New to pfSense



  • Hey everyone

    I am totally new to pfSense and was looking for some advice. I have recently received a Netgate XG-7100-1U and am looking to integrate this in to my network. Currently I have the following hardware:

    • Netgate XG-7100-1U
    • Netgear XS708T (10g managed switch)
    • Unifi AP AC HD (x2)
    • Unifi Cloud Key Gen 2
    • Unifi Switch (US-16-150w)
    • FreeNAS running on 4U Supermicro chassis

    I was going to connect my devices:

    Internet -> pfSense -> Netgear XS708t -> Unifi US-16-150w

    I am wanting the FreeNAS server along with 3 computers connected to the Netgear (as all have 10g Intel nics) and the 2 Unifi AP's connected to the Unifi US-16-150w switch (as this has PoE). However, I would like the FreeNAS server to be available to wireless clients that will be connected to the Unifi AP's (mobile phones/tablets/laptops/Apple TV). I was planning on having pfSense do all the DHCP duties.

    Is the above setup correct or should I be connecting these differently? I am new to networking and still learning :)

    Many thanks!



  • This should work. Guessing you'll just have one LAN for all devices, not doing VLANs?



  • Thanks for the response. I wasn’t going to have any VLANs as I want all devices to be able to communicate with each other over the network.

    With connecting the Netgear and Ubiquiti, should I use the last port of the Netgear and the last port of the Ubiquiti?



  • @Sir_SSV said in New to pfSense:

    I wasn’t going to have any VLANs as I want all devices to be able to communicate with each other over the network.

    With VLANs, everything can communicate with everything else, providing routing is set up appropriately. VLANs are just a way to provided logical isolation over a physical network.



  • So with VLANs, I would connect the Netgear to eth2 & the Ubiquiti to eth3 then set up VLANs within pfSense and also on the switches?



  • @Sir_SSV Maybe VLANs is too much for you at this point. You could do what you say, but you could also plug the Ubiquiti into the Netgear switch.

    Have you looked over the documentation?


  • LAYER 8 Global Moderator

    Some pretty nice gear you have there! Have fun!!

    Kind of with bartkowski here, playing with vlans might be a be premature if your new to networking... Get it all working on the same network... Then you can always start playing with vlans after.

    The first step might be to create a vlan on your AP so that say guest wifi users are isolated from the rest of your network. Both of your switches will support vlans, as well as your AP so you good to go when your ready to start playing with vlans.



  • @bartkowski I haven’t read that doc however I will go through it now. Thanks for the link 😄

    @johnpoz Thanks! It is decent gear and I’m hoping to utilise all the features.

    I do appreciate the help. The reason I was against VLANs is due to the fact I have never needed to create them however I have watched several videos on VLAN creation within pfSense so hopefully this gives me a good idea how this is done.

    Regarding connecting my switches to the pfSense, is it better practice to daisy chain the switches from eth2 (pfSense -> Netgear -> Ubiquiti) or should I create VLANs on pfSense and connect the Netgear to eth2 and Ubiquiti to eth3 (individually connected not daisy chained)? If I did the latter, would devices on eth2 VLAN (Netgear) be able to communicate to devices on eth3 VLAN (Ubiquiti)?

    If only Ubiquiti produced a 10g RJ-45 switch only with PoE! 😏


  • LAYER 8 Global Moderator

    Well you have enough interfaces on your pfsense so you could connect your switches to different interfaces on different networks.. All comes down to what your wanting to do and what paths your major traffic flows will take.

    With 10g switch connected to pfsense at 10g? I would think you would connect your 10g switch to pfsense with 10g?



  • @johnpoz What I am wanting is for all devices to be able to talk with each other. The FreeNAS server will be connected to the 10g switch however mobile devices on the Ubiquiti need to be able to read files from the server. From the reading I have done on VLANs as long as the rules are set correctly within pfSense (and the individual switch) then they should be able to communicate with each other.

    My understanding is the pfSense box is only 1g not 10g?


  • LAYER 8 Global Moderator

    The 7100 has 2 sfp+ ports that can do 10g you just need the sftp+ modules for it. They are $49

    And then your switch has sfp+ as well - so need one there and the fiber to connect them.



  • @johnpoz Of course! I totally forgot about the sfp+ ports as I am using ethernet.

