Create a guest network with VLAN tag 1003



  • Thanks johnpoz, this is immensely useful.

    2 - OK. Thanks a lot. It helps to know this deny all rule is there by default.

    3 - I created a rule "Block packets to all IPs on the firewall, wan, lan, opt, etc. (this SG-1000)". I tried it, it seems to work. Access is allowed when I am on the LAN and access seems denied when I am on the INVITES network.

    4 - I created a rule "Block packets to IP 192.168.0.1 (the Zyxel modem-router)". Similarly, I tried it and it seems to work.

    Then on System / Advanced Miscellaneous

    Gateway monitoring I have Ticked "Skip rules when gateway is down"

    If I understand your two last suggestions well,

    I would create either one of the two following additional rules on INVITES gateway (created for the photo below but not active yet):

    Either: as a first rule "Block all packets from INVITES to LAN" (not active)

    Or as a last rule "And allow all INVITES' packets except to LAN addresses" (not active).

    More precisely, I would create either one of these two rules and remove the rule "And allow INVITES to internet gateway only" and remove the "Skip rules when gateway is down" instruction.

    I am writing this with the pfSense definitive guide (the book) open in front of me and I do not even find there (nor in the pfsense Book on the web) the definitions of the default aliases (like This Firewall, LAN net, INVITES net).

    Is my understanding correct ? TIA

    ![Rules > INVITES v2017-10-29.png](/public/imported_attachments/1/Rules > INVITES v2017-10-29.png)
    ![Rules > INVITES v2017-10-29.png_thumb](/public/imported_attachments/1/Rules > INVITES v2017-10-29.png_thumb)



  • Hello, johnpoz. I had not tested enough. With my new ruleset, the INVITES (guests) were denied access to the internet. By trial and error, I found the culprit: "Block packets to this Firewall (all IPs on the firewall, wan, lan, opt, etc.) (this SG-1000)"

    I replaced it by

    Block packets to IP 192.168.1.1 (this SG-1000)

    There it works. So the second option of your suggestion, instead of blocking access to IP 192.168.1.1 (the SG-1000 Web interface), of "either block it to the specific interface you concerned with ; Or use the built in alias "this firewall" which is all IPs on the firewall, wan, lan, opt, etc." was, apparently, too broad. It blocked internet access.

    I attach a picture of the current ruleset I now use.

    TIA for any comment.

    ![Rules > INVITES v2017-11-03.png](/public/imported_attachments/1/Rules > INVITES v2017-11-03.png)
    ![Rules > INVITES v2017-11-03.png_thumb](/public/imported_attachments/1/Rules > INVITES v2017-11-03.png_thumb)


  • LAYER 8 Global Moderator

    You need to allow these clients to talk to the services you want on pfsense invite address.  Like dns, ping.. Then use the block this firewall..

    Your blocking access to the lan address of pfsense.  But can hit the gui on invite IP, or the Wan IP or any other IP that is not lan.. Say you bring up another vlan, etc.

    Just walk down your rules top down, stop when you get a rule that triggers..  Walk through what you want to allow or block..



  • OK, so My rule "block packets to IP 192.168.1.1" is too narrow. I need (1) to block all packets to This Firewall and (2) allow by a higher level rule internet access, which is the services that I want to allow to pfsense INVITES. I tried many things, which all failed.

    I looked in the printed book "pfSense the definitive guide" and in "The pfSense book" which I had downloaded last week in epub format to my iPad. I found no mention on how to allow INVITES clients (INVITES IPs) to talk to the services I want.  Like dns, ping..

    The rule "Allow to WAN net" defeated my blocking rule "block packets to This firewall" and allowed access to the firwall web interface.

    On the opposite, "Allow packets to all TCP/UDP" does not suffice to give internet access.

    I am currently short on ideas. I need to get away from the computer, move back to simpler bicycle life and will try again tomorrow. Thanks, johnpoz, for your kind help. I guess I have a slow brain, which translates into cerveau lent in french, a pun (cerf volant).


  • LAYER 8 Global Moderator

    Post up your current rules, and and what you would like your clients to be able to do and not do and will post screen shot of how to accomplish it and we can discuss why and how it works, etc.

