2 LAN's with pfsense in between and no WAN ?

  • Hello all,

    Is it possible to let pfsense work without a real internet connection ?
    The goal is to replace the WAN site by a LAN1 network (expl. range
    and to have a second lan on the LAN interface (expl. range

    The goal is to put some servers (ftp, emule , www(forum) ) in the LAN1 and to have a wireless community in the LAN2 (Access point on real LAN interface).
    Can I they use the captive portal to supply access to the LAN1 ?

    How to configure pfsense and dns in this case ?


  • Sure. You want to shutdown NAT in that case. Go to firewall>nat, outbound tab. Then enable advanced outbound nat and delete all rules that are created in the table below. Now pfSense does simple routing. Add firewallrules to allow the desired traffic and enable the captive portal at the interface you need it. Add your LAN DNS-Servers at system>general and keep the dns-forwarder enabled (needed for captive portal). You also should set up DHCP for all of your subnets where needed at services>dhcp.

  • Helo Hoba,

    Thanks for reply.

    As I don't have a DNS server in my 2 lan's, is there a way (plugin ?) to let do pfsense the dns part ?

  • at services>dns forwarder enable "Register DHCP leases in DNS forwarder". This way your client's can be resolved by their hostnames. For servers or other static IPs you can add mappings at the same page at the bottom of the page.

  • Another question in this configuration :

    I have my wifi usb stick configured as WLAN interface (and wireless activated for this, initial opt1, interface)
    Do I now need to bridge this interface with the LAN interface ?
    Will I have the captive portal also on my WLAN if I enable it on the LAN interface ?

  • If you need captive portal at more than one interface bridging the wlan interface to lan might be the only way.

  • The goal is the have the captive portal only at the WLAN (= opt1) interface.
    But I don't have the possibility to activate it on this interface (no cap. port. option on the webpage for opt1 interface)

  • Then make a seperate subnet for the wlan. captive portal can't be enabled at a bridged interface.