    Would you happen to have a link to the modules I would require? I had a look online and it seems there are different types of modules that suit different switches.



  • Would these be the sfp+ modules that I need for both the pfSense and NetGear?

    pfSense:
    https://store.netgate.com/SFP-10GBase-SR-Transceiver-P2575.aspx

    Netgear: https://www.netgear.com.au/business/products/switches/modules-accessories/axm761.aspx

    They’re 50/125um (sr) which I’m guessing they both need to be identical



  • So, I ended up acquiring from a friend a UniFi XG-16 switch and have used this instead of the Netgear.

    I have re-configured the Netgate to use ix0 as LAN and have this connected via sfp+

    pfSense --> UniFi XG-16 --> UniFi 16-150w (PoE)

    Connected to the XG-16 is a desktop computer and the PoE switch has both AP's and the Cloud Key (Gen. 2). IoT devices are connected through the AP's on a separate VLAN (configured in pfSense).

    The issue I am having is the wireless AP's show as connected for the first minute or 2 then appear as disconnected however IoT devices can still connect to the network.

    Is there a firewall rule I need to add that allows the Cloud Key to see the AP's and communicate with them? I think I read somewhere that the CK requires port 8080 however I could be wrong. I disconnected the pfSense box and used my old router and there are no issues with the CK connecting and monitoring the AP's (and switches). Any help would be much appreciated!



  • I have been at pfSense, the UniFi switches and VLANS for the past week and everything I have watched on YouTube or read doesn’t seem to work.

    I have tried pinging devices on different VLANS with zero success. I’m guessing I am doing something majorly wrong but I can’t figure it out.

    I have set up 3 VLANS within pfSense 20, 40 & 50. These are:

    VLAN 20: 10.10.20.0/24
    VLAN 40: 10.10.40.0/24
    VLAN 50: 10.10.50.0/24

    On the UniFi switches, I have both connected via SFP+ passing all VLAN traffic. My wireless network (IoT - VLAN50) is working so I know the VLANs are passing through the UniFi switches correctly. I have tagged the appropriate ports on the UniFi switches for the computers on VLAN’s 20 & 40.

    Is there something else I can try? My pfSense box is the xg-7100 and I have assigned the ix0 interface (10gbe) as the LAN if that helps. My configuration is:

    pfSense -> UniFi 16xg -> 16-150w

    I have VLAN20 on the UniFi 16xg and VLAN50 on 16-150w


  • LAYER 8 Global Moderator

    And what rules did you put on your vlan interfaces with pfsense?

    If your unifi controller is on vlan A, and AP is vlan B - then you would have to use layer3 adoption..



  • The UniFi swiitches, AP's & Cloud Key are on the LAN address and have been statically assigned:

    16XG - 10.10.10.101
    16-150 - 10.10.10.102
    AP (1) - 10.10.10.103
    AP (2) - 10.10.10.104
    Cloud Key - 10.10.10.105

    The AP's are connected to the 16-150w and are on VLAN50. All mobile devices connecting to this VLAN (10.10.50.2 etc) operate correctly and the Cloud Key can communicate with the switches and AP's to get updates.

    16XG has 2 ports tagged for VLAN20 and the 16-150w has 2 ports tagged for VLAN40.

    What I am trying to do is ping a computer from VLAN20 on the 16xg switch to VLAN40 on the 16-150w switch however the request times out.

    2.jpg 1.jpg

    I have only set these firewall rules for now as I want to establish the connection between the computers on different VLAN's then I will add more firewall rules. Is there something else I need to do? I have seen several tutorials on YouTube where they are doing what I require however they are able to ping the other computers.


  • LAYER 8 Global Moderator

    Well your rules would for sure allow ping ;) Between those vlans..

    Could be firewall on the actual host your pinging?

    Can device in PC vlan ping the IP of pfsense on PI vlan? Can device in PI vlan ping the IP address of pfsense on PC vlan?

    I would do a simple sniff on pfsense to see what is going on.. So for example if you know you can ping pfsense PI IP from PC.. Then sniff on PI Interface on pfsense while you while you ping an IP in pi vlan from pc vlan... Do you see pfsense send the ping on to the IP in the pi vlan - where is the answer?

