Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Using Managed Switch for Company and Private Networks

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    lag
    51 Posts 4 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bookie56 @johnpoz
      last edited by

      @johnpoz so how do I set up the switch with both of these networks?

      bookie56

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @bookie56
        last edited by johnpoz

        @bookie56 your port 1 would be connected to lan_private interface on pfsense with whatever vlan you want that network to be on your switch.. this would be untagged and pvid would be whatever vlan your using on your switch.

        You connect port 17 on your switch to the pfsense interface that is lan company.. This port would be on some other vlan you create on the switch, this port would also be untagged and with a pvid of whatever vlan you created on your switch for this network.

        So as example

        Here is 3 different networks on pfsense, igb0, 3 and 5

        pfsenseports.jpg

        On my switch I have 3 different vlans created 9, 3 and 7 for these networks. I just used the 3rd octet number so its easy to remember.. my lan network is 192.168.9/24 my dmz is 192.168.3/24 and my roku is 192.168.7/24

        Might make it easier for you to see if show this on the switch gui vs cli

        These are the 3 ports on the switch those pfsense interfaces are connected too

        switchports.jpg

        Now those ports on the switch are configured like this

        switchportsvlans.jpg

        see pvid that is set, which is also shown on the vlan membership page as the P, the UP means Untagged and PVID vlan ID. All a pvid is what vlan on the switch the switch will put traffic that it sees coming in on that port untagged. Before you were isolating your networks with physical different switches. But when you want to keep these networks isolated on a vlan swtich, you have to tell the switch what vlans are what ports, etc even if the traffic is not tagged.

        Even if the networks on pfsense are not actually vlans on pfsense, ie no TAG.. You still have to isolate that traffic on the switch by creating vlans..

        Here are the vlans I have created on the switch

        switchvlansIDs.jpg

        In my case my default vlan is set to 9 on the switch vs 1, the default vlan on most switches is 1 and many do not even allow you to change that.. I just changed mine so the ID would match up with the network I use on my lan of 192.168.9.0/24

        You could prob do this on your switch with port vlans.. But using 802.1q is better option. Because now it will allow you in the future maybe to create a vlan on pfsense and carry this over the same physical port.. See for example those ports that are trunked and have multiple vlans listed on them.. Like port 7 on my switch that has 2,3,4,6,7,9,110 and 1011 all Tagged, see the T next to the number other than vlan 9 which is untagged.. you can only ever have 1 untagged vlan on a port.

        That port 7 on my switch is an uplink to another switch that sits in my AV cabinet in my living room.. And I can put a port on that switch in any of those vlans.. For example one of my APs connects to that switch in the AV cab, and depending on what SSID you connect to puts you on that network/vlan.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • G
          Gblenn @bookie56
          last edited by Gblenn

          @bookie56 said in Using Managed Switch for Company and Private Networks:

          @Gblenn Sorry I am lost...
          I was hoping to have the link for the LAN_PRIVATE which goes to Port 1 on the switch
          I then was hoping to have the link for the LAN_COMPANY go to Port 17 on the switch...
          If the above can't be done then I will have a separate switch for LAN_COMPANY and leave everything else on the new switch...

          This is why I have the quad using all 4....
          bookie56

          Ah of course that's perfectly possible, exactly like @johnpoz describes it. You will essentially split your 24 port switch into two logical partitions, replacing your current dumb switches. And for that to work like you want, you don't need to do anything on the pfsense side at all.

          So going back to my example with the picture of the TPLink interface, you will do this (using my 16 port switch as an example)

          First for PRIVATE (using VLAN tag 5 here)

          abcf95bb-8a62-4226-b125-6c725947af67-image.png

          Then Update and Apply and then similarly for COMPANY (using VLAN tag 10)

          a04c595b-611b-477e-80c2-6b3a5c2c0efb-image.png

          Then on the 802.1 VLAN PVID page you make ports 1-16 members of VLAN 5
          And then ports 17 to 24 members of VLAN 10..

          Like this:
          6b7d6c5f-77cb-4a19-b717-38a89a802360-image.png

          johnpozJ 1 Reply Last reply Reply Quote 1
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @Gblenn
            last edited by johnpoz

            @Gblenn yup that works - only thing with those entry level vlan capable switches. He prob wants to use just the default vlan 1 as one of his network. Because this is the vlan the management of the switch will be on..

