Critique my design, please?
-
Hello. My plan is to use pfsense for a retail operation. 1 wan. 2 lan. 1 lan (named 'POS') to POS machines and POS server and 1 lan (named 'staff') to staff PCs, camera system, lan printer. I would like to use a SG-2440. POS network is 10.10.10.0/24 and staff is 10.20.20.0/24
I plan to have a dumb switch attached to each lan port from pfsense.
we want to isolate each network to a certain extent but allow outgoing internet traffic.
I set up firewall rules on a test system to block/pass specific traffic between each network. For example pass ICMP, pass vnc, block everything else between each network. test system works fine.
Any criticism of this design is appreciated!
-
Not much to criticize. It's a simple, basic design for a small generic network.
-
It sucks!!!!
Kidding - sounds fine.
-
I would change the interface naming for LAN, someone might misunderstand that acronym :P
-
When I see POS I think Piece of Sh_T not Point of Sale ;) So yeah I would change it ;)
-
Good stuff!
thanks for the support!
-
Without a network diagram, IP/host/network details and a posting of your config, we can't critique your plans.
Just because your test setup appears to be functioning doesn't mean it can't be improved, or it doesn't have holes. The PF community will help to make sure you have the best setup.
-
If you're thinking of using IP cameras (and even if you're just talking analogue) I would consider adding a third network dedicated just to the cameras.
pfSense makes it trivial to allow the intra-network traffic you want while isolating everything else by default.
The cost of an extra NIC or VLAN setup is trivial compared to worrying about possible conflicts in the network traffic.
-
I would change the interface naming for LAN, someone might misunderstand that acronym :P
When I see POS I think Piece of Sh_T not Point of Sale ;) So yeah I would change it ;)
Good design advice. :)
I've worked on a couple customer systems before with similarly-named interfaces, POS_NET or something, and just think to myself "man no wonder, this network was doomed from the start with a name like that."
-
I've changed it to POINT_OF_SALE.
The camera system is a single windows computer (analog cameras) and there are only 2 other windows computers.
This is an effort at PCI compliant solution that requires the point of sale equipment on the network to be isolated. obviously other measures need to be taken on the actual PCs and point of sale equipment.
-
I would have left it as POS, the rest of these nerds be damned! I support POS installations, both kinds.
-
We've set this up. Customer wants to print to a LAN printer on the POS_NETWORK from the STAFF_NETWORK.
However If I open up firewall rules to allow for windows printing 137-139 and 445. won't that defeat the purpose of separate networks? Won't it be wide open, then?
Can the firewall rules allow specific ports to a specific IP address?
-
Make sure the printer has a known static IP in LAN. Then add a firewall rule on POS to pass source POSnet destination Printer-IP ports 137-139,445
It is easy if you make an alias "LANprinters" for the IP of the LAN printer - then you can add to that when another printer appears. And make a ports alias for the list of ports that need to be open to the printer. -
137-139 and 445 is not for printing. It's for the crappy network browsing. Really cannot see how's this needed? Just point the damned printing to an FQDN or IP of the printer.
-
Printer ports would be 9100 TCP for HP JetDirect or 515 TCP for LPR/LPD. As mentioned, the other ports mentioned in this topic are for Windows networking (NetBIOS, SMB, etc.).
-
Is your POS pfsense rig working ok?
-
ok, great advice. thanks! enjoy the weekend!
-
We've set this up. Customer wants to print to a LAN printer on the POS_NETWORK from the STAFF_NETWORK.
I would put the printer on the LAN network and make firewall rules so the POS stations could print to the printer on LAN instead of punching holes in the firewall in the other direction from LAN (unprotected) to POS (protected)..
My LAN rule would be:
reject any source any dest POS Net
I would also make the two networks more random and contained in one subnet, say (staying in 10/8 which is ill-advised to begin with):
10.67.234.0/24
10.67.235.0/24Then the site can be referenced with a single /23.
-
