How to split LAN into two? - Jikjik101's network
-
@metu: is the manageable switch alone is enough to create a vlan? i'm talking about hardware requirements. so from my pfsense box-manageable switch-different vlans?
@stephen: sorry but i don't understand what you are saying. If i have a vlan-capable client, i can separate this client from others in my LAN directly? And this client is the one who can control/manage the VLAN and not me? what if i have 3 vlan-capable clients, how are they going to communicate? thinking vlan alone makes my head aches. :-[
Myy current situation, I have one LAN composes of Group A(staff) and Group B(guests). My LAN has a file server of which Group B should not have access for confidentiality reason. I read that I cannot filter traffic coming in and out in the same interface. But I need to restrict Group B to access the file server. The question is how?
-
@metu: is the manageable switch alone is enough to create a vlan? i'm talking about hardware requirements. so from my pfsense box-manageable switch-different vlans?
Yes, a small VLAN capable switch is sufficient for your needs. I'm not sure that all manageable switches are VLAN capable.
@stephen: sorry but i don't understand what you are saying. If i have a vlan-capable client, i can separate this client from others in my LAN directly? And this client is the one who can control/manage the VLAN and not me? what if i have 3 vlan-capable clients, how are they going to communicate? thinking vlan alone makes my head aches. :-[
[/quote]
Notice also that Stephen said it would not provide much by way of security so I think that rules his idea out for your circumstances.Myy current situation, I have one LAN composes of Group A(staff) and Group B(guests). My LAN has a file server of which Group B should not have access for confidentiality reason. I read that I cannot filter traffic coming in and out in the same interface. But I need to restrict Group B to access the file server. The question is how?
You need to be able to configure separate interfaces for group A and group B so you can create distinct firewall rules for each group. You can use separate physical interfaces for each group (but your slots are all in use so you might need to replace a single port card by a dual port card to get the additional interface) or you can use VLANs to get distinct "virtual" interfaces over a single physical interface. If you use VLANs you will need at least a small VLAN capable switch. Where I live small VLAN capable switches are available for under the local equivalent of US$100.
Given that you aren't allowing significant traffic between group A and group B you should see any significant performance difference between the two options.
Actually money is not the factor, it is our office location. We are currently situated in a place of nowhere. Buying gadgets like this will require us at least a 3-hour travel or at worst, needs to wait 30-45 days for our supplier to get the hardware from their manufacturer/distributor.
If your superiors are not prepared to fund someone for the three hour trip and are not prepared to wait 30-45 days for your current supplier to provide and are not prepared to authorise an "exception" to get suitable equipment sooner and want the solution "now" then they are not serious about the security.
To get the security you appear to need you require either an additional port or the VLAN capable switch.On thinking through this a bit more, I notice its not clear how groups A and B currently connect to pfSense: possibly both groups connect to a single switch, maybe there is a wireless access point or two etc. What you will need will actually depend somewhat on the mix of devices in the different groups. For example, if every device in group B is WiFi capable then you could get away with configuring a USB Wireless NIC that can act as an access point in your pfSense box. Group B devices would then come in over WiFi and would have their own separate firewall rules. (I'm presuming your existing pfSense box has at least one spare USB slot.)
-
Yes, a small VLAN capable switch is sufficient for your needs. I'm not sure that all manageable switches are VLAN capable.
Nice. I will start looking for a VLAN capable switch.
Notice also that Stephen said it would not provide much by way of security so I think that rules his idea out for your circumstances.
Just for the sake of discusion, how will the three VLAN-capable computers communicate? Do not consider the security here.
You need to be able to configure separate interfaces for group A and group B so you can create distinct firewall rules for each group. You can use separate physical interfaces for each group (but your slots are all in use so you might need to replace a single port card by a dual port card to get the additional interface) or you can use VLANs to get distinct "virtual" interfaces over a single physical interface. If you use VLANs you will need at least a small VLAN capable switch. Where I live small VLAN capable switches are available for under the local equivalent of US$100.
Given that you aren't allowing significant traffic between group A and group B you should see any significant performance difference between the two options.
What do you mean by this?
If your superiors are not prepared to fund someone for the three hour trip and are not prepared to wait 30-45 days for your current supplier to provide and are not prepared to authorise an "exception" to get suitable equipment sooner and want the solution "now" then they are not serious about the security.