    Maybe this will help?

    This is my dmz vlan.. So its locked from talking to any of my other networks.

    So I allow ping to ipv4, v6 to pfsense IP address on this vlan
    I allow this vlan to hit pfsense dns on either ipv4,v6 to the pfsense IP address in this vlan.
    I then block any other access to any other IP address of pfsense, be it dmz, lan, wlan or even the wan IP, etc.  That is what the this firewall alias is, its a list of all IPs on the firewall.
    I then allow traffic anywhere as long as not any of my networks, which are all rfc1918 space.  Create alias that lists the rfc1918 networks, use ! (not) on this dest.. So as long as its some public IP its allowed.
    Same goes for my local IPv6 space, that is made up of /64 from my /48 from HE, etc.

    Does that help?  Happy to discuss.




  • Thank you for the reply. That does help enormously. This is also quite above my level of understanding, so: (1) thank you very much for your consideration on this, (2) I will, with regards so far only to IPv4 (IPv6 will be mañana for me), do my homework and try to understand (2.1) why allowing ping may be important for IPv4 clients on the INVITES network, (2.2) why allowing DNS to pfSense may be useful to IPv4 clients (in my config, DNS is mainly provided by the PPPoE server of my ISP so I would anticipate that it would flow through gracefully). I will try to understand first instead of copying the rules. I intend to reply tomorrow and will (3) post then my current rules, without changing them until then. All that after allowing time to my bicycle club.  :D Thanks and sorry for the delay.


  • LAYER 8 Global Moderator

    No delay ;)  I am not going anywhere.. Been here over 10 years.. More than likely be here for atleast a few more days ;) hehehe

    Take your time and happy to walk through any rules you don't quite understand.

    When it clicks you will kick yourself as to how simple it is..  But a basic understanding of ports and IP and such is a huge plus that is for sure ;)

    Rules are evaluated as the traffic enters the interface towards pfsense from the network pfsense is attached too.. Clients sending traffic to internet or trying to get off the lan will send it inbound into the pfsense lan interface.  So just walk down the rules from the top.. Does the traffic match that rule - if so its triggered and no others are evaluated be it allows the traffic or blocks it.

    If it doesn't match that rule, then it moves to the next rule from the top down.. Until it finds a rule that matches the traffic, or doesn't if it gets to the end and no rules match then it would be denied by the default deny rule.



  • Thanks johnpoz. I wanted to do my homework on PING and DNS and post my existing rules before anything else, so here it goes:

    2.1 PING. I never use ping so did not know why allowing ping to INVITES would be useful to them to permit their internet access. The PFSense docs state in Connectivity Troubleshooting "Check that the LAN (INVITES) rule allows all protocols, or at least TCP and UDP ports for reaching DNS and HTTP/HTTPS and allow ICMP for testing […]". This does not seem to say why PING is needed to INVITES (for testing?). So I searched again, and on security.stackexchange at "Is there any risk in allowing PING packets out through a firewall?", the subsequent discussion seems to state PING is a comfort rather than a *MUST and that (at a high cost to their convenience) denying PING to INVITES would remove the security risk cased by allowing ICMP reply echo back in. So PING does not seem to be mandatory for my INVITES.

    2.2 DNS servers. There I am more confused. I edited my earlier post. My setup is as standard pfSense as possible and, accordingly, the SG-1000 connects via DHCP to the Zyxel modem router which receives DNS info from my ISP. So, in my control panel, DNS Server addresses are 127.0.0.1 (originated from the SG-1000 setup), 192.168.0.1 (the Zyxel modem router) 8.8.8.8 and 8.8.4.4 added in by the SG-1000. No mention even of the 80.10.246.130 DNS server provided by my ISP to the Zyxel modem router. So I may need to copy your rule "Allow DNS to PFSense".

    (3) My rules are attached, unchanged so far (5 of them are grayed out, only 4 are active). As they are, they allow internet access to INVITES. What would blocks them would be my use my rule "Block packets to This firewall". I will experiment on (1) an allow rule on top allowing access to port53 (DNS) similat to your rule on your DMZ and (2) on an allow rule on top to allow HTTP traffic through the HTTP port (I have the list of ports somewhere), just to see whether or not HTTP requires it (a test which can't do harm) and report back here. Thanks.

