Creating a Guest Wired & Wireless Network for Guest & IoT Traffic



  • My goal is to create a guest wired and wireless network for guest and IoT traffic. I have the following equipment in my home network:

    2 – Juniper EX3300 layer 3 switches in virtual chassis mode
    2 – Pfsense boxes (Watchguard XTM 5 & 8 Series) in HA mode
    3 – Ubiquiti UAP-AC-Pro APs

    I would like to get the guest wired network configured first. Once that is working, I will focus on the guest wireless network configuration.
    At a high level, here are some of the steps.

    Juniper Switch Configuration

    1. Create a Guest wired/wireless VLAN (VLAN 30)
    2. Do not configure the VLAN as a RVI (Routed VLAN interface)
    3. Assign the Guest VLAN to port 13,14,15, and 16 on the switch. Note: These ports will be assigned to the Home Network VLAN (VLAN 1) as well. These ports will be a trunk port. So these ports will have VLAN 1 and VLAN 30 assigned to them.
    4. Create DHCP server on the Guest Network (Vlan 30).

    Pfsense Configuration

    • Not sure about the steps in Pfsense to do the following; however, I believe the steps are very similar to configuring a DMZ in Pfsense:
    1. Guest network (VLAN 30) needs access to the internet
    2. Restrict guest network access to all other VLANs.
    3. Allow Home network VLAN (VLAN 1) access to the Guest network.

    Ubiquiti UAP-AC-Pro APs

    • Still doing some research on how to configure the APs. Currently I have a SSID for the home Wi-Fi network, so I will need another SSID for the Guest Wi-Fi network.

    I have attached a high-level diagram on my current network. I appreciate any help possible to implement this guest network design. If there is a better way of doing this, I would like to hear your feedback as well.


  • Netgate

    That sounds like basically what you would want to do.

    It's a little confusing though since you already have a VLAN 20 in your diagram.



  • @Derelict:

    That sounds like basically what you would want to do.

    It's a little confusing though since you already have a VLAN 20 in your diagram.

    Sorry I meant VLAN 30… I will change it in my original post.

    Could someone provide me the configuration steps in pfSense.


  • Rebel Alliance Global Moderator

    So you hairpin your devices on your access switch to your L3 to get routed back up to pfsense to get to the internet?

    You are using vlan 1 as your transit.. But you only have the 1 uplink so you have a hairpin..

    And then really vlan 1 is not a transit - since your using behind your L3 as well??  Or that is suppose to be your vlan 30  Yeah there is plenty wrong with your current network - fix that before you add another vlan.  Why do you trunk 10 and 20 to pfsense if pfsense only has the lan interface and no vlan interfaces to route, etc.

    Pick something to use as a transit that is not used anywhere else - use a /30 on the pfsense lan or /29 if you want to use this as your management vlan as well for your switches.  AP etc..  Then from your access switch there should be an uplink for the transit (not trunked) then a trunk uplink for your vlans your going to put on your access switch so you do not hairpin an interface.

    So your vlan 1 you show below L3, that would really be vlan 30.. Then yeah that is all you need to do.. If your using downstream router pfsense doesn't give 2 shits about vlans and or their tags.. Its not routing.  In your setup though you loose all of pfsense easy firewall between segments.

    Why are you not just letting pfsense do the routing and use your switches at L2?  But if you put your vlan 30 or other vlans on your L3.. And you want those to route at pfsense, then you would trunk them to pfsense, create the vlans and the firewall rules.  Then you would have to create a gateway down your transit (vlan 1 in your case it seems)..  You do understand this is going to be a mess of a hairpin if you want your vlan 30 to talk to any of your other vlans..




  • @johnpoz:

    So you hairpin your devices on your access switch to your L3 to get routed back up to pfsense to get to the internet?

    You are using vlan 1 as your transit.. But you only have the 1 uplink so you have a hairpin..

    And then really vlan 1 is not a transit - since your using behind your L3 as well??  Or that is suppose to be your vlan 30  Yeah there is plenty wrong with your current network - fix that before you add another vlan.  Why do you trunk 10 and 20 to pfsense if pfsense only has the lan interface and no vlan interfaces to route, etc.