To get the security you appear to need you require either an additional port or the VLAN capable switch.Which do you suggest, VLAN switch or additional port?
On thinking through this a bit more, I notice its not clear how groups A and B currently connect to pfSense: possibly both groups connect to a single switch, maybe there is a wireless access point or two etc. What you will need will actually depend somewhat on the mix of devices in the different groups. For example, if every device in group B is WiFi capable then you could get away with configuring a USB Wireless NIC that can act as an access point in your pfSense box. Group B devices would then come in over WiFi and would have their own separate firewall rules. (I'm presuming your existing pfSense box has at least one spare USB slot.)
Sorry, I was not clear on this.
switches - wired clients
pfsense box ->switch-|
|-wireless router - WiFi clientsGroup A - wired clients and WiFi clients
Group B - WiFi clients onlyI will give you more details network diagram on my next reply(hopefully I can make one).
There is another post that looks like my problem. http://forum.pfsense.org/index.php/topic,39654.0.html
@Nachtfalke:Hi,
not sure how this works in pfsense but I think there is an option "Virtual IP". I think this could help you (if you do not have/like tuj use VLANs)
-
Notice also that Stephen said it would not provide much by way of security so I think that rules his idea out for your circumstances.
Just for the sake of discusion, how will the three VLAN-capable computers communicate? Do not consider the security here.
There aren't three VLAN capable computers, only a VLAN capable switch and VLANs configured on pfSense. One switch port connects to your LAN switch (group A), one switch port connects to your wireless router. These switch ports are configured in distinct VLANs, add VLAN tags on input to the switch, strip VLAN tags on output. A third switch port connects to pfSense and is configured to belong to both VLANs and passes through VLAN tags on both input and output. On pfSense you configure two VLANs on its port connected to the switch and use VLAN IDs the same as you configured in the switch.
You need to be able to configure separate interfaces for group A and group B so you can create distinct firewall rules for each group. You can use separate physical interfaces for each group (but your slots are all in use so you might need to replace a single port card by a dual port card to get the additional interface) or you can use VLANs to get distinct "virtual" interfaces over a single physical interface. If you use VLANs you will need at least a small VLAN capable switch. Where I live small VLAN capable switches are available for under the local equivalent of US$100.
Given that you aren't allowing significant traffic between group A and group B you should see any significant performance difference between the two options.
What do you mean by this?
Sorry, it should have read … you should NOT see any significant …
If your superiors are not prepared to fund someone for the three hour trip and are not prepared to wait 30-45 days for your current supplier to provide and are not prepared to authorise an "exception" to get suitable equipment sooner and want the solution "now" then they are not serious about the security.
To get the security you appear to need you require either an additional port or the VLAN capable switch.Which do you suggest, VLAN switch or additional port?
Whatever best suits you. Extra port means you don't have a extra switch to manage. VLAN switch give you a bit more expansion capability than an extra port.
There is another post that looks like my problem. http://forum.pfsense.org/index.php/topic,39654.0.html
@Nachtfalke:Hi,
not sure how this works in pfsense but I think there is an option "Virtual IP". I think this could help you (if you do not have/like tuj use VLANs)
A variant of Stephen's suggestion that was rejected earlier because it provided inadequate security.
-
A variant of Stephen's suggestion that was rejected earlier because it provided inadequate security.
Please expound this one.
What difference will it make? -
The very low security option would be something like this:
Assign a second virtual interface to the LAN interface. This interface will have different subnet.
Then you assign your 'lan B' group to use this subnet.
However any seperation betwen the two subnets relies on your clients not manually changing their IP. I guess you could lock down the client computers using windows security policy or equivalent.The VLANs with no switch would be similar. You would have to set the VLAN number on each client such that they would only see packets tagged with that number.
Steve
-
I see. The effect is now clearer on me using stephenw10's method.
Sorry for being so ignorant, but what I don't get is the how-to or the step-by-step process to make this one. ??? ???
@stephenw10:Assign a second virtual interface to the LAN interface. This interface will have different subnet.
Then you assign your 'lan B' group to use this subnet.Correct me if I am wrong (I know I'm wrong ;D), are these the steps to do stephenw10's suggestion?
1. In my pfSense box, go to Interface>(assign)>VLANs>add.
2. Create a VLAN with LAN as the parent interface.VLAN tag as 2.
3. I don't know what's the next step. -
You shouldn't be doing this! :P
I've never done it even read about doing it with VLANs. I was just speculating if it might be theoretically possible.However after you have setup the additional VLAN interface and configured it's IP address and subnet then you should go to a client computer and try to set the VLAN tagging to match. I don't know how you would do that though.
