3 NICs: how should I divvy them up?

  • I have pfSense 1.2.3 on an ALIX 2d3 (500MHz and 256MB RAM).  I've setup the following:

    vr0: WAN
    vr1: OPT1 (parent to VLAN 10 "workstations" and VLAN 20 "printers")
    vr2: LAN (

    According to the docs and the book, the DMZ should be assigned to a separate physical interface and switch fabric to mitigate against possible misconfiguration and/or "VLAN hopping".

    Unfortunately I'm all out of ports.  Should I use the LAN interface?  Do I even need it?  I could setup a small subnet as VLAN 30 called "admin" or something and only grant pfSense web access.  Or maybe as the "default" VLAN 1 and have an access port on both switches for strictly pfSense GUI access and/or switch management?

    Not sure the best use of my (limited) physical interfaces.  Thanks.

  • Well you have to decide yourself if you really need the LAN interface.

    You could also put the LAN on a VLAN on vr1 and have the DMZ alone on vr2.