VPN for internet anytime I want
If my TV is DHCP, it will route to VPN
If my TV is static ip ( Despite being on a vlan3 VPN port) when the packet exits L2 Smart Switch as vlan3 tag the Firewall rule is looking at IP address not the vlan3 tag) Does this make sense ?
If OpenVPN goes down, I still have internet
if edge router pfsense goes down, I only loose Internet for a while.
if edge router pfsense goes down for week, I enable DHCP on Linksys DD-WRT on WAN Port and plug directly to MODEM.

Further down the line:

Possibility to add another 3 additional AP with ubiquiti AP AC Lite ( Different VPN Provider, Guest , 5.0ghz AC Internet )
Create a vlan for Obitalk VOIP

Thank you :)

ChefRayB

After writing my previous post, I just realized I don't really need L2 managed, ubiquiti AP and the usage of VLAN .
VLANs are simply virtual interface sharing same hardware…. So a pfsense box with 4 ports (wan, lan, opt1, opt2) would suffice in theory.

Hardware required:

pfsense box ( 4 ports )
8 port switch un-managed ( already have)
4 port switch un-managed ( already have)
DD-WRT Linksys e4200 (already have)
cheap used router configured as AP supporting 5.0ghz (will ask around or still buy ubiquiti if can't get cheap 5.0ghz)

Pfsense Box (4 ports)
Wan - Modem
Lan -> router DD-WRT
-> DHCP Server Enabled ( This makes by dd-WRT fully independent)
- home ip address 192.168.20.129/25 (62 hosts from 129 to 190)
- home dhcp server range 192.168.20.130-190
-> AP 2.4GHZ (route to ISP internet)
-> AP 5.0GHZ (router to ISP internet)
-> wan -> pluged to Lan of Pfsense Box
-> Port 1 -> Access Switch #2 (8 port - Unmanaged)
-> Port 1 -> pluged to port 1 of router DD-WRT
-> port 2 to 7->(Sonos, Synology, Obitak VOIP, Xbox)
-> Port 8 -> Switch #3 (4 port - Unmanaged)
-> port 1-4 (Sonos)
Opt1 -> Cheap AP router
-> AP 5.0GHZ (route to VPN)
Opt2 -> plug directly to TV

pfsense configuration with interfaces (without any VLAN)
Lan interface internet via ISP
Opt1 internet via OpenVPN (opt1 is connected to AP )
Opt2 internet via OpenVPN (opt2 is connected to TV)

Lan interface (DHCP Disabled, my dd-wrt will take care of everything for home)

home ip address 192.168.20.64/26 (62 hosts from 65 to 126)

Opt1 interface (DHCP enabled, I put a used router for small AP)

vpn ip address 192.168.20.128/26 (62 hosts from 129 to 190)
vpn dhcp server range 192.168.20.129-190

Opt2 interface (DHCP enabled, this is what I plug to my TV, netflix 4k ! )

vpn ip address 192.168.20.192/26 (62 hosts from 193 to 254)
vpn dhcp server range 192.168.20.193-254

Firewall:

192.168.20.1/25 (126 hosts from 1 to 126) to internet ( this is my static range + dhcp range for home network to ISP )
192.168.20.128/25 (126 hosts from 129 to 190) to OpenVPN ( this is my dhcp range for openvpn )

OpenVPN

NAT 192.20.128/25 (128 hosts from 129 to 254) to OpenVPN

IGMP-Proxy

Install on lan, opt1 and opt2 ( Does IGMP proxy supports more than 2 interfaces ? )

Functionality:

Home static Lan, DHCP Lan, Home AP 2.4, AP 5.0 and DHCP Server all under dd-wrt router with DLNA/UPnP available
VPN AP 5.0GHZ will allow me to route through VPN for internet anytime I want
If my TV is DHCP, it will route to OpenVPN Interface which NAT translates to OpenVPN tunnel for internet
If my TV is static ip (<64), it will route to Internet
If OpenVPN goes down, I still have internet working
if edge router pfsense goes down, I only loose Internet for a while.
if edge router pfsense goes down for week, I enable DHCP on Linksys DD-WRT on WAN Port and plug directly to MODEM.

Thank you