You are then in the situation where you have both tagged and untagged traffic on the same interface which can result in problems.
It's an interesting exercise but you probably won't end up with a working configuration.
Steve
-
hahaha… that is what I'm thinking. hahaha
I thought you're going to give me a HOW-TO. ::) hahaha
Anyway, I'll try to experiment with this and maybe (maybe), I can solve my problem.(cross-fingers on both hands and feet).hahaha
THANKS A LOT FOR SHARING YOUR THOUGHTS/IDEAS. I've learned a lot from this.
-
Well.. I would continue with vlan capable switch and put this to side for waiting period. What kind of client devices you're having over there?
should you need also vlan capable wireless also?!?For a good practice you could draw couple of images: "What do I have now" and "What I want to achieve with changes"
Send those drawings us to view and the we might be able to give you precise enough answers for your investments
-
In case you're crazy enough to try this! Here's some instructions for WinXP:
http://www.formortals.com/implementing-vlan-trunking/
I think you need the right network card and probably Win XP Pro. It doesn't work on my one remaining Win XP Home machine. Here's something for Ubuntu if your using that:
http://ubuntuforums.org/showthread.php?t=703387If you added a VLAN interface on your LAN and then setup all your Group A clients to use it it would be very unlikely that any machine in group B would every connect to it. There would be nothing to stop a group B user from connecting (unless you have the machines locked down) it's just not something any normal person would look for. It's such an unusual network setup. However security through obscurity is not any real sort of security! ;)
It would still require all of your group A machines to be VLAN compatible.
Steve
-
Another idea that could be done without additional hardware:
Why not connect ALL users to the guest network and install an OpenVPN or IPSec client on the production machines.
…ok, if you have infrastructure they need to access (like servers...) then it's not the best idea. That has to be connected to a physical segment. Unless you're using VMs everywhere. -
I like that idea. Why could the server not be connected to pfSense via internal VPN also?
Perhaps you could run a VPN server on your LAN server machine instead and simply restrict access to it that way. Come to think of it there must be any number of ways you could restrict access to the server via authorisation.Steve
-
Now your making my brain bleed. ???
I will post tomorrow my setup for everyone's better understanding. Sorry if my posts were a little bit ambiguous.
The only reason that I want to separate Group B from A is to restrict B in accessing the file server in A.
All devices in B are wireless while in A are both wired and wireless. -
to restrict B in accessing the file server in A.
Access policy on the server? Pretty much standard in every server software I can think of.
VPN Clients:
- Make everyone a guest.
- Allowed users/PCs tunnel into your restricted network via an IPSec or OpenVPN tunnel.
That's how road warriors typically access resources back in the company. In your case just without the road. :D
-
Okay now we're going to make different kind of decision.
Do we manage acl in- firewall/router
- switches (vlan dividing)
- servers(ntfs kind of restrictions or fileshare restrictions)
- antivirus softwares
-
Sorry for the late reply. Here's my network diagram.
I want to separate Groups E and G from the rest of the network. I thought it was a simple job. ;D![New Network Diagram-pfsense2.jpg_thumb](/public/imported_attachments/1/New Network Diagram-pfsense2.jpg_thumb)
![New Network Diagram-pfsense2.jpg](/public/imported_attachments/1/New Network Diagram-pfsense2.jpg) -
I thought it was a simple job. ;D
It can be. If you have lots of time you can spend instead of cash a number of other possible solutions could be explored.
Its a nice diagram but I find the text difficult to read even when magnified.
Based on the diagram I would recommend you consider only the following two options:
-
Replace one of the existing pfSense NIC by a multiport card, connect one card port to the existing switch (this becomes the pfSense LAN port) and connect another to a suitable sized (number of ports) switch (new switch to the configuration) and move groups E and G to that new switch.
-
Purchase a suitable sized VLAN capable switch, configure two VLANs on existing pfSense LAN interface, one VLAN for your existing LAN, one for the combined group E and G. On your VLAN capable switch configure the two VLANs, configure one switch port for connection to your existing LAN interface, one port for connection to the existing switch and other ports for connection to groups E and G.