    Pick something to use as a transit that is not used anywhere else - use a /30 on the pfsense lan or /29 if you want to use this as your management vlan as well for your switches.  AP etc..  Then from your access switch there should be an uplink for the transit (not trunked) then a trunk uplink for your vlans your going to put on your access switch so you do not hairpin an interface.

    So your vlan 1 you show below L3, that would really be vlan 30.. Then yeah that is all you need to do.. If your using downstream router pfsense doesn't give 2 shits about vlans and or their tags.. Its not routing.  In your setup though you loose all of pfsense easy firewall between segments.

    Why are you not just letting pfsense do the routing and use your switches at L2?  But if you put your vlan 30 or other vlans on your L3.. And you want those to route at pfsense, then you would trunk them to pfsense, create the vlans and the firewall rules.  Then you would have to create a gateway down your transit (vlan 1 in your case it seems)..  You do understand this is going to be a mess of a hairpin if you want your vlan 30 to talk to any of your other vlans..

    I am so sorry.. I posted the wrong diagram.. Attached is the correct diagram. My apologize. I changed the diagram in my original post as well.


  • Rebel Alliance Global Moderator

    Why would you trunk you transit down to your layer 2?

    So your question is that you want to just add a vlan 30 to pfsense?  And you want this vlan to be off of your AP?

    Well trunk your connections to your AP tagging the vlans you wan to carry while your vlan 1 is untagged since the management of your AP has to be untagged.  Then layer 2 only use on your core switch.. You can vlan that up your transit connection to a vlan on pfsense.  But again this will be hairpin.. If possible create a new uplink for your vlans that will be on your AP so you do not hairpin.

    Or do you just want to isolate these vlans you create on your AP from your other vlans completely? Or could be limited via the ACL features of your core switch.  If so then that never needs to be brought up to pfsense at all.



  • @johnpoz:

    Why would you trunk you transit down to your layer 2?

    So your question is that you want to just add a vlan 30 to pfsense?  And you want this vlan to be off of your AP?

    Well trunk your connections to your AP tagging the vlans you wan to carry while your vlan 1 is untagged since the management of your AP has to be untagged.  Then layer 2 only use on your core switch.. You can vlan that up your transit connection to a vlan on pfsense.  But again this will be hairpin.. If possible create a new uplink for your vlans that will be on your AP so you do not hairpin.

    Or do you just want to isolate these vlans you create on your AP from your other vlans completely? Or could be limited via the ACL features of your core switch.  If so then that never needs to be brought up to pfsense at all.

    Before I configure the guest network, I want to make sure my current setup is correct. What changes are you recommending in my current design to improve it?



  • @johnpoz:

    Why would you trunk you transit down to your layer 2?

    So your question is that you want to just add a vlan 30 to pfsense?  And you want this vlan to be off of your AP?

    Well trunk your connections to your AP tagging the vlans you wan to carry while your vlan 1 is untagged since the management of your AP has to be untagged.  Then layer 2 only use on your core switch.. You can vlan that up your transit connection to a vlan on pfsense.  But again this will be hairpin.. If possible create a new uplink for your vlans that will be on your AP so you do not hairpin.

    Or do you just want to isolate these vlans you create on your AP from your other vlans completely? Or could be limited via the ACL features of your core switch.  If so then that never needs to be brought up to pfsense at all.

    Not sure why I have the transit vlan (Vlan 2000) configured on the downstream layer 2 switch (Quanta LB6M). It serves no purpose. I will remove the transit vlan from the Layer 2 switch.



  • I have posted a new diagram with the transit Vlan (Vlan 2000) removed from the downstream Layer 2 switch (Quanta LB6M).

    Now back to the guest wired and wireless network. Since I have 3 APs, it may be best to use one exclusively as a Guest WI-FI. If yes, to truly isolate it from the Home network, could I create an interface on the Pfsense box and connect it directly to the Pfsense box. That assumes I have an extra network port available on the Pfsense box.  At this point, I am really confused and need some direction…


  • Rebel Alliance Global Moderator

    "Since I have 3 APs, it may be best to use one exclusively as a Guest WI-FI"

    Why would you do that??  These are unifi AP are they not.. They do vlans - so just do that.. Create vlans just like you have other vlans…  You clearly see no need to filter between your current vlans so you have them on layer 3 router.  Do you have any ACLs setup on them.  Why do you not just do the same with your wifi vlans?