            So for his say lan private, just use vlan 1, then create a new vlan be it 5 or 10 or whatever other ID he wants to use for his lan company..

            But I like the idea of just splitting the switch into 2 vlans.. Ie 2 switches in 1 box, which is what vlans are - the ability really to create multiple switches (virtual lans) in one box..

            And its also a good idea to keep all the ports in 1 vlan together.. So ports 1-8 are vlan 1, and ports 9-16 are the other vlan.. So ports 1-8 are his lan private "switch" and ports 9-16 are his lan company switch.. then port 1 connected to pfsense lan private interface, and say port 9 connected to his lan company interface on pfsense... Easy peasy, lemon squeezy ;)

            edit - personally I would connect his AP to the switch as well.. This allows him then to put wired devices on either his wifi private or company network.. He could still leave his pfsense as is without having to create vlans on it.. And just 2 more uplinks from the switch for wifi private and company.

            And if he ever wants more network than his 4 ports, then he can start tagging those vlans and use one of the physical uplinks from switch to pfsense to carry that vlan. I would hope his APs allow for vlans - this way he could place his AP in different parts of the house and client can connect to which ever one is closer and provides the best signal - doesn't matter if client is wifi private or company, etc.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            G 2 Replies Last reply Reply Quote 0
            • G
              Gblenn @johnpoz
              last edited by Gblenn

              @johnpoz Yes I just realized that and was meaning to edit my post accordingly, but you beat me to it... 😁

              So what johnpoz is saying is to keep the switch at default VLAN settings for all ports except 17-24. Only those ports do you make the changes I showed in the pictures...

              You also need to do one more thing, which is to remove the VLAN 1 membership from those ports. So type 1 in the VLAN ID field and click Not Member for ports 17-24.

              Similar to this (using 5-8 as an example for your COMPANY ports)

              3d1e6711-3bae-49c8-9ef5-7a3e8fd21b3c-image.png

              johnpozJ 1 Reply Last reply Reply Quote 1
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @Gblenn
                last edited by

                @Gblenn great reminder about removing vlan 1 from the ports you put into different vlan.. You would hope the switch would be "smart" enough to not allow you to have more than 1 untagged vlan on the same port.. But those tplinks don't have a great track record for understanding vlans to be honest ;)

                There was a whole issue quite some time ago, where they wouldn't even let you remove vlan 1 if you put the port into a different vlan.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                G 1 Reply Last reply Reply Quote 0
                • G
                  Gblenn @johnpoz
                  last edited by

                  @johnpoz said in Using Managed Switch for Company and Private Networks:

                  @Gblenn yup that works - only thing with those entry level vlan capable switches. He prob wants to use just the default vlan 1 as one of his network. Because this is the vlan the management of the switch will be on..

                  edit - personally I would connect his AP to the switch as well.. This allows him then to put wired devices on either his wifi private or company network.. He could still leave his pfsense as is without having to create vlans on it.. And just 2 more uplinks from the switch for wifi private and company.

                  Agree but I guess he wants to keep the setup on pfsense untouched, with any rules etc that have already been created for the 4 subnets.
                  Perhaps move the COMPANY AP to the switch ports 17-24, and drop the WIFI_COMPANY interface on pfsense. There are no static leases on either of the COMPANY networks so why make it more complicated than needed.

                  And if he ever wants more network than his 4 ports, then he can start tagging those vlans and use one of the physical uplinks from switch to pfsense to carry that vlan. I would hope his APs allow for vlans - this way he could place his AP in different parts of the house and client can connect to which ever one is closer and provides the best signal - doesn't matter if client is wifi private or company, etc.

                  Exactly, and those AP's do actually allow for VLANs and are compatible with Omada centralized management.

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @Gblenn
                    last edited by

                    @Gblenn said in Using Managed Switch for Company and Private Networks:

                    setup on pfsense untouched, with any rules etc that have already been created for the 4 subnets.