If you want future flexibility go with 2) (for example, its easy to add a another VLAN so group E could have different firewall rules from group G). You might be able to save a little bit (unlikely to be much) by going with option 1
This might be a good time to recall the proverb "the devil is in the detail". The costs will be significantly affected by the number of computers in group E. If its two then a cheap 5 port VLAN capable switch will be sufficient. If its 24 then you will need a rather more expensive VLAN capable switch. The way you have drawn the diagram suggests there might be more switches than you have shown in which case implementing either solution might require new cabling which might be a non trivial installation task.
Its simple in concept.
-
-
Sorry for the diagram. You can check it here: http://i49.photobucket.com/albums/f297/jikjik101/NewNetworkDiagram-pfsense3.jpg
I want to use this one: Intel Pro/1000 MT Quad Port Server Adapter PWLA8494MT1000 (Intel 82546EB processor) http://www.ebay.co.uk/itm/NEW-Intel-PRO-1000-Quad-Port-Server-Adp-PWLA8494MT-/170262023800 of which my pfsense box is : Dell Vostro 220 Mini Tower http://www.dell.com/us/dfb/p/vostro-220/pd#TechSpec @wallabybob:
- Replace one of the existing pfSense NIC by a multiport card, connect one card port to the existing switch (this becomes the pfSense LAN port) and connect another to a suitable sized (number of ports) switch (new switch to the configuration) and move groups E and G to that new switch.
I'm confused with Number 2. Please see attached picture if I understand correctly your suggestion sir.
![New Network Diagram-pfsense(rev1).jpg](/public/imported_attachments/1/New Network Diagram-pfsense(rev1).jpg)
![New Network Diagram-pfsense(rev1).jpg_thumb](/public/imported_attachments/1/New Network Diagram-pfsense(rev1).jpg_thumb) -
You got it right.
-
I'm confused with Number 2. Please see attached picture if I understand correctly your suggestion sir.
You understand.
You diagram suggests group G has an access restriction schedule while group E doesn't. It could be convenient to put group E and group G on separate interfaces so you can use firewall rule schedules on group G.
-
This might be a good time to recall the proverb "the devil is in the detail". The costs will be significantly affected by the number of computers in group E. If its two then a cheap 5 port VLAN capable switch will be sufficient. If its 24 then you will need a rather more expensive VLAN capable switch. The way you have drawn the diagram suggests there might be more switches than you have shown in which case implementing either solution might require new cabling which might be a non trivial installation task.
Just some clarifications sirs. If for example I have 20 computers in group E and another 20 computers in group G, does it mean I need atleast a 40-port VLAN switch? Can't I use a normal switch to connect all my clients behind Group G and E?
Thanks for all your input. Maybe I am going to change the title of this thread to jikjik101's network, because I think I need more of your expertise to help me build my network in a sound technique and more appropriate methods.
Every now and then, some problems arise in my network and I am going to post it here so that I can access it easily. I hope the moderators don't mind if I am going to "own" this thread. ;D
![New Network Diagram-pfsense(rev2).jpg](/public/imported_attachments/1/New Network Diagram-pfsense(rev2).jpg)
![New Network Diagram-pfsense(rev2).jpg_thumb](/public/imported_attachments/1/New Network Diagram-pfsense(rev2).jpg_thumb) -
This is ONE of the concerns of my network. ;D
As you can see, I have three ISPs and they are in load balance mode. But I cannot "stabilize" my ISP1 and ISP3. The connections are so erratic that it becomes so hard to connect to the internet. Unlike my ISP2, the connection is so stable and so I just use the failover mode with ISP2 in tier 1 and both ISP1 and ISP3 in tier2.
If I assign my whole network in using just one ISP, it is stable.
I already tried the following:
1. Assign an ISP as default gw
2. Not assigning a default gw
3. Check the "allow default gw switching"
4. Uncheck the "allow default gw switching"
5. Set each GW with maximum and minumum latency % base on its RRD.I have squid, squidguard, lightsquid, lusca-cache, havp, vnstat2 and bandwidthd.
I cannot fully utilize all my ISPS, it seems ISP2 is doing the hardwork. >:( and the rest are just easy-go-lucky ISPs. :-X
![network traffic.jpg](/public/imported_attachments/1/network traffic.jpg)
![network traffic.jpg_thumb](/public/imported_attachments/1/network traffic.jpg_thumb)
-
With those rules and gateways I would expect almost all traffic to using be using ISP2, and it is.