    ![Rules > INVITES v2017-11-03.png](/public/imported_attachments/1/Rules > INVITES v2017-11-03.png)
    ![Rules > INVITES v2017-11-03.png_thumb](/public/imported_attachments/1/Rules > INVITES v2017-11-03.png_thumb)


  • LAYER 8 Global Moderator

    2.1.  You never use ping?  Wow… I use it multiple times a day every single day... It is just back connectivity check.. Something doesn't work, can you ping it..

    Ie if wireless is not working and you show it connected, can you even ping the gateway.. First thing to check when something doesn't work is can you ping it or your gateway, etc.  But if you do not think you use it or need it then no you don't need to allow it.

    2.2  Out of the box pfsense running dhcp will hand its OWN ip on that interfaces as your dns server, it will then resolve.. Not forward.. So what you set in dns under general is pointless unless your forwarding..  Or you want pfsense to use something else for dns if its own resolver is down. Ie the 127.0.0.1 entry.

    What are your clients pointing to for dns?  Simple ipconfig /all on them will show you where they point for dns.. Or simple nslookup www.google.com will tell you if you can resolve and what your using for dns..



  • Now I can reply to your two posts. A basic understanding of ports and IP and such is a huge plus that is for sure ;) YES indeed, that is a huge requirement. The french forum provides a link to a great tutorial (<http://irp.nain-t.net/doku.php>). I need to spend more time there.

    Yes, I got the logic of rules ordering, which means a huge difference from what I am used to from Apple devices, like the preset guest network set of rules on Airport routers which just work like magic.

    PING ? I need to learn how to use it. This never crossed my head.

    DNS. <quote>So what you set in dns under general is pointless unless your forwarding..  Or you want pfsense to use something else for dns if its own resolver is down. Ie the 127.0.0.1 entry. OK. I will not experiment on forwarding. I experimented as planned on an allow rule on top allowing access to port 53 (DNS) similar to your rule on your DMZ. It did its magic and everything immediately worked just like magic. No need for HTTP allow rule and the serie of equivalent rules… I will check on the tutorial above to better understand why my INVITES, who are expected to know nothing about DNS, need to be allowed to send packets to 192.168.2.1 (their router address) on port 53 for internet and mail to work for them.

    I did some clean-up job on my rules. Here they are (5 active rules). They work fine and I understand they should be protective enough to allow me some rest and prepare for my next endeavour which will be the implementation of a crude form of traffic shaping to prevent the IP clients downloading stuff from appropriating all bandwith away from my wife's web browsing. This will be for next month. Thanks johnpoz, thanks a lot. I would never have managed that alone (even with tons of books).  ;D ;D ;D

    ![Rules > INVITES V2017-11-06.png](/public/imported_attachments/1/Rules > INVITES V2017-11-06.png)
    ![Rules > INVITES V2017-11-06.png_thumb](/public/imported_attachments/1/Rules > INVITES V2017-11-06.png_thumb)</quote>



  • I’m attempting to get my guest network setup on my Airport Extremes and this thread has been very helpful but a couple of things I’m not sure about.

    I’m using a Netgear GS724Tv2 switch to create the vlans MAIN_VLAN10 (pvid10) for all my desktops, printers and servers and WIFI_VLAN20 (pvid20) for the Airports. If I’m understanding correctly the Airports will tag guest traffic with 1003? I just need to set a VLAN20 on my firewall for my smart phones and laptops with rules to allow proper access to VLAN10 and internet? Set a VLAN1003 on my firewall with rules to allow access only to internet?

    Still a little foggy on how pfSense matches the tags? Do I need special firewall rules to seperate VLAN20 traffic from vlan1003 traffic?

    BTW- It’s a router-on-a-stick configuration. Switch connected to pfSense connected to single WAN.



  • Why are you creating a VLAN for desktops etc.?  Normally, those don't need a VLAN, so you'd have to set up access ports on VLAN 10.  Also, each VLAN in pfSense appears as a separate logical interface, which you'd use as any other interface.  The rules etc., will depend on what you want to do.



