Newbie to pfSense, question about network configuration
-
Hi everyone and sorry for my English.
I want to discuss about my 10Gbe home network plan, the configuration is shown in the graph.
My plan is to use a virtual pfSense as a 10Gbe gateway. The necessary function I want to have is to restrict the Wi-Fi router so that the router cannot communicate with other device like PC or NAS. Also I need to restrict the NAS so that the NAS cannot connect to Internet.
However, since the 10Gbe Switches are unmanagement switch, I am not sure I can control the access by pfSense. Any comments are always welcome. Thank you very much.
-
Your issue will be the unmanaged switches, the wifi will be on the same subnet as the PC & NAS so the traffic wouldn't even hit the firewall.
Do you have another 1Gb interface on the Proxmox server that you could move the wifi ?
The NAS to the internet blocking you could do with a firewall rule.
-
Also not sure why you're using a 10Gb port on the Proxmox interface when there will only ever be a maximum of 1Gb out to the internet.
If you were running vlans on the pfSense LAN interface that would be a different matter.
-
I don't think your main objective will work with the diagram above. As you mentioned, the unmanaged switches will allow all devices connected to it to communicate. I'm not sure if the wifi router would even work as you show it connected to the WAN port. Perhaps if it's configured as an access point, it might work. Maybe enabling a guest wifi network should prevent it from talking to other devices on the LAN. You could also add a third interface to pfsense (OPT1) to separate the wifi router. Then connect the wifi router LAN port to the OPT1 port. That will allow setting rules in pfsense to prevent the wifi router on the OPT1 interface and the LAN interface from talking to each other.
Yes, rules can be created on the pfsense LAN interface to prevent the NAS from accessing the web.
-
Finally, supplementing the colleagues in front of me.
Pls. forget this TP-Link switch, because a big pile of garbage!
Not so long ago, we threw out 4 of it.I know you chose it because of the cheap 10Gig, but this tool is useless.
Not to mention that SFP compatibility is almost zero, it is almost willing to work with TP-Link SFP(+) modules only.
Affordable 10Gig capable serious switches:
https://mikrotik.com/product/crs317_1g_16s_rm
https://mikrotik.com/product/crs309_1g_8s_in+++++edit:
BTW: and makes no sense!
how? (10Gig SFP+ LAN module(?) to USB 5Gig on fiber???)
you cannot mix the bit rates
-
@NogBadTheBad Thank for your reply, as I have read some posts regarding there are problem using 1G SFP module in this switch so I use 10G SFP+ module to instead. The Proxmox server is on J3455 board but I can change to another router board.
@Raffi_ Thank for your reply, can I understand that the pfSense will act as DHCP server, so both the two switches are on the same subnet, but there is no firewall in the LAN side, so the switches can talk each other, thus the router can talk to NAS / PC.
Besides, the "1Gbe RJ45 (WAN)" is meaning for the WAN port of router. The WAN is the modem "1Gbe RJ45".
@DaddyGo Thank for your reply. As I found that the mikrotik CRS305 works worst as a router (the data in their website), I know that the CRS305 can switch to SwOS, but I am not sure if SwOS fulfill my requirement so I choose the TL-ST1008F as the first choice.
With NogBadTheBad, Raffi_ and DaddyGo comments, I updated two plans as follow. In version 0.2, the router and NAS will direct connect to pfSense. However, the bandwidth of the Proxmox Server PCIe 3.0 x1 is not enough to handle the 10Gbe network, is it possible to limit the network speed to 4Gbps each link? Or use the version 0.3?
-
@testcb00 said in Newbie to pfSense, question about network configuration:
Thank for your reply. As I found that the mikrotik CRS305 works worst as a router (the data in their website), I know that the CRS305 can switch to SwOS, but I am not sure if SwOS fulfill my requirement so I choose the TL-ST1008F as the first choice.
since I was only talking about the hardware part...
I would continue with that (otherwise the idea... develops)
-SwOS is fine for your requirements
@Johnpoz can tell you a lot about the 10Gig NAS connection (SMB3, and such), is it worth it at all, in a SOHO environment ?!it's for the sake of curiosity:
I'm showing a GUIs, from SwOS and this is exactly a CRS305
(true, here I am now using it as a media converter for 1Gig WDM to CWDM)
Note:
this unit operates continuously and reliably!!!
caution: is sensitive to DAC cables, but the 305 "eat" everything from the SFP and (+) module
(UBNT DAC cable absolutely does not work)
-Select DDM / DOM capable units from the SFP(+) modules -
@testcb00 said in Newbie to pfSense, question about network configuration:
However, since the 10Gbe Switches are unmanagement switch
Unless you wanting this for just pure raw bandwidth between your devices... I would never suggest a dumb switch.. Other than for more ports on downstream switch from your smart switch.
I would love to pull the trigger on 10ge in the home as well - but budget wise for "me" I just can not justify it as of yet.. Even though yeah it would be nice.. Unless your PC and NAS can exceed what you could do with just smb3 multichannel and a few 1ge ports.. Its way cheaper to just use that vs 10ge.. Some stuff is starting to support 2.5 and 5 which prob better bang for your buck.. I got my pc and nas moving files via 2.5 connection for 80$ out of pocket.. Which ended up being about a 50MBps increase over what it was doing with 2x1ge smb3 multichannel connections.. Jumped from about 220MBps to 270MBps.. I don't think my current nas even if had 10ge could do more than that with current disks..
-
@testcb00 I think 0.2b looks better. The only thing is that you don't need the WAN port on the wifi router. The WAN port is only need if you are doing firewalling/routing with that device. You are doing neither with the wifi in your setup. Change that word on the wifi router from 1Gbe RJ45 (WAN) to 1Gbe RJ45 (LAN). You plug the Wifi router LAN port into pfsense OPT1. The wifi router will then be an access point to your network. Rules can be created as needed to prevent wifi devices from accessing the LAN on pfsense.
-
@Raffi_ said in Newbie to pfSense, question about network configuration:
@testcb00 I think 0.2b looks better. The only thing is that you don't need the WAN port on the wifi router. The WAN port is only need if you are doing firewalling/routing with that device. You are doing neither with the wifi in your setup. Change that word on the wifi router from 1Gbe RJ45 (WAN) to 1Gbe RJ45 (LAN). You plug the Wifi router LAN port into pfsense OPT1. The wifi router will then be an access point to your network. Rules can be created as need to prevent wifi devices from accessing the LAN on pfsense.
^^ This and switch off DHCP on the WiFi router.