                    He really wouldn't have to change anything on the pfsense side, he would just move the AP from the port on pfsense to port on the switch.. This would really give him more flexibility going forward.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    G 1 Reply Last reply Reply Quote 0
                    • G
                      Gblenn @johnpoz
                      last edited by Gblenn

                      @johnpoz said in Using Managed Switch for Company and Private Networks:

                      @Gblenn great reminder about removing vlan 1 from the ports you put into different vlan.. You would hope the switch would be "smart" enough to not allow you to have more than 1 untagged vlan on the same port.. But those tplinks don't have a great track record for understanding vlans to be honest ;)

                      There was a whole issue quite some time ago, where they wouldn't even let you remove vlan 1 if you put the port into a different vlan.

                      Yes the switch I am using to exemplify is an old one and have had some wierd issues wrt VLAN and picking up, or flipping between two differen IP's for the UI. So sometimes I had to access it via a VLAN and other times I could reach it via the static lease I had given it in pfsense.

                      I am playing around with another firewall which has it's LAN port connected to a VLAN only existing in my switches. Similar to what this config does with ports 17-24. But apparently it couldn't decide which DHCP server to listen to... I have fixed it now but it was a bit frustrating before I figured out what was going on.

                      The newer Omada switches I'm using for my network are way better and have not had any problems at all.

                      1 Reply Last reply Reply Quote 1
                      • G
                        Gblenn @johnpoz
                        last edited by

                        @johnpoz said in Using Managed Switch for Company and Private Networks:

                        @Gblenn said in Using Managed Switch for Company and Private Networks:

                        setup on pfsense untouched, with any rules etc that have already been created for the 4 subnets.

                        He really wouldn't have to change anything on the pfsense side, he would just move the AP from the port on pfsense to port on the switch.. This would really give him more flexibility going forward.

                        Agree, like I said about the COMPANY AP, but I suppose there is some reason he wants his wifi separated...

                        B 1 Reply Last reply Reply Quote 1
                        • B
                          bookie56
                          last edited by

                          Wow you guys have been busy...
                          Ok I will try and keep to just English.......🙄
                          Too many years in Sweden....lol
                          Give me time to digest all of this !
                          I am so grateful for the support one gets on this forum!
                          In one word BRILLIANT!

                          bookie56

                          1 Reply Last reply Reply Quote 0
                          • B
                            bookie56 @Gblenn
                            last edited by

                            @Gblenn said in Using Managed Switch for Company and Private Networks:

                            @johnpoz said in Using Managed Switch for Company and Private Networks:

                            @Gblenn said in Using Managed Switch for Company and Private Networks:

                            setup on pfsense untouched, with any rules etc that have already been created for the 4 subnets.

                            He really wouldn't have to change anything on the pfsense side, he would just move the AP from the port on pfsense to port on the switch.. This would really give him more flexibility going forward.

                            Agree, like I said about the COMPANY AP, but I suppose there is some reason he wants his wifi separated...

                            No real reason apart from the fact I have a quad and could physically run cables to each AB and LAN networks

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @bookie56
                              last edited by

                              @bookie56 do you not have enough ports to just connect those 4 ports to your switch... Which then would give you more flexibility..

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              B 1 Reply Last reply Reply Quote 1
                              • B
                                bookie56 @johnpoz
                                last edited by

                                @johnpoz Can we leave at it is for now....😊
                                Here are the two settings now:
                                TP-Link-1.png TP-Link-2.png

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • B
                                  bookie56
                                  last edited by

                                  I have gone back to pfsense and added an IPv4 address and then in DHCP Server given it a range ...because I have no need for so many gone from 192.168.121.2 to 192.168.121.25 (example)
                                  The existing firewall rules I had help with.....
                                  What rules do I need to stop this network talking to LAN_PRIVATE and WIFI_PRIVATE?

                                  bookie56

                                  G 1 Reply Last reply Reply Quote 0
                                  • G
                                    Gblenn @bookie56
                                    last edited by Gblenn

                                    @bookie56 Under Firewall > Rules you have the LAN_COMPANY and WIFI_COMPANY tabs.

                                    Create new block rules above the allow all rule that look similar to this. In my case it's my GuestVLAN that I don't want accessing e.g. the IoT-network.

                                    b50d1b28-a0f5-4c55-942a-42fa0a88bcb1-image.png

                                    Select Block and the interface is your LAN_COMPANY, protocol any and source any.
                                    Then it's a matter of selecting the destination you want to block, in this case you would pick LAN_PRIVATE and click Save.

