How many NICs I need?

kipTry

Hi, I'm a beginner in networks and security, and now I want to build my own router/firewall using pfsense.
My first question is about the number of NICs. What is the minimum of interfaces I need?. I guess two NICs: WAN and LAN. But, is it possible to use a single NIC with several ports, and configure each port as port1-WAN, port2-VLAN1(LAN), port3-vlan2(DMZ)? Or is it better to use a NIC for WAN, another for LAN, DMZ, …

Graphically:

Option A:

NIC1: WAN
NIC2: LAN
NIC3: DMZ
NIC 4: WIFI

Option B:

NIC1:
Port 1: WAN
Port 2: LAN
Port 3: DMZ
NIC2: Wifi

If both options are possible, what are the advantages and disadvantages of each one?

Thanks.

johnpoz

You should have at min 2 nics, wan and lan - if you want to do some vlans on your lan great, wifi for example - do you have a switch that supports vlans?

While yes everything could be done with 1 nic and vlans. Why??? You can pick up a 4 port nic for really cheap..

Never seen a nic with 3 ports so your option 2 is a bit odd ;)

heper

Youtube Video

you generally run a trunk towards your pfsense ; in most cases its pointless to run multiple physical interfaces with each 1 seperate vlan …

Guest

If you are in the situation to build a new pfSense appliance and oyu can really choose how many NICs or Ports
you will be able to set up or plain insert it would be the best to have 4 LAN Ports in your case.
1 GB LAN Port - WAN
1 GB LAN Port - LAN
1 GB LAN Port - DMZ
1 GB LAN Port - WiFi

or

1 GB LAN Port - WAN
1 GB LAN Port - LAN & Netgear GS105Ev2, GS108GSv2, GS108Tv2 Switch & WiFI APs
1 GB LAN Port - DMZ if needed or free

For a home setup it would be sufficient to go with Intel consumer grade NICs
beware of Realtek or Broadcom NICs. If money is there you can also go with a
Quad Port or 2 Dual Port used Intel NICs from the eBay or Amazon.com

kipTry

OK, so It is possible ;). I saw this example with 3 ports: http://www.get-virtual.net/2014/09/16/build-firewall-appliance/

I don't want to use a switch because my net is very small. My idea is:

Router -> pfsense
pfsense:
WiFi: laptops, mobiles, tv. This would be a mini-PCIe wi-fi Adapter
LAN: Right now I use WiFi, but I would like to have a port for connect a device (or maybe a switch in the future)
DMZ: With a port is ok, the same than lan: for a device (like a honeypot) or a switch in the future to web servers

So, I was thinking my option B should work if I use each port for a purpose: wan, lan and dmz. Just for keep it simple. Mi goal is to learn, I don't want anything too much complex.

On the other hand I can buy a mini-itx with:

Integrated Nic for wan
PCI wifi adapter for wifi
And two NICs: dmz and lan

I'm still confused: In mi situation, is it better to use NICs or Ports in terms of efficiency, complexity and security?.

Thanks!

johnpoz

A multiple port nic is fine…

Don't put wifi in your pfsense box.. Its just not really the optimal solution.. There is no such thing as AC support, its going to have limited range.. Its much better to place a AP where you need it, etc.

kipTry

OK. Anyway, I can research about Mini-ITX with more NICs. But, is there any issue with sharing a NIC for LAN and DMZ (I mean in real world)?.

Why a PCIe wi-fi Adapter can't provide a good performance?.

Thanks a lot! ;)

johnpoz

Sorry but a card in your router is not best place for a AP be it the card works or not.. How many antennas does it have? 3x3 streams? Cards in routers don't make good AP period.. END OF STORY!!

If you want some crappy wifi connection that you could get by buying a 20$ soho router off the street have fun..

Guest

OK. Anyway, I can research about Mini-ITX with more NICs. But, is there any issue with sharing a NIC for LAN and DMZ (I mean in real world)?.

No there would be no plroblems to share the on board GB LAN Ports for using anything in your direction
or plain for what you want it to use. Supermicro is offering a huge amount of Intel Atom C2758 boards
that would fit your needs. From my point of view the best option you have at the moment to get a really
flavor running and electric saving box for your home. For sure the SG units from the pfSense Store are
also really wicked based on the circumstance that they will be owing 3 miniPCIe slots.

Why a PCIe wi-fi Adapter can't provide a good performance?.

WiFi is not really good supported under FeeBSD or plain all BSD systems and pfSense is
based on FreeBSD 10.1! So better to get a WLAN AP to get better results.

kipTry

OK. So, finally I'm going to do this:

Mini-ITX with 2 NICS
NIC1: WAN
NIC2: Switch
Switch Port1: WLAN AP
Switch Port2-PortX: LAN
Switch PortN: DMZ (I'm going to connect just a raspberrypi)

to do this, I need to pay attention to any special features of the switch or the wlan ap?

Thanks!

Derelict

The switch will need to be at least "web smart" meaning it will need to support 802.1q VLANs.

The AP can be pretty much anything, but if you want to support multiple SSIDs on multiple VLANs it will need to support that feature. Any Ubiquiti UAP will do. Your decision on what frequency bands/modulations you want to support.

Guest

to do this, I need to pay attention to any special features of the switch or the wlan ap?

Both should be supporting VLANs as you where told before, I see it right also.
A tiny Netgear GS105Ev2 for around $30 will do the job right for you, if more ports are needed
and you know it until today a GS108Ev3 with 8 GB LAN Ports will do the job also for $40.

Connect like you where drawing and all is running, why a DMZ connect the NAS an its ok.
Usually a DMZ would be owning another different IP subnet as the LAN owns.

kipTry

I will choose one of these:

TP-LINK TL-SG108E (8 Ports, $20) http://www.amazon.com/TP-LINK-TL-SG108E-8-Port-Gigabit-Tag-Based/dp/B00K4DS5KU/ref=sr_1_3?s=pc&ie=UTF8&qid=1437388589&sr=1-3&keywords=switch+vlan&refinements=p_n_feature_keywords_two_browse-bin%3A7306160011%7C7306161011%2Cp_36%3A-5000&pebp=1437388591690&perid=0X9XJ04RYZ3ESEGV1GAY
NETGEAR ProSAFE GS105Ev2 (4 ports, $39) http://www.amazon.com/NETGEAR-ProSAFE-GS105Ev2-5-Port-Gigabit/dp/B00HGLVZLY/ref=sr_1_8?s=pc&ie=UTF8&qid=1437388589&sr=1-8&keywords=switch+vlan&refinements=p_n_feature_keywords_two_browse-bin%3A7306160011%7C7306161011%2Cp_36%3A-5000

I'm looking for the AP. The cheaper one that I found is TP-LINK TL-WA801ND ($24) http://www.amazon.com/TP-LINK-TL-WA801ND-Wireless-300Mbps-Repeater/dp/B004UBU8IE/ref=sr_1_12?s=pc&ie=UTF8&qid=1437389758&sr=1-12&keywords=access+point&refinements=p_36%3A2000-5000%2Cp_n_feature_keywords_two_browse-bin%3A6569831011%7C6569833011%7C6569829011

Usually a DMZ would be owning another different IP subnet as the LAN owns.

I will configure a VLAN "for each" port:
Switch Port1: AP -> VLAN1 (normal users) and VLAN2 (guests). So, I need mapping VLAN1-SSID1 and VLAN2-SSID2.
Switch Port2-PortX: LAN -> VLAN3
Switch PortN: DMZ -> VLAN4

Thanks!