How to split LAN into two? - Jikjik101's network
-
Sorry but I don't know the correct terminology or how to describe my problem.
Recently, I ran out of NIC and I want to use the LAN card to have two different networks. The reason for this is that all our devices are connected to our file server. For security sake, I want to separate the personal devices (smartphones and laptops) to our office devices (office PCs and printers).
My current setup is: WAN - pfSense - LAN(192.168.100.x)
What I want to do is: |-LAN1(192.168.100.x)
WAN-pfSense-|
|-LAN2(10.10.10.x)Is this doable in 2.0? Can you please point me to the correct direction? I'm confused with VLAN, VIP and DMZ. Which one is more proper solution to my problem?
TIA.
-
How many interfaces you have in your pfsense machine?
only 2? then use vlans
three or more, you can use physical interfaces to separate subnetsboth ways are equally easy
-
this is either going to require A) a switch in front pf your LAN nic, which supports VLAN tagging, or B) another physical NIC
-
I have 4 nics and 3 isps. only one for the lan left. But i need to split the lan into two networks for security purposes. As of now, i cant get additional nic because of my mobo only supports additional 3 nics. And i can only buy the nic with more than two ports by next month. So i want to have atleast a temporary solution to my problem of which i need to "privatized" my office client group from the personal clients group.
I currently have a 3-ISP loadbalance setup.
-
Then you should use vlan with manageable switch until you get nic with multiple interfaces
-
…And i can only buy the nic with more than two ports by next month.
So i want to have atleast a temporary solution to my problem ...If money is the limiting factor for buying another NIC then I doubt he will be able to buy a VLAN capable switch immediately.
To succeed, you need to separate the traffic. Either physically (NICs) or virtually (VLANs). Everything else does not separate the traffic and you gain nothing (except troubles).
If it is this important in a time frame before next month I probably would use one of the WAN NICs as second LAN until a dual NIC arrives. -
10% off w/ promo code netswitch01, ends 8/8
http://www.newegg.com/Product/Product.aspx?Item=N82E16833122381&nm_mc=OTC-Froogle&cm_mmc=OTC-Froogle-_-Network+-+Switches-_-Netgear+Inc.-_-33122381
-
Then you should use vlan with manageable switch until you get nic with multiple interfaces
I though that vlan is already "embedded" with pfsense. This is my fatal misconception. I was thinking that I can just split my LAN into two or more networks and use the VLAN tags as the "category" to identify each network. I thought VLAN is an easy concept to implement without acquiring additional hardware. ;D
If money is the limiting factor for buying another NIC then I doubt he will be able to buy a VLAN capable switch immediately.
Actually money is not the factor, it is our office location. We are currently situated in a place of nowhere. Buying gadgets like this will require us at least a 3-hour travel or at worst, needs to wait 30-45 days for our supplier to get the hardware from their manufacturer/distributor.
To succeed, you need to separate the traffic. Either physically (NICs) or virtually (VLANs). Everything else does not separate the traffic and you gain nothing (except troubles).
If it is this important in a time frame before next month I probably would use one of the WAN NICs as second LAN until a dual NIC arrives.Since physical separation is not possible at this point of time, then the only option that I have is VLAN. But VLAN needs a switch with VLAN capability of which I don't have a possession of, or buying the said hardware will still need time to produce and of which time is not on my side. So I guess this is a losing battle for me unless the new hardware arrives. :'(
10% off w/ promo code netswitch01, ends 8/8
http://www.newegg.com/Product/Product.aspx?Item=N82E16833122381&nm_mc=OTC-Froogle&cm_mmc=OTC-Froogle-_-Network+-+Switches-_-Netgear+Inc.-_-33122381
Thanks for the recommendation but I prefer the NIC with 4 ports. It is for easier management to control just one hardware than to have many devices in-between and it is also much easier to troubleshoot to find the one problematic hardware in a large system.
THANKS ALOT GUYS FOR SHEDDING LIGHT ON MY PROBLEM. CHEERS!
This is my system though:
2.0-RC3 (i386)
built on Sun Jul 31 05:05:32 EDT 2011
Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
http://www.dell.com/us/dfb/p/vostro-220/pd -
Well vlan is embedded in pfsense, but it needs hardware that is capable of understanding that traffic
-
what can you suggest, additional dedicated NIC or manageable switch? Which is more better in terms of performance and management? Considering that I only want to split the current LAN.
-
If you think that you would have more separated lans, then manageable switch pays off via multiple vlans.
