Connecting 2 LAN interfaces to same Switch (segmenting vlans)

moji

Good day!

I'm new to vlans, definitely a noob but spending hours on forums trying to understand how to get this up and running.

I'm configuring my Pfsense with vlans to separate iot traffic and implement gust networks. My setup is as follows: Internet --> Pfsense --> Managed Switch --> AP.

By connecting the LAN port on my Pfsense to the Port 1 on my Switch, all vlans can access the internet (so just one interface on pfsense is being used).
I am curious as to whether segmenting the guest network traffic to travel to the Pfsense via a different interface- OPT1, would improve security in any way. For that, I'll have to trunk the Guest vlan on different ports on both the switch and the Pfsense (so the OPT1 port on Pfsense and let's say Port 2 on the switch). And then I'd connect those 2 new ports so that my guest network traffic shares no medium with other vlan traffic.

1- Is that improving anything?
2- In case it does, what is the scenario that is being defended? Is it the chance that a faulty switch software or something would allow someone with physical access to manipulate vlan tags and thus suddenly access a different vlan? Or what else could make this useful?
3- Doesn't that pose the risk of a loop since I have 2 ports on the Pfsense connecting to 2 ports on the same switch.

Tried to make this concise, thanks, hopefully someone out there has gone through this before.

Derelict

@moji I would just use VLANs. "VLAN hopping" used to be a thing in certain cases but if your switch isn't completely defective, just tag the VLANs to pfSense and be done. There is no choice but to do so for things with only one ethernet port like Wireless APs, etc.

johnpoz

@moji

using a different interface would/could improve bandwidth, vs sharing the bandwidth of the physical interface they have their own full physical interface bandwidth. Does this matter, would depend on your traffic flow requirements.

I do both, some networks have their own physical interface, some vlans share the physical - these are my wifi networks that would never do full gig anyway, and don't talk to each other either so no hairpinning of traffic

if you set up your networking correctly, wouldn't matter if someone change the tag on their traffic to try and jump vlans because the port they are connected to shouldn't allow tags.. Something jumping vlans would need to be plugged into a trunk that has multiple tags on it.. Say like an uplink to another switch, or port you plug in an AP that does multiple vlans.
no if your interfaces are on different vlans on the switch you wouldn't have a loop.

moji

@johnpoz

Thanks a million, That's exactly what I was looking for!