This is because most of your traffic is caught by the first rule as it's web traffic. Only non-webtraffic is reaching the second rule where it is shared between ISP1 and 3 as they are both in the same tier.
You need to change the gateway to loadbalance on the first rule if you want to see the traffic more evenly distributed.There is no need (or harm) to use tier5 in your load balancing rule. The importance of each connection is relative within the gateway and not related to the other gateways. If you had all three at tier1 it would be the same. The same applies to your failover3 gateway.
You can use a normal switch behind your VLAN switch to connect your clients.
Steve
-
Maybe I am going to change the title of this thread to jikjik101's network, because I think I need more of your expertise to help me build my network in a sound technique and more appropriate methods.
Every now and then, some problems arise in my network and I am going to post it here so that I can access it easily. I hope the moderators don't mind if I am going to "own" this thread. ;D
You might find it more workable to have as few topics as possible per thread: that is make a new thread for a new issue.
If for example I have 20 computers in group E and another 20 computers in group G, does it mean I need atleast a 40-port VLAN switch? Can't I use a normal switch to connect all my clients behind Group G and E?
Maybe I've missed something. The 40 is from 20 in group E + 20 in group G? But your diagram shows group G as WiFi clients connecting to an Access Point. The AP would use one port on a switch (VLAN or non-VLAN). The 20 computers in group E would use 20 ports in a switch (because they are shown as using wired connections) unless they are connected to another switch.
-
@stephenw10: sorry for not being clear. The fw and gw pictures that I posted are my current setup as a solution to my erratic loadbalance on ISP1 and ISP3. That is only to utilize my my ISP1 and ISP3 because they are not stable if I use the LoadBalance gw.
You are correct that my webbrowsing enters ISP2 and the rest to my Failover GWs. That is my current setup. i forgot to disable the first two rules when I took the screenshots.
But the erratic connection that I am talking about is when I use the LoadBalance gw and disabling the first two fw rules leaving this one alone active:
-
-
-
-
- LoadBalance none
-
-
-
I only use the default LAN rule with LoadBalance as gw, disable/remove other rules except the Anti-lockout but same results.
@wallybob:
The way you have drawn the diagram suggests there might be more switches than you have shown in which case implementing either solution might require new cabling which might be a non trivial installation task.
I remove some switches in the diagram because I don't find it essential for the network diagram. sorry, my bad.
The 40 is from 20 in group E + 20 in group G? But your diagram shows group G as WiFi clients connecting to an Access Point. The AP would use one port on a switch (VLAN or non-VLAN). The 20 computers in group E would use 20 ports in a switch (because they are shown as using wired connections) unless they are connected to another switch.
Actually I have more than 200 computers behind Group E and Group G. Group G atleast 100 WiFi clients and Group E another 100 both Wired And WiFi clients.
You can use a normal switch behind your VLAN switch to connect your clients.
I think stephenw10 already answered my clarification regarding a LAN switch behind a VLAN switch.
I'll go back to my concern, I use the default LAN fw rule with LoadBalance as my gw, leaving my LAN rule as follows:
* * * LAN Address 22 * * Anti-Lockout Rule
80
* * * * * LoadBalance none Default allow LAN to any ruleBut I cannot utilize my ISP1 and ISP3 because they just suddenly drop my connection, or worse they cannot get the maximum bandwidth even if I bombarded my system with lots of video streaming.
-
-
Your ISPs 1 and 3 both use a wireless connection. They are likely to have high latency. When you are trying to loadbalance all three what you see in the logs?
It's very possible that they are being removed from the loadbalancing gateway due to the latency becoming too high or packet loss.Steve
-
All my ISPS are wireless.
ISP1 is using a grid antennae
ISP2 is using radio tower
ISP3 is using satellite dishMy syslog is clear of any disconnections from any ISP except if there is a high network utilization.
What I don't understand is for example I'm downloading a torrent, I can see all my ISPs as being used due to high traffic. The only difference is that my ISP2 has a steady traffic, but my ISP1 and ISP3 shows very minimal or "erratic" connection. See the attached picture please.
-
In your diagram you show some infrastructure in the network of ISP2 between you and the radio link section. I would guess that ISP2 is limiting your connection speed in that infrastructure such that you are never seeing the limit of what the radio link can achieve and hence any variation in speed. The other connections, ISP1 and 3, are subject to error checking and additional network overhead caused by a wireless connection.