    But if you want pfsense to control some or all of the vlans you put on your wifi network..  Create the interface/vlan on pfsense and connect it to your network either tagged or untagged to pfsense..  At a loss to how someone could setup such a network and then no know how to add another vlan?

    If you want to add a vlan ssid to your AP.. Then trunk the port that is connected to that AP and tag that vlan.  Then connected that to pfsense either via another uplink or trunk your current transit interface and add your tag vlans, etc.

    Do you have your DMZ on your transit vlan as a VIP?? So your running multiple layer 3 on that layer 2?



  • @johnpoz:

    "Since I have 3 APs, it may be best to use one exclusively as a Guest WI-FI"

    Why would you do that??  These are unifi AP are they not.. They do vlans - so just do that.. Create vlans just like you have other vlans…  You clearly see no need to filter between your current vlans so you have them on layer 3 router.  Do you have any ACLs setup on them.  Why do you not just do the same with your wifi vlans?

    But if you want pfsense to control some or all of the vlans you put on your wifi network..  Create the interface/vlan on pfsense and connect it to your network either tagged or untagged to pfsense..  At a loss to how someone could setup such a network and then no know how to add another vlan?

    If you want to add a vlan ssid to your AP.. Then trunk the port that is connected to that AP and tag that vlan.  Then connected that to pfsense either via another uplink or trunk your current transit interface and add your tag vlans, etc.

    Do you have your DMZ on your transit vlan as a VIP?? So your running multiple layer 3 on that layer 2?

    I am still learning about networking. My current setup was designed by reading a lot of information over the internet.

    The APs are UnFi APs. I do not have ACLs setup. The DMZ is currently not setup right now. I will take your recommendation and design a solution and post a drawing before I implement it. Thanks for all your feedback so far.



  • @johnpoz:

    "Since I have 3 APs, it may be best to use one exclusively as a Guest WI-FI"

    Why would you do that??  These are unifi AP are they not.. They do vlans - so just do that.. Create vlans just like you have other vlans…  You clearly see no need to filter between your current vlans so you have them on layer 3 router.  Do you have any ACLs setup on them.  Why do you not just do the same with your wifi vlans?

    But if you want pfsense to control some or all of the vlans you put on your wifi network..  Create the interface/vlan on pfsense and connect it to your network either tagged or untagged to pfsense..  At a loss to how someone could setup such a network and then no know how to add another vlan?

    If you want to add a vlan ssid to your AP.. Then trunk the port that is connected to that AP and tag that vlan.  Then connected that to pfsense either via another uplink or trunk your current transit interface and add your tag vlans, etc.

    Do you have your DMZ on your transit vlan as a VIP?? So your running multiple layer 3 on that layer 2?

    Here is my understanding of your recommendation based on the option for trunking my current transit interface. Please verify….

    Juniper Switch Configuration
    1.  Create a Guest wired/wireless VLAN (VLAN 30)
    2.  Do not configure the VLAN as a RVI (Routed VLAN interface)
    3.  Assign the Guest VLAN to port 13,14,15, and 16 on the switch. Note: These ports will have the Home Network VLAN (VLAN 1) as well as the Native VLAN (untagged traffic). These ports will be a trunk port. So these ports will have VLAN 1 and VLAN 30 assigned to them. VLAN 30 will tagged and the Native VLAN will be untagged.
    4.  Create DHCP server on the Guest Network (Vlan 30).

    Ubiquiti UAP-AC-Pro APs

    1. Connect the APs to Port 13,4,15, or 16 on the Juniper Switch. These ports are trunk ports carrying traffic from VLAN 30 (tagged traffic) and the native VLAN (VLAN 1 – untagged traffic).
    2. Create Guest VLAN 30 on the UniFi AP.
    3. Create the Guest SSID on the UniFi AP and assign it to VLAN 30.
    4. The Home Network SSID on the UniFi AP already exist and I don’t need to assign this SSID to a VLAN.

    Pfsense Configuration
    1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
    2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
    3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

    Please let know if my understanding of your recommendation is correct.  Additionally I would like to understand the other option based on creating another uplink to pfsense for the guest VLAN (VLAN 30).


  • Rebel Alliance Global Moderator

    other than the specific ports since I do not know what those would be that seems correct.

