Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Different networks

    Scheduled Pinned Locked Moved General pfSense Questions
    6 Posts 4 Posters 556 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pedro1x
      last edited by

      I have my pfsense and using Unifi 3 APs for wifi.
      I would like to know what is the best way to create a second SSID for my wifi that I will give to my guest, but anyone on that guest SSID can't access my internal network and access only to Internet.
      Thank you.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Create a vlan for this other SSID, and then in unifi assign this vlan ID.. Then create whatever firewall rules you want on the vlan interface in pfsense to control access how you want.

        You have vlan capable switch I take it?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        P 1 Reply Last reply Reply Quote 0
        • Raffi_R
          Raffi_
          last edited by Raffi_

          On my Unifi AP AC Lite I was able to setup a second Guest ssid on my unifi without having to setup a seperate VLAN for it. I don't remember the exact settings page, but there was an option to give that WLAN a guest profile or something like that. I would think this can also be done with VLANs as @johnpoz said, then you would have more control over the exact rules in pfSense and you would need a smart switch. But if all you want is a simple wireless guest connection with web access and no access to the other wireless subnets, that feature should be available within the unifi settings. Check the documentation of the specific unifi you have or the unifi forums.

          edit, ok so if these unifi's are on the same segment as the LAN, then yes you will have to create a seperate VLAN for them. If they are on a different interface like OPT1, then that may not be needed since you can already create rules to segment OTP1 from LAN and such. Then using the built in Guest profile should be enough. It depends on your setup.

          P 1 Reply Last reply Reply Quote 0
          • P
            pedro1x @johnpoz
            last edited by

            @johnpoz Hi,
            I did already tag with a Vlan for my Unifi.
            Yes I have a vlan capable switch.
            Do I need to create a new interface in pfsense? Can you let me know exactly the steps to follow?
            On pfsense I went on Interfaces/Vlan, and I created a vlan, and I used my LAN port as the parent interface.
            On interface assignments, I added a new interface with Network Port the vlan I choose.

            Next step I guess will be to add 2 rules on firewall: 1 rule that gives that interface access to internet, and 1 rule that blocks all traffic to inside. Right?

            JKnottJ 1 Reply Last reply Reply Quote 0
            • P
              pedro1x @Raffi_
              last edited by

              @Raffi_ All Unifi APs are on same LAN interface.

              1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @pedro1x
                last edited by

                @pedro1x

                You will have to create a VLAN in pfSense for the guest network and create appropriate rules, etc.. You need a matching VLAN on the AP for the 2nd SSID. A managed switch will keep the VLAN off other parts of the network, but that's not essential. You do that by configuring the switch so that the VLAN only goes to the port that the AP is connected to.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.