  • @JKnott:

    Why are you creating a VLAN for desktops etc.?  Normally, those don't need a VLAN, so you'd have to set up access ports on VLAN 10.  Also, each VLAN in pfSense appears as a separate logical interface, which you'd use as any other interface.  The rules etc., will depend on what you want to do.

    When I set those vlans up I was using a guide that I modified slightly to meet my needs. That’s all up and running except for the guest WiFi. I’m just not sure what I need to do to get pfSense to read the tags. Is this done in the background or do I need to configure a rule to match the packets with the 1003 tag to my guest network?


  • LAYER 8 Netgate

    Create a VLAN 1003 on the physical interface to your switch (using eth0 below as an example).

    Assign an interface to that VLAN 1003 on eth0 interface.

    Create appropriate firewall rules, DHCP services, etc on that interface.

    Everything transmitted by that interface will be tagged with 1003. Everything arriving tagged 1003 will be processed by that interface.



  • @wgstarks:

    I’m attempting to get my guest network setup on my Airport Extremes and this thread has been very helpful but a couple of things I’m not sure about.

    I’m using a Netgear GS724Tv2 switch to create the vlans MAIN_VLAN10 (pvid10) for all my desktops, printers and servers and WIFI_VLAN20 (pvid20) for the Airports. If I’m understanding correctly the Airports will tag guest traffic with 1003?

    I will just clarify the airport Extreme (or Express, or time Capsule) side.
    When used as a router, an Airport Extreme (and the other new Airport base stations) will be able to *create a guest network by VLAN tagging, assigning the Vlan tag 1003 to packets going to the guest network (ethernet or wireless).
    When used as a wifi simple access point, an airport Extreme base station will recognise packets Vlan tagged 1003 and be able to send them to the wireless guest network.
    Given that your airport base stations are wifi access points and not routers, none of them will do the Vlan tagging. But they will need it. You need to do it on your guest interface in the pfSense router. pfSense > Interfaces > VlanAssignment > Vlans. I attach a copy of my setup. HTH




  • @Derelict:

    Create a VLAN 1003 on the physical interface to your switch (using eth0 below as an example).

    Assign an interface to that VLAN 1003 on eth0 interface.

    Create appropriate firewall rules, DHCP services, etc on that interface.

    Everything transmitted by that interface will be tagged with 1003. Everything arriving tagged 1003 will be processed by that interface.

    Outstanding. That's what I thought. Just wanted to be sure.



  • @Michel-angelo:

    Given that your airport base stations are wifi access points and not routers, none of them will do the Vlan tagging. But they will need it. You need to do it on your guest interface in the pfSense router.

    This is all fairly new to me, but I don"t see how this could be? You are able to login to the wifi guest network and also into the regular network that you have setup right? The Airport must have some way to distinguish between the 2 different wifi networks. I would think that the Airport must be applying tags to all traffic entering the guest network via wifi. Of course there's always the chance that I'm completely wrong.  :D


  • LAYER 8 Global Moderator

    My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..

    https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
    The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs



  • @johnpoz:

    My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..

    https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
    The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs

    Thanks. I think I’ve kinda got my head wrapped around the basics of the tag routing now. Having a family day today, but I’ll give it a shot tomorrow and see if I can get it to work.

    Thanks to everyone for your help so far.



  • @wgstarks:

    @johnpoz:

    My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..

    https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
    The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs

    Thanks. I think I’ve kinda got my head wrapped around the basics of the tag routing now. Having a family day today, but I’ll give it a shot tomorrow and see if I can get it to work.

    Thanks to everyone for your help so far.

    Well that didn't turn out too good. I created a VLAN10 (pvid 10) on my switch with associated ports tagged. Created VLAN10_MAIN on my firewall for approved laptops and other wireless devices and created VLAN1003_Guest for guest use.

    VLAN1003 should have no access to local network. Only internet. I believe that's working.

    VLAN10 needs to have full access to the local network as well as the internet. I can get access to the internet but not the local network.

    I'm hoping I've just missed a rule or misconfigured one?