    But 2 and 3 on the AP is really just 1 step - there is no creating of a vlan on the AP… When you create your SSID you just put in the vlan id you will be using.  Ie 30 in your case.

    Keep in mind with such a setup you have a hairpin for guest to any of your other vlans.

    I think to be honest you did way to much reading -- in such a small network the use of L3 downstream of pfsense is overkill and over complex the network..  And removes the the functionality of being able to firewall easy between your segments at pfsense..  If me I would remove the whole layer 3 setup and just let pfsense firewall/route between your segments.. Unless you have need of huge amounts of bandwidth between your vlans?  And pfsense firewall/routing hit would be too much???

    Since your not using any acl between your vlans - why not just put them all on the same so now you do not have to route between them at all - if you have not need of firewall between them, etc.



  • @johnpoz:

    other than the specific ports since I do not know what those would be that seems correct.

    But 2 and 3 on the AP is really just 1 step - there is no creating of a vlan on the AP… When you create your SSID you just put in the vlan id you will be using.  Ie 30 in your case.

    Keep in mind with such a setup you have a hairpin for guest to any of your other vlans.

    I think to be honest you did way to much reading -- in such a small network the use of L3 downstream of pfsense is overkill and over complex the network..  And removes the the functionality of being able to firewall easy between your segments at pfsense..  If me I would remove the whole layer 3 setup and just let pfsense firewall/route between your segments.. Unless you have need of huge amounts of bandwidth between your vlans?  And pfsense firewall/routing hit would be too much???

    Since your not using any acl between your vlans - why not just put them all on the same so now you do not have to route between them at all - if you have not need of firewall between them, etc.

    Thanks for the confirmation.

    You are correct about doing a lot of reading to setup my current network. I thought about the router-on-a-stick concept with Pfsense performing all the inter-vlan routing. However; several network experts suggested that since the Juniper switch is a layer 3 switch, let it perform the routing.

    Before I go down the router-on-a-stick concept, is there a setup to eliminate the hairpin?



  • @johnpoz:

    "Since I have 3 APs, it may be best to use one exclusively as a Guest WI-FI"

    Why would you do that??  These are unifi AP are they not.. They do vlans - so just do that.. Create vlans just like you have other vlans…  You clearly see no need to filter between your current vlans so you have them on layer 3 router.  Do you have any ACLs setup on them.  Why do you not just do the same with your wifi vlans?

    But if you want pfsense to control some or all of the vlans you put on your wifi network..  Create the interface/vlan on pfsense and connect it to your network either tagged or untagged to pfsense..  At a loss to how someone could setup such a network and then no know how to add another vlan?

    If you want to add a vlan ssid to your AP.. Then trunk the port that is connected to that AP and tag that vlan.  Then connected that to pfsense either via another uplink or trunk your current transit interface and add your tag vlans, etc.

    Do you have your DMZ on your transit vlan as a VIP?? So your running multiple layer 3 on that layer 2?

    I am trying to understand your comment about another uplink to pfSense.  I assume the new uplink from the Juniper switch to pfSense would be a trunk port containing VLAN 30 as tagged and the native VLAN (VLAN 1) as untagged.  The current Transit network uplink to pfSense would still exist as well. Right now, the Home Wi-Fi traffic (VLAN 1) from my UniFi APs is being sent to pfSense over the transit network.  So if I create the new uplink to pfSense  with VLAN 30 and the native VLAN (VLAN 1), which uplink will be carrying the Home Wi-Fi traffic on VLAN 1?

    For the new uplink, here is what I believe is the pfSense configuration:
    1. Create a new interface called "GUEST" in pfSense and assign it to an available network port on the pfSense box.
    2. On the GUEST interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the GUEST interface.
    3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface.


  • Rebel Alliance Global Moderator

    Does pfsense have another interface you can use??  If so you can use that…

    "several network experts suggested that since the Juniper switch is a layer 3 switch, let it perform the routing. "

    expert would be your word not mine - to suggest such a thing to someone that doesn't know what they are doing and then walk away is MORONIC!!!  And now your left in your current pickle.. Like taking a kid that just learned that 2+2 is 4 and hey lets do some Polynomial Algebra ;)

    You do not need to create any vlan on pfsense if your going to use another interface - you only need to create a vlan in pfsense if its going to be TAGGED!!  If your switch is going to handle the vlan at layer 2 pfsense doesn't give 2 shits what the switch is using as the vlan ID..