                                    6856ae03-d1d0-4065-90d2-43f910aad9d8-image.png

                                    Then you create one more looking exactly the same but select WIFI_PRIVATE as the destination you want to block. Make sure they end up above the allow rule.

                                    To test that it works you can try pinging anything on your PRIVATE netwórk from one of your COMPANY PC's.

                                    B 1 Reply Last reply Reply Quote 1
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator @bookie56
                                      last edited by

                                      @bookie56 said in Using Managed Switch for Company and Private Networks:

                                      Can we leave at it is for now

                                      sure.. whatever you feel comfortable with doing, its your network..

                                      So your lan private and lan company are working now.. depending on what port you plug them into on your switch? That switch config looks correct to me for just splitting the switch into 2 virtual switches.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 1
                                      • B
                                        bookie56 @Gblenn
                                        last edited by

                                        @Gblenn said in Using Managed Switch for Company and Private Networks:

                                        @bookie56 Under Firewall > Rules you have the LAN_COMPANY and WIFI_COMPANY tabs.

                                        Create new block rules above the allow all rule that look similar to this. In my case it's my GuestVLAN that I don't want accessing e.g. the IoT-network.

                                        b50d1b28-a0f5-4c55-942a-42fa0a88bcb1-image.png

                                        Select Block and the interface is your LAN_COMPANY, protocol any and source any.
                                        Then it's a matter of selecting the destination you want to block, in this case you would pick LAN_PRIVATE and click Save.

                                        6856ae03-d1d0-4065-90d2-43f910aad9d8-image.png

                                        Then you create one more looking exactly the same but select WIFI_PRIVATE as the destination you want to block. Make sure they end up above the allow rule.

                                        To test that it works you can try pinging anything on your PRIVATE netwórk from one of your COMPANY PC's.

                                        Sorry not understanding this....I have fire rules implemented from LAN_COMPANY and WIFI-COMPANYnot having contact with my private network....but don't I need a rule for the VLAN? Or does that automaticaly fall under the rules for LAN_COMPANY and WIFI_COMPANY

                                        bookie56

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator @bookie56
                                          last edited by johnpoz

                                          @bookie56 said in Using Managed Switch for Company and Private Networks:

                                          but don't I need a rule for the VLAN?

                                          what vlans - you didn't create any vlans on pfsense - did you? The vlans are only on your switch.. to keep those networks at layer 2 isolated from each other. At layer 3, pfsense would filter any traffic trying to be routed across pfsense.

                                          I thought you only had 4 networks on pfsense on your quad port nic, your lan private and company, and then wifi private and company that you plug your AP into.

                                          So 4 interfaces, for these 4 networks.. This is where you would create rules.. There are no rules you would put on your switch.. The very act of creating a vlan on the switch isolates those ports in vlan X from vlan Y ports at layer 2.

                                          But if you don not want lan private to talk to any of your 3 other networks, then you would need rule(s) to do that. You could do it in 1 rule if you wanted with alias that contains the networks you don't want to talk to.. When your creating rules that block access to your other networks its common to just create a alias that contains all of the rfc1918 space. 10.0.0.0/8, 192.168.0.0/16 and 172.16.0.0/12 this way you can use the alias in your block rule, and this network would not be able to talk to any other networks that you currently have or in the future might add.

                                          You just need rules above this block rule that allows what you want.. Here is an example of a locked down network that can not talk to any other network I have on pfsense, nor any of pfsense other IPs, like say its public IP..

                                          rules.jpg

                                          Rules are evaluated top down as traffic interfaces the pfsense interface from the network that interface is attached too, first rule to trigger wins and no other rules are evaluated

                                          These rules allow devices on my "test" network to ping pfsense IP on the test interface, use dns and ntp to this test interface IP. It then makes sure clients on the test can not talk to any other IPs of pfsense, say the want public IP - or devices on this network would be able to access the pfsense web gui for example on its wan IP which is public. The use of the alias helps if that IP might change in the future to some other public IP.

                                          They then block access to any other rfc1918 addresses - ie my other networks.. And then the last rule is what allows devices on this network to talk to any other IPs, ie the internet.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          B 1 Reply Last reply Reply Quote 1
                                          • B
                                            bookie56 @johnpoz
                                            last edited by

                                            @johnpoz so I don't need a vlan on pfsense?

                                            bookie56

                                            G johnpozJ 2 Replies Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.