Steve
-
I don't know if you're a magician or an x-men with telekinesis power but I think you got it right. :o
The diagram actually only showed a building with ISP2, but as a matter of fact, all my ISPs are in the same roof with 10-20meters in-between distance. The only difference is that ISP2 has a router in-between my pfsense box and the rest has none.But I think you're right when you say that ISP2 is limiting my connection speed. It looks like ISP2 had put a cap on my download speed so it looks like very stable.
-
And I think I got my multiwan to work with loadbalance with squid.
What I did is just put floating rule and the manual NAT.
In the floating rule, I select WAN1 as the interface source, loadbalance gw as the gateway. And that's it.- WAN1 address * * * LoadBalance none
My loadbalance with squid is now working (I think) :o
I read this somewhere but I forgot the link. I don't know why it is needed to put WAN1 Address as the source and selecting WAN1 interface only in the floating rule.
I found the link: http://forum.pfsense.org/index.php/topic,38882.0.html![net traf.JPG](/public/imported_attachments/1/net traf.JPG)
![net traf.JPG_thumb](/public/imported_attachments/1/net traf.JPG_thumb) - WAN1 address * * * LoadBalance none
-
kernel: pid 26983 (imspector), uid 0: exited on signal 11 (core dumped)
What is this? This is with imspector-wip. I tried to reinstall but failed.
When I looked at my installed packages, imspector didn't show up. When I go to packages, I didn't find the package anymore. So I uninstall it and try the imspector, the other version. -
I don't know if you're a magician or an x-men with telekinesis power
Hmmm, X-man! ;D
I can't help you with imspector though.
Steve
-
I thought you can solve anything. ;D
I have another problem, the loadbalance works. But sometimes when an ISP goes down, it doesn't reconnect. I have to edit its gateway and save just to "wake" it up. Any thoughts?
-
Now this make my head aches! >:(
It seems that LoadBalance doesn't work properly.
Default GW: None
Unabled: Use sticky connections
Unabled: Allow default gateway switchingNAT: Manual
WAN1 * * * * * * NO
WAN2 * * * * * * NO
WAN3 * * * * * * NOLoadBalanceGW is the gateway group for the 3 ISPs under same tier.
Firewall Rules
LAN:-
-
-
-
- LoadBalanceGW None
Floating:
- LoadBalanceGW None
-
-
-
-
-
-
-
- LoadBalanceGW None
-
-
-
Packages: squid, lusca-cache, squidguard, lightguard, havp, bandwidthd, vnstat2 and imspector
Squid is transparent mode.WAN1 = Dynamic, 2 DNS
WAN2 = Static, 2 DNS
WAN3 = Static, 2 DNS - 1 is the Google DNS (8.8.8.8)Problem1: It seems that round-robin doesn't work correctly. It seems that one ISP gets the heavy work while the other two are just simply "sleeping". But when I check the http://pfsense.org/ip.php, I get all the public IPs of the three ISPs. When I checked the firewall logs, it seems that an ISP gets a weight twice the other two. I can see that ISP1 for example is being used twice before it connects to ISP2 then ISP3 then goes back to ISP1 then another ISP1 then ISP2 and so on and so forth.
Problem2: If one ISP gets down, it doesn't reconnect. I manually edit the router page or unplug/plug the cable just to get it online. The status either stays OFFLINE or Gathering Data, it never goes back to ONLINE.
Please help again. TIA.
-
-
I assume you have made most of those settings because you are running Squid with loadbalancing? I've never tried to do that I'm afraid.
I think you would be better asking a new question in the loadbalancing section of the forum. This thread is now long enough to put people off reading it! ::)Steve
-
I cannot get the loadbalance to work so I go to policy routing with squid in transparent.
Although I am disappointed with my setup since I cannot fully utilize all my ISPs but I have to be contented with it.
I manually balance the load to the 3 different ISPs.GroupA(high priority) - ISP1
GroupB(medium priority) - ISP2
GroupC(low priority) - ISP3I just add the following in my custom options of squid to make it work (IPs are just for example):
acl GroupA src 192.168.100.1/24;
acl GroupB src 192.168.101.0/24;
acl GroupC src 192.168.102.0/24;tcp_outgoing_address 10.10.10.1 GroupA;
tcp_outgoing_address 10.10.10.2 GroupB;
tcp_outgoing_address 10.10.10.3 GroupC;