    How many physical interfaces does pfsense have?  How many interfaces are you using up for your LACP setup?  How fat is your internet pipe, how many actual clients are we talking..



  • @johnpoz:

    Does pfsense have another interface you can use??  If so you can use that…

    "several network experts suggested that since the Juniper switch is a layer 3 switch, let it perform the routing. "

    expert would be your word not mine - to suggest such a thing to someone that doesn't know what they are doing and then walk away is MORONIC!!!  And now your left in your current pickle.. Like taking a kid that just learned that 2+2 is 4 and hey lets do some Polynomial Algebra ;)

    You do not need to create any vlan on pfsense if your going to use another interface - you only need to create a vlan in pfsense if its going to be TAGGED!!  If your switch is going to handle the vlan at layer 2 pfsense doesn't give 2 shits what the switch is using as the vlan ID..

    How many physical interfaces does pfsense have?  How many interfaces are you using up for your LACP setup?  How fat is your internet pipe, how many actual clients are we talking..

    I agreed with your comments about network experts.. I am still learning.

    I have 2 extra network ports available on the master and backup pfSense box.  I am using 2 ports on the pfSense box for my LACP setup. My internet connection is 120Mbps DL / 6Mbps UL. This is my home network. Currently there is less than 5 users. In the future, I will be using this setup for a home business.

    I have a more detailed drawing if you want me to post it…


  • Rebel Alliance Global Moderator

    You have zero use of a carp setup with lacp and a downstream router in a HOME setup, or even a home business.. You don't even have a internet pipe that would suggest such a setup..

    You have no need of lacp, nor L3 router in your setup.. Why do you not just let pfsense do what it was designed to do and that is route and firewall?  Use your switches as layer 2 only which really simplifies your setup.. And will allow for you to actually firewall between your segments and create guest wifi or wired networks in minutes, etc..

    Sure looks to me like your behind a double nat and not sure what you think your carp setup is getting you either??  Other than cost, complexity - for what exactly??  You believe that hardware is going to fail?

    So you have 5 interfaces total in 1 of your pfsense boxes?  That means you could have 4 network segments behind without having to do any vlan on pfsense at all.  Just let your switch do it at layer 2.. And setup untagged ports on your switch as uplinks to the the pfsense interfaces.  If you need to just vlan for multiple wifi networks since they prob have little use of 1 gig bandwidth and normally wireless clients do not talk to each other much anyway across segments.

    Once you understand the basics - then you can move up to lacp, downstream routers, etc. when there is an actual NEED for it!!!


  • Netgate

    The whole point in creating a guest/iot network is usually to PREVENT inter-VLAN traffic so hairpinning the VLAN on one interface with LAN is probably a non-issue.

    Create VLAN 30 on the same pfSense physical interface (or lagg) as VLAN 2000.

    Interfaces > (assign) Create a GUEST interface on the VLAN 30 pfSense interface. That traffic will be TAGGED on that physical port/lagg.

    Create DHCP server, firewall rules, outbound NAT (if not auto/hybrid) for the GUEST interface.

    TAG VLAN 30 through your switches but DO NOT create an SVI/RVI.

    TAG VLAN 30 to the access points.

    Create a GUEST SSID on the Unifi with the VLAN set to 30.

    And you're done.

    I would consider the same procedure for a separate IoT network as that might require different rules, etc.



  • @Derelict:

    The whole point in creating a guest/iot network is usually to PREVENT inter-VLAN traffic so hairpinning the VLAN on one interface with LAN is probably a non-issue.

    Create VLAN 30 on the same pfSense physical interface (or lagg) as VLAN 2000.

    Interfaces > (assign) Create a GUEST interface on the VLAN 30 pfSense interface. That traffic will be TAGGED on that physical port/lagg.

    Create DHCP server, firewall rules, outbound NAT (if not auto/hybrid) for the GUEST interface.

    TAG VLAN 30 through your switches but DO NOT create an SVI/RVI.

    TAG VLAN 30 to the access points.

    Create a GUEST SSID on the Unifi with the VLAN set to 30.

    And you're done.