  • LAYER 8 Netgate

    No way to know without knowing what that LOCAL_NETWORKS Alias and those port aliases are. Those rules don't make much sense.

    What are you trying to do here?

    I personally despise "blocking" traffic with pass ! rules. Hate it. Loathe it. Wish it would die in a fire.

    If you want to block it, just block it. Then pass any.

    ![Screen Shot 2018-01-01 at 3.50.23 PM.png](/public/imported_attachments/1/Screen Shot 2018-01-01 at 3.50.23 PM.png)
    ![Screen Shot 2018-01-01 at 3.50.23 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2018-01-01 at 3.50.23 PM.png_thumb)



  • @Derelict:

    No way to know without knowing what that LOCAL_NETWORKS Alias and those port aliases are. Those rules don't make much sense.

    What are you trying to do here?

    I personally despise "blocking" traffic with pass ! rules. Hate it. Loathe it. Wish it would die in a fire.

    If you want to block it, just block it. Then pass any.

    local_subnets

    These rules aren't mine really. Straight from a guide. Would be glad for any suggestions to simplify them.

    As far as what I want to accomplish. I have 2 airports that are configured with a WPA2 “Home Network” which works and a “Guest Network” which shows “no internet”. I’m trying to setup a vlan that will allow guest connections to DHCP server and WAN only, without interfering with the “Home Network” which needs full access to local networks.


  • LAYER 8 Netgate

    Just because it's in a "guide" doesn't mean it's correct.

    You only gave half the picture. What destination ports are you passing?



  • @Derelict:

    Just because it's in a "guide" doesn't mean it's correct.

    You only gave half the picture. What destination ports are you passing?

    Not sure what you mean by destination ports?



  • @wgstarks:

    @Derelict:

    Just because it's in a "guide" doesn't mean it's correct.

    You only gave half the picture. What destination ports are you passing?

    Not sure what you mean by destination ports?

    Guess I'm a little slow tonight.:)


  • LAYER 8 Netgate

    I would disable those rules and add a pass any any rule. Does it work? Then you are not passing traffic you need to pass.

    You do realize that you will be unable to ping with that configuration because it is not passed, right?

    I can be confident that pfSense is behaving exactly as it is being instructed to behave.

    Check the firewall logs for what is being blocked and evaluate whether it should be passed and pass it or don't.



  • @Derelict:

    I would disable those rules and add a pass any any rule. Does it work? Then you are not passing traffic you need to pass.

    Thanks. Makes a lot of sense. Maybe one of these days I’ll learn to quit following these online step-by-step guides.🙄



  • Think I've got everything working now. Thanks @Derelict. Guest network has access to DHCP Server and WAN but no access to firewall or LAN (only other local network currently).

    The firewall rules may need some tweaking. Any advice? I checked pinging, that works.

    Edit: Caught my mistake with the "Block LAN Access" rule order. It's now one above "Allow Any".


  • LAYER 8 Netgate

    Your Allow any rule will pass all traffic and nothing below it will have any effect.



  • @Derelict:

    Your Allow any rule will pass all traffic and nothing below it will have any effect.

    Are you saying I should modify “allow any” or delete the rules below it? Or both?


  • LAYER 8 Global Moderator

    What he is saying is rules are evaluated top down, first rule to trigger wins - no other rules are evaluated.

    Anything below an any any allow is pointless since no traffic will ever make it to that rule since the any any allow will pass the traffic.  You need to place your rules in the correct order top down so they evaluate how you want them to evaluate.



  • Thanks. Actually, I understood that. Should have been more specific.

    I can see that the default block rules aren’t going to do anything. If I move the any-any rule below them then it won’t do anything. Since I’m a noob at this, I’m not sure if I should modify the any-any rule or just delete the default block rules? My intent with this rule is to allow unlimited acces to the internet.


  • LAYER 8 Global Moderator

    there is a default deny rule anyway.. There is no reason to create your own rule unless have turned off logging of the default rule and would still like to log stuff that makes it through your rules that you block that meet some specific criteria you setup in the block rule that would be different than default deny, etc.  Or if you only want to log stuff on specific lan side interfaces and have turned off the logging of the default deny rule that is on all interfaces.


Log in to reply