What's the best network setup for a group of devices?
-
Hello,
I'm setting up internet access only for select devices on the LAN.
I'm wondering what is the best way to do this?
A VLAN, rules allowing MAC addresses, a group or something else?My network is a modem > cable > hypervisor > VM router > cable > switch > cable > devices and APs.
Only certain devices will be allowed internet access.
I prefer all devices having LAN access to the network, router and hypervisor.I hope I'm in the right pfSense channel: L2/SWITCHING/VLANS, as I thought this could be a vlan setup?
-
Ok, I created a Firewall Rule to Block all traffic from the WAN to any destination.
I then tried to add a Pass to a LAN address, however pfSense doesn't allow me to enter the LAN IP address?
-
The rule to block all traffic from WAN2 failed, as I was able to ping the vm router and the hypervisor to 1.1.1.1.
-
@eiger3970 said in What's the best network setup for a group of devices?:
I created a Firewall Rule to Block all traffic from the WAN to any destination.
Huh? Wan is block all out of the box.. Zero reason to add any rules on wan other than port forwards or remote access to the wan access (rare)..
as I was able to ping the vm router and the hypervisor to 1.1.1.1.
From whare? Sure and the hope your not using 1.1.1.1 and your IP.. Is this public, why would you obfuscate rfc1918 address?
And sure you could create vlans on your network if you so desired - but your current setup has none..
-
Thanks.
I deleted the WAN block. I'm confused and thought I could block all outgoing internet traffic.I setup a LAN rule to block all traffic. This hasn't stopped the hypervisor and vm router pinging 1.1.1.1. They will be allowed to use internet, but I'm just testing if all devices are blocked.
1.1.1.1 is just the cloudflare dns I test ping on. That or google.com. 1.1.1.1 is not my IP.
Just need to allow 4 devices to use the internet.
1 of the devices will be a WLAN AP, which can send internet to 1 of the permitted devices.I can't deny specific devices, as I don't know all machine's details that may or may not join the network.
-
Oops, fixed the LAN rule to block any traffic, not just TCP traffic. Those pesky little ICMP packets were transmitting through the ping.
No, it seems I might be able to add the 4 devices I prefer to have internet.
-
If you want help with rules - the best thing is to post a picture of them..
1 of the devices will be a WLAN AP, which can send internet to 1 of the permitted devices.
AP do not NAT.. Do you mean a downstream wifi router that is natting?
I can't deny specific devices, as I don't know all machine's details that may or may not join the network.
Well then the best thing to do is use vlans, where devices on vlan X can use the internet, and devices on vlan Y can not sort of setup.
-
Here's what I have so far.
Not much to screenshot for allowing 3-4 devices, as I'm not sure yet what rules to create.
I have 4 LAN devices that need internet, everything else needs no internet, just LAN connections.
Device1: Hypervisor.
Device2: VM router (pfSense).
Device3: Intercom via WLAN.
Device4: Solar meter reader via WLAN.I'm unsure yet how the APs (Access Points, not routers) will work. The UniFi AP AC Lite can manage device access, but perhaps this management can be handled by pfSense?
-
Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated. So your allow rules below the block rule never get evaluated.. Because your block rule blocks all lan devices.
-
Thanks.
-
@eiger3970 said in What's the best network setup for a group of devices?:
A VLAN, rules allowing MAC addresses, a group or something else?
PfSense doesn't filter on MAC addresses, so you can only use IP addresses.
-
Ok, that sounds great!
I only asked as the WLAN intercom may or may not have a configurable dynamic to static IP address.
-
As per rules in post 10, I've tested and the hypervisor and vm router can still traffic with the internet.
I'm not confident my rules are correct to stop all traffic.
I thought I would have to add the 4 devices' IP addresses?
-
@eiger3970 said in What's the best network setup for a group of devices?:
I'm not confident my rules are correct to stop all traffic.
The rules you posted are not blocking anything. You have a Any rule for anything in LAN.. That last block rule doesn't do anything other than NOT Log your blocks.. Say something like broadcast.
-
Ok, I think I understand now.
I'll create 4 LAN IP allow rules, then a last block all LAN.
After that, I'll test how the WLAN works, as the LAN to devices 3 and 4 are via 1 or 2 WLAN APs.
-
Oh, same issue as before.
When I create a new Firewall Rule to pass, I set the Destination to LAN address, however the Destination Address is greyed out and I cannot enter the preferred LAN IP address?
-
@eiger3970 said in What's the best network setup for a group of devices?:
then a last block all LAN.
Dude why do you think you need this? By default if not allowed - its blocked..
Again rules are evaluated top down, first rule to trigger wins, NO OTHER rules are evaluated. Post up these rules..
-
I can't post the rules, as I can't add them?
The LAN IPs to allow internet are:
Device1: Hypervisor: 192.168.1.140.
Device2: VM router (pfSense): 192.168.1.170.
Device3: Intercom via WLAN: IP unknown, only MAC address known.
Device4: Solar meter reader via WLAN: unknown, only MAC address known.
Device5: my Linux Mint computer needs access to the network to configure devices, however no internet needed. If needed, I hotspot to my phone.
-
What do you mean you can't add them.. .Sure you can.. Post up the screen where you trying to add them, and what errors or whatever that is keeping you from posting them..
Here.. example