    I would consider the same procedure for a separate IoT network as that might require different rules, etc.

    Derelict … So these are the steps..

    Juniper Switch Configuration
    1.   Create a Guest wired/wireless VLAN (VLAN 30)
    2.   Do not configure the VLAN as a RVI (Routed VLAN interface)
    3.   Assign the Guest VLAN to port 13,14,15, and 16 on the switch. Note: These ports will have the Home Network VLAN (VLAN 1) as well as the Native VLAN (untagged traffic). These ports will be a trunk port. So these ports will have VLAN 1 and VLAN 30 assigned to them. VLAN 30 will tagged and the Native VLAN will be untagged.
    4.   Create DHCP server on the Guest Network (Vlan 30).

    Ubiquiti UAP-AC-Pro APs
    1.   Connect the APs to Port 13,4,15, or 16 on the Juniper Switch. These ports are trunk ports carrying traffic from VLAN 30 (tagged traffic) and the native VLAN (VLAN 1 – untagged traffic).
    2.   Create the Guest SSID on the UniFi AP and assign it to VLAN 30.
    3.   The Home Network SSID on the UniFi AP already exist and I don’t need to assign this SSID to a VLAN.

    Pfsense Configuration
    1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
    2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
    3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface


  • Netgate

    Looks right to me.

    IDK if you can do DHCP on the switch without an RVI on that VLAN but if you can and you want DHCP there, that's fine. Else do it on pfSense.


  • Rebel Alliance Global Moderator

    Already told you could do it that way…  Now Derelict has validated it... Do it already..



  • Thanks everyone for your help.. I truly appreciate it..

    I will deploy the changes tonight and let you know. I may need some help on the firewall rules for Guest interface (VLAN 30) on the pfSense box.

    Essentially, I want the Guest interface on the pfSense box to do the following:
    1. Allow access to the internet
    2. Block access to all or specific subnets

    However, I do want to allow my other subnets access to the Guest network, but the Guest network cannot access my internal subnets.

    I hope this is not confusing.


  • Netgate

    Rules allowing access from the other subnets to the guest network will be on the transit interface (vlan 2000).

    The attached is pretty basic but generally works for limiting guest access.

    My local_nets_v4 includes some repetition. Blocking RFC1918 is probably sufficient unless you have inside networks on public IP space.

    ![Screen Shot 2017-08-06 at 2.26.11 PM.png](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.26.11 PM.png)
    ![Screen Shot 2017-08-06 at 2.26.11 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.26.11 PM.png_thumb)
    ![Screen Shot 2017-08-06 at 2.27.13 PM.png](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.27.13 PM.png)
    ![Screen Shot 2017-08-06 at 2.27.13 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2017-08-06 at 2.27.13 PM.png_thumb)



  • I was looking over my pfSense configuration and I think it is not totally correct.

    Pfsense Configuration
    1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
    2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
    3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

    If I trunk the Transit network (VLAN 2000) and add VLAN 30  (Guest VLAN) to it, both VLANs will be tagged. So in addition to creating a subinterface on the LAN interface in pfSense for VLAN 30, I will now need to create VLAN 2000 in pfSense as well. VLAN 2000 will be the assigned to the original LAN interface. Does that sound correct? Please advise.



  • @pglover19:

    I was looking over my pfSense configuration and I think it is not totally correct.

    Pfsense Configuration
    1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
    2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
    3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

    If I trunk the Transit network (VLAN 2000) and add VLAN 30  (Guest VLAN) to it, both VLANs will be tagged. So in addition to creating a subinterface on the LAN interface in pfSense for VLAN 30, I will now need to create VLAN 2000 in pfSense as well. VLAN 2000 will be the assigned to the original LAN interface. Does that sound correct? Please advise.

    Got pfSense working.. I created VLAN 2000 in pfSense as well and assigned it to the original LAN interface. All the routing and firewall is now working for the LAN interface. Will be configuring the GUEST interface (VLAN 30) shortly.



  • @pglover19:

    @pglover19:

    I was looking over my pfSense configuration and I think it is not totally correct.