    If your devices can not ping the other vlans Pfsense IP - then you have something else wrong.. Like not using pfsense as their gateway..

    example here I can ping the IP of pfsense dmz IP (192.168.3.253) from my pc in lan (192.168.9/24)

    $ ping 192.168.3.253
    
    Pinging 192.168.3.253 with 32 bytes of data:
    Reply from 192.168.3.253: bytes=32 time<1ms TTL=64
    Reply from 192.168.3.253: bytes=32 time<1ms TTL=64
    

    So that tells me hey I can get to pfsense interface for my dmz vlan... So If I could not ping say the 192.168.3.32 device on the dmz.. I would sniff on the pfsense dmz interface.. Do I see that ping being sent?

    request-reply.png

    Do you only see the yellow, and not the green?



  • I can't believe it, on my PC tagged to VLAN20 I have Eset Antivirus... disabled it and I am able to ping both the LAN gateway and VLAN50 gateway!

    It always seems to be the easiest solution usually works :)

    I am having trouble pinging my Raspberry Pi however that could be because it is running Private Internet Access through OpenVPN and changing the gateway.

    If I decide to run OpenVPN through pfSense, if there is a disconnection from the PIA server will it automatically reconnect to PIA or does it fall back to the WAN IP?


  • LAYER 8 Global Moderator

    @Sir_SSV said in New to pfSense:

    it is running Private Internet Access through OpenVPN and changing the gateway.

    Yeah that could be a problem..

    As to reconnecting to a vpn service on pfsense - yeah if you set it to reconnect it should.. All comes down to why there was a disconnect, etc. etc



  • Ok, thanks. I’ll have to do some research to see how to set up OpenVPN on pfSense.

    To prevent a device on Vlan50 (IoT) seeing a device on either Vlan20 or Vlan40, should I do an Alias to block these or should I set a firewall rule on VLAN50 to block any protocol source: any destination: LAN net?


  • LAYER 8 Global Moderator

    Rules are evaluated on the interface the traffic enters on, from the network its connected too.. So if you don't want devices on vlan X to talk to vlan Y, then on vlan X you would put a rule that blocks access to vlan Y.

    Above rules that would allow, say your dest any rule that allows access to the internet..

    Rules are evaluated top down, first rule to trigger wins - no other rules are evaluated.



  • Ok, so finally I have everything up and running! It took a while however everything is working perfectly right down to OpenVPN and the RPi's (including a "Killswitch" in case the VPN network goes down it does not default to the WAN address) :)

    However, I have one more question: on Vlan30 resides my FreeNAS server. This is only accessible by the computers on Vlan 20. FreeNAS sends email/status updates/critical alerts via Gmail (TLS over port 587). I do not want the FreeNAS server to be connected to the internet but would like it to be able to send these updates via Gmail. I have tried several rules however none seem to be working (it mentions could not resolve Hostname).

    Is this possible to do? I was attempting to open the address/port for Gmail however this did not work.

    Edit: After having a think about what Firewall rules I was using, I worked it out. Due to not having an internet connection on Vlan30, I made rules for connection to DNS servers then rule for Gmail's IP range (74.125.0.0/16)



  • @Sir_SSV

    I’ve followed the SG-3100 manual to the letter and configured the port 4 as VLAN port. Every thing seems okay except there’s no internet from that port. I don’t know what to do know.


  • LAYER 8 Global Moderator

    And what rules did you put on that initerface? Did you dick with the automatic outbound nat? Network network did you put on that interface.. Are you clients able to ping pfsense IP on that interface?



  • @johnpoz

    Hi John,

    I put IPv4 and IPv6, allow anything to anything. Haven’t touched NAT outbound rules at all (still default to automatic). I connect FMC transmitter/receiver pair to that interface (LAN port 4 or OPT2). At the other far end is a gigabit switch. An access point plugs into the switch. A music server plugs into the switch as well. I have not yet tried pinging from music server to the pfSense IP.

    WAN connects to a Comcast Xfinity modem/router which offers wired and wireless internet.



  • @johnpoz

    I’ve just pinged pfSense IP 192.168.1.1 on the interface. No problem. Actually, ping works on all 4 ports including the configured one and 3 other “raw” ports.