But other than that it is flavor issue, which you prefer more -
Would it not be possible, theoretically, to use VLANs without a switch if all the LAN clients support VLAN tagging directly?
I realise it would not provide much by way of security and that it may be completely impractical if you have lots of clients. It would also rely on you trusting the client computers.
However if you need to separate the traffic for some reason other than security this might be possible.I've never tried this but I'd be interested in your thoughts. :)
Steve
-
Hmm, i've never seen this in action. so does this mean, that i don't trust people/client machines?!?
-
@metu: is the manageable switch alone is enough to create a vlan? i'm talking about hardware requirements. so from my pfsense box-manageable switch-different vlans?
@stephen: sorry but i don't understand what you are saying. If i have a vlan-capable client, i can separate this client from others in my LAN directly? And this client is the one who can control/manage the VLAN and not me? what if i have 3 vlan-capable clients, how are they going to communicate? thinking vlan alone makes my head aches. :-[
Myy current situation, I have one LAN composes of Group A(staff) and Group B(guests). My LAN has a file server of which Group B should not have access for confidentiality reason. I read that I cannot filter traffic coming in and out in the same interface. But I need to restrict Group B to access the file server. The question is how?
-
@metu: is the manageable switch alone is enough to create a vlan? i'm talking about hardware requirements. so from my pfsense box-manageable switch-different vlans?
Yes, a small VLAN capable switch is sufficient for your needs. I'm not sure that all manageable switches are VLAN capable.
@stephen: sorry but i don't understand what you are saying. If i have a vlan-capable client, i can separate this client from others in my LAN directly? And this client is the one who can control/manage the VLAN and not me? what if i have 3 vlan-capable clients, how are they going to communicate? thinking vlan alone makes my head aches. :-[
[/quote]
Notice also that Stephen said it would not provide much by way of security so I think that rules his idea out for your circumstances.Myy current situation, I have one LAN composes of Group A(staff) and Group B(guests). My LAN has a file server of which Group B should not have access for confidentiality reason. I read that I cannot filter traffic coming in and out in the same interface. But I need to restrict Group B to access the file server. The question is how?
You need to be able to configure separate interfaces for group A and group B so you can create distinct firewall rules for each group. You can use separate physical interfaces for each group (but your slots are all in use so you might need to replace a single port card by a dual port card to get the additional interface) or you can use VLANs to get distinct "virtual" interfaces over a single physical interface. If you use VLANs you will need at least a small VLAN capable switch. Where I live small VLAN capable switches are available for under the local equivalent of US$100.
Given that you aren't allowing significant traffic between group A and group B you should see any significant performance difference between the two options.
Actually money is not the factor, it is our office location. We are currently situated in a place of nowhere. Buying gadgets like this will require us at least a 3-hour travel or at worst, needs to wait 30-45 days for our supplier to get the hardware from their manufacturer/distributor.
If your superiors are not prepared to fund someone for the three hour trip and are not prepared to wait 30-45 days for your current supplier to provide and are not prepared to authorise an "exception" to get suitable equipment sooner and want the solution "now" then they are not serious about the security.
To get the security you appear to need you require either an additional port or the VLAN capable switch.On thinking through this a bit more, I notice its not clear how groups A and B currently connect to pfSense: possibly both groups connect to a single switch, maybe there is a wireless access point or two etc. What you will need will actually depend somewhat on the mix of devices in the different groups. For example, if every device in group B is WiFi capable then you could get away with configuring a USB Wireless NIC that can act as an access point in your pfSense box. Group B devices would then come in over WiFi and would have their own separate firewall rules. (I'm presuming your existing pfSense box has at least one spare USB slot.)
-
Yes, a small VLAN capable switch is sufficient for your needs. I'm not sure that all manageable switches are VLAN capable.
Nice. I will start looking for a VLAN capable switch.
Notice also that Stephen said it would not provide much by way of security so I think that rules his idea out for your circumstances.
Just for the sake of discusion, how will the three VLAN-capable computers communicate? Do not consider the security here.
You need to be able to configure separate interfaces for group A and group B so you can create distinct firewall rules for each group. You can use separate physical interfaces for each group (but your slots are all in use so you might need to replace a single port card by a dual port card to get the additional interface) or you can use VLANs to get distinct "virtual" interfaces over a single physical interface. If you use VLANs you will need at least a small VLAN capable switch. Where I live small VLAN capable switches are available for under the local equivalent of US$100.
Given that you aren't allowing significant traffic between group A and group B you should see any significant performance difference between the two options.
What do you mean by this?