    Pfsense Configuration
    1. On the Transit Network (VLAN 2000) uplink from the Juniper switch to Pfsense, add VLAN 30 to the Transit network. So, this will become a trunk port with VLAN 2000 and VLAN 30 as tagged traffic.
    2. On the LAN interface in Pfsense, I need to create VLAN 30. This will become a subinterface off of the LAN interface.
    3. I can now create an interface for VLAN 30 and create the routing, firewall, and NAT rules for the VLAN 30 interface

    If I trunk the Transit network (VLAN 2000) and add VLAN 30  (Guest VLAN) to it, both VLANs will be tagged. So in addition to creating a subinterface on the LAN interface in pfSense for VLAN 30, I will now need to create VLAN 2000 in pfSense as well. VLAN 2000 will be the assigned to the original LAN interface. Does that sound correct? Please advise.

    Got pfSense working.. I created VLAN 2000 in pfSense as well and assigned it to the original LAN interface. All the routing and firewall is now working for the LAN interface. Will be configuring the GUEST interface (VLAN 30) shortly.

    I can't get the Guest network in pfSense working. I am testing using a wired connection. I configure a static IP address on my laptop (192.168.30.10) and connected directly into the switch port that is configured for VLAN 2000 (Transit network) and VLAN 30 (Guest network).

    I have attached all the Guest network configuration in pfSense. It seems as though pfSense is not receiving VLAN 30 traffic.


  • Netgate

    So tag VLAN 30 through to the client. Client should be on an untagged port on VLAN 30.

    This isn't rocket science.

    If pfSense is not receiving traffic on that port on VLAN 30 then it's your switch/layer 2 that isn't passing it.

    You obviously need DHCP on GUEST (unless provided from something else) and firewall rules passing the traffic into GUEST for anything to work.



  • @Derelict:

    So tag VLAN 30 through to the client. Client should be on an untagged port on VLAN 30.

    This isn't rocket science.

    If pfSense is not receiving traffic on that port on VLAN 30 then it's your switch/layer 2 that isn't passing it.

    You obviously need DHCP on GUEST (unless provided from something else) and firewall rules passing the traffic into GUEST for anything to work.

    For some reason, my DHCP setup on VLAN 30 on the Juniper switch is not working. Maybe because VLAN 30 is not setup for inter-vlan routing.

    I created the Guest SSID on the UniFi AP and assigned it to VLAN 30. I went ahead and setup DHCP on the pfSense box and when I connect to the Guest SSID, I can now access the internet. Traffic to the other subnets is blocked as well. So, major progress. I will tinker with it more tomorrow. Thanks everyone…


  • Netgate

    I said earlier that you can probably not run a DHCP server on the switch without an RVI.



  • Is there any reason to assign an IP address to the Guest Vlan (VLAN 30) created on the Juniper switch? Right now I assigned it "192.168.30.1" but I am not sure if it is serving any purpose. On the pfSense box, the Guest interface (VLAN 30) has been assigned IP address "192.168.30.2".


  • Netgate

    No. I specifically said NOT to create one. You want the firewall to route traffic, not the switch.



  • @Derelict:

    No. I specifically said NOT to create one. You want the firewall to route traffic, not the switch.

    Everything is working now. Thanks for the help.



  • @Derelict:

    Rules allowing access from the other subnets to the guest network will be on the transit interface (vlan 2000).

    The attached is pretty basic but generally works for limiting guest access.

    My local_nets_v4 includes some repetition. Blocking RFC1918 is probably sufficient unless you have inside networks on public IP space.

    How did you create the local_nets_v4 table?



  • I created a Firewall Alias and it worked for me…



  • Got everything working.. I may tinker with the firewall rules on the Guest network some more…

    Here is the final drawing. Thanks everyone.


  • Rebel Alliance Global Moderator

    Why are you calling it lan vip and dmz vip?  Sounds like to me you are running 2 different layer 3 networks on the same layer 2??



  • @johnpoz:

    Why are you calling it lan vip and dmz vip?  Sounds like to me you are running 2 different layer 3 networks on the same layer 2??

    Sorry about the confusion. The drawing is not correct. For the DMZ, I will have separate Layer 3 switch. It is currently not setup yet….

    I will update the drawing the reflect the separate Layer 3 switch for the DMZ and it's uplink to pfSense.



  • Here is the correct drawing with the proposed DMZ setup. Once again, I have not installed the DMZ switch yet.



  • johnpoz … Do you see anything weird about my proposed DMZ setup?