  • LAYER 8 Global Moderator

    What exact IP did you put on pfsense interface in this new vlan? Sure the mask is not /32? Is dhcp working on this vlan? You didn't mess with outbound nat say per some idiot vpn guide? And its set to automatic for your wan?



  • @johnpoz

    It’s 192.168.100.1

    Before getting on the road, I fiddled with system/advance/system tunables, 2 bridge/filter related parameters and it seemed to work. Laptop connected to that interface shows internet. Will dig more after work.


  • LAYER 8 Global Moderator

    You wouldn't be doing anything with bridging!!! You made no mention of bridging in your OP.. You sure wouldn't be bridging your vlan 192.168.100 to your lan 192.168.1

    Set your port to untagged in the vlan you want, set the port 5 (the uplink to the soc) to tagged for your vlan... It really is that simple.

    Here I have the switch ports with different vlan on port, with 1 being the default lan
    switchportsvlans.png



  • @johnpoz

    No John, I didn’t mention bridging because I had not touched it before posting the last message.

    Thanks for the attached screenshot. I’ll get to learn from it after work.


  • LAYER 8 Global Moderator

    @Thuan said in New to pfSense:

    I had not touched it before posting the last message.

    And why would you think you should? Make no sense!! clicking random shit is not how you correct a problem!



  • @johnpoz

    You’re right John, it isn’t working. I’m resetting the SG-3100 and starting over again.



  • @johnpoz

    John, let’s assume that I know nothing about setting pfSense router, and my goal is simple: configure an internet port out of 4 available ports on the 3100. My existing source is Comcast Xfinity modem.

    Starting from a factory default 3100 unit, what steps should I take to fulfill my simple requirement: having an internet capable port in which I can plug in a switch and go from there?



  • @Thuan said in New to pfSense:

    @johnpoz

    John, let’s assume that I know nothing about setting pfSense router, and my goal is simple: configure an internet port out of 4 available ports on the 3100. My existing source is Comcast Xfinity modem.

    Starting from a factory default 3100 unit, what steps should I take to fulfill my simple requirement: having an internet capable port in which I can plug in a switch and go from there?

    It's pretty easy, if you have in fact reset the 3100 to factory defaults.

    The SG-3100 has a WAN and 4 LAN switch ports (see image link).
    https://www.netgate.com/assets/img/products/sg-3100-back.png

    Use the wizard to do all of this. If you setup your WAN port properly (Static IP address or DHCP address from your Comcast modem), that should be good for that one. Then set your LAN switch ports up, using the default 192.168.1.0/24 address range. You can then plug in anything to the LAN ports, even a switch, like you're asking about. Leave the OPT1 port alone for now.

    SG-3100 getting-started and setup instructions are here:
    https://docs.netgate.com/pfsense/en/latest/solutions/sg-3100/getting-started.html

    Is there anything more complicated with your Comcast connection - VLAN stuff, PPPoE login stuff, TV/Phone/Security thingies, anything...? I don't think Comcast operates their modems with those kinds of settings, but I could be wrong.

    Jeff



  • @akuma1x

    Thanks Jeff for your help, but I have no luck. Not yet. No matter what or how I tried, I can’t see the internet from any port on the SG-3100. I just have no luck with pfSense.


  • LAYER 8 Global Moderator

    And without you posting anything - its impossible to tell you what you are doing wrong...

    So your lan has internet? And now you want to do what exactly with the switch ports



  • @johnpoz

    Hi John,

    After configured as instructed in the SG-3100 manual, I have no internet from the only VLAN. The grey areas are firewall and DHCP server setup.


  • LAYER 8 Global Moderator

    And again without you actually posting what you did there is no way for us to tell what your doing wrong.. Users say they did X all the time and come to find out they actually did Y..

    You saying it doesn't work is not going to get anyone anywhere.



  • @johnpoz

    I followed the instructions printed on the SG-3100 PDF manual, pages 7 of 48 thru 12 of 48. At the end, I was told to create firewall rules, so I did. Basically, I created rules that pass ANY from ANY source to ANY destination. Then I was told to enable DHCP, and I did.

    In general, I tried to follow exactly what the instructions said, and verified results after each step. Only thing missing is the internet from the newly configured port. That’s why I asked what steps YOU DID to get your results. Experts say doing this or that is easy but they skip the details.


Log in to reply