If your superiors are not prepared to fund someone for the three hour trip and are not prepared to wait 30-45 days for your current supplier to provide and are not prepared to authorise an "exception" to get suitable equipment sooner and want the solution "now" then they are not serious about the security.
To get the security you appear to need you require either an additional port or the VLAN capable switch.Which do you suggest, VLAN switch or additional port?
On thinking through this a bit more, I notice its not clear how groups A and B currently connect to pfSense: possibly both groups connect to a single switch, maybe there is a wireless access point or two etc. What you will need will actually depend somewhat on the mix of devices in the different groups. For example, if every device in group B is WiFi capable then you could get away with configuring a USB Wireless NIC that can act as an access point in your pfSense box. Group B devices would then come in over WiFi and would have their own separate firewall rules. (I'm presuming your existing pfSense box has at least one spare USB slot.)
Sorry, I was not clear on this.
switches - wired clients
pfsense box ->switch-|
|-wireless router - WiFi clientsGroup A - wired clients and WiFi clients
Group B - WiFi clients onlyI will give you more details network diagram on my next reply(hopefully I can make one).
There is another post that looks like my problem. http://forum.pfsense.org/index.php/topic,39654.0.html
@Nachtfalke:Hi,
not sure how this works in pfsense but I think there is an option "Virtual IP". I think this could help you (if you do not have/like tuj use VLANs)
-
Notice also that Stephen said it would not provide much by way of security so I think that rules his idea out for your circumstances.
Just for the sake of discusion, how will the three VLAN-capable computers communicate? Do not consider the security here.
There aren't three VLAN capable computers, only a VLAN capable switch and VLANs configured on pfSense. One switch port connects to your LAN switch (group A), one switch port connects to your wireless router. These switch ports are configured in distinct VLANs, add VLAN tags on input to the switch, strip VLAN tags on output. A third switch port connects to pfSense and is configured to belong to both VLANs and passes through VLAN tags on both input and output. On pfSense you configure two VLANs on its port connected to the switch and use VLAN IDs the same as you configured in the switch.
You need to be able to configure separate interfaces for group A and group B so you can create distinct firewall rules for each group. You can use separate physical interfaces for each group (but your slots are all in use so you might need to replace a single port card by a dual port card to get the additional interface) or you can use VLANs to get distinct "virtual" interfaces over a single physical interface. If you use VLANs you will need at least a small VLAN capable switch. Where I live small VLAN capable switches are available for under the local equivalent of US$100.
Given that you aren't allowing significant traffic between group A and group B you should see any significant performance difference between the two options.
What do you mean by this?
Sorry, it should have read … you should NOT see any significant …
If your superiors are not prepared to fund someone for the three hour trip and are not prepared to wait 30-45 days for your current supplier to provide and are not prepared to authorise an "exception" to get suitable equipment sooner and want the solution "now" then they are not serious about the security.
To get the security you appear to need you require either an additional port or the VLAN capable switch.Which do you suggest, VLAN switch or additional port?
Whatever best suits you. Extra port means you don't have a extra switch to manage. VLAN switch give you a bit more expansion capability than an extra port.
There is another post that looks like my problem. http://forum.pfsense.org/index.php/topic,39654.0.html
@Nachtfalke:Hi,
not sure how this works in pfsense but I think there is an option "Virtual IP". I think this could help you (if you do not have/like tuj use VLANs)
A variant of Stephen's suggestion that was rejected earlier because it provided inadequate security.
-
A variant of Stephen's suggestion that was rejected earlier because it provided inadequate security.
Please expound this one.
What difference will it make? -
The very low security option would be something like this:
Assign a second virtual interface to the LAN interface. This interface will have different subnet.
Then you assign your 'lan B' group to use this subnet.
However any seperation betwen the two subnets relies on your clients not manually changing their IP. I guess you could lock down the client computers using windows security policy or equivalent.The VLANs with no switch would be similar. You would have to set the VLAN number on each client such that they would only see packets tagged with that number.
Steve
-
I see. The effect is now clearer on me using stephenw10's method.
Sorry for being so ignorant, but what I don't get is the how-to or the step-by-step process to make this one. ??? ???
@stephenw10:Assign a second virtual interface to the LAN interface. This interface will have different subnet.
Then you assign your 'lan B' group to use this subnet.Correct me if I am wrong (I know I'm wrong ;D), are these the steps to do stephenw10's suggestion?
1. In my pfSense box, go to Interface>(assign)>VLANs>add.
2. Create a VLAN with LAN as the parent interface.VLAN tag as 2.
3. I don't know what's the next step.