wifi vlan guest network
-
@stephenw10 i think i made a mistake. i'm back to "dynamic ip" and my wifi took well an ip from 192.168.4.0/24
but i have no internet... i set a captive portal also, i will check tomorrow what's wrong
-
@ppe there you go, so your client got an IP from the dhcp server on pfsense is a good sign your connected... Now you would create the rules you want on that pfsense inteface to allow or block what you want for clients on this network.
Here is an example set of rules you might put on a guest network.. that allows for internet but not talking to any of your other networks
Creating the rfc1918 alias is helpful, it just contains all the rfc1918 networks 10/8, 192.168/16 and 172.16/12 witch would be normally any other networks you might setup locally.
-
@johnpoz thank for your answer
it works with yours rules (except captive portal) but i have to maintain enable dhcp server of the wifi router.
So, all computers connected to wifi have 192.168.0/24 ip instead of.192.168.4/24..i can't set lan of wifi router to 192.168.4/24 (error message : WAN IP address and LAN IP address cannot be in the same subnet. )
-
@ppe said in wifi vlan guest network:
i can't set lan of wifi router to 192.168.4/24 (error message : WAN IP address and LAN IP address cannot be in the same subnet. )
Your not using it as an AP then your actually still natting.. To use ANY wifi router as just an AP... turn off its dhcp server, connect it to the network via one of its lan ports vs the wan/internet port. Set the lan IP to be on whatever network your connecting it to.
For wifi routers that have a AP mode - all they do is bridge in the wan internet into the lan, so that is just another lan port and there won't be a "wan" IP on it.
As to captive portal - are you trying to do that on the wifi device or pfsense captive portal??
Also about captive portal - I don't get the use case to be honest.. This is your home right? Not some lobby of a business or something.. So you can't give your "guests" a psk to use.. I have a QR code on a card they can scan to auth to the guest network.
Captive portals kind of make sense in a business setup where don't want to put a sign of what the psk is to auth to the wifi, and you also normally want to glean some info from those users.. If you truly just wanted to provide wifi to customers or whatever, why would you just not make it open, etc.
Why do you want a captive portal? What do you get from using that? What is your use case of a captive portal? Are you wanting to charge your guests a fee to use your wifi?
-
Yes you want that wifi router in access point mode. If it doesn't have a specific access point mode then:
https://docs.netgate.com/pfsense/en/latest/recipes/external-wireless-router.html#turning-a-wireless-router-into-an-access-pointSteve
-
hi, I set my wifi router as you suggest : with dhcp server disable and lan/lan connection (i don't wan ports of the wifi routers). And it works :-D !
I'm the IT/network admin of a very little firm (<10 workers). My goal is :
- set a wifi for worker of the company (access to the servers)
- set a wifi for our clients or visitors (not often but could happen)
And, i thought about captive portal for marketing purpose and also just test this technology.
About guest wifi, i change the lan ip from 192.168.0.1 to 192.168.4.2. Since this change, i can't connect to the admin portal.... i don't know why
-
Actually, i can access...
About guest wifi, i can access from 192.168.4.0/24 network but not from 192.168.2.0/24.
How do that ? Or is it possible to set to 192.168.2.3 for example (i think it might be better because, it can't be accessible from guest network) ? -
Ok so you're using this router only for guest wifi yes? Since it doesn't support multiple SSIDs and VLANs.
You are having trouble accessing the webgui on the wifi device?
There's probably no way to prevent i being accessible from the guestwifi subnet. But it should be password protected.
It probably has no route to be able to reply to other subnets so you would need an outbound NAT rule to mask those behind the guestwifi interface address.
-
I have this now :
i have no vlan capability on both wifi routers
i use 1 router wifi by ssid because, it seems more easy (but i think that i have no choice anyway...)
i set fw rules to block access by guests to the servers
but, i don't understand why i can't access to 192.168.4.2 from 192.168.2.0/24 network
-
You need two things to access the router in 192.168.4.X from 192.168.2.X:
A firewall rule that passes the traffic on LAN in pfSense. That includes not policy routing it out over the VPN for example.
The router must be able to reply. It can probably only reply to requests in the 192.168.4.X subnet because for anything else it will try to use it's WAN which probably isn't connected.
So either set the default route there to the wifiguest interface IP in router. That may not be possible though.
Or add an outbound NAT rule in pfSense on the wifiguest interface to catch the traffic from LAN to the router and translate it to the interface address.
