Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Configuration Help - Adding 2nd subnet to existing setup

    Scheduled Pinned Locked Moved Routing and Multi WAN
    7 Posts 3 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      indybm
      last edited by

      We currently have pfSense v2.1 with 2 NIC cards (1 for WAN, 1 for LAN).  System works fine.  People connect to 1 of 2 access points in the facility and have access to all the network resources. We use the DHCP in pfSense for ease of user connection configuration with facility equipment given static IP addresses.

      Now we have the need to add a second LAN setup that will be for guest use because the facility will be opened up to various local groups for meetings.

      Our current LAN is 192.168.2.x/24 with the DHCP pool @ 101 - 150, with static mapping of known users @ 151 - 199.

      I would like to change the DHCP pool to 192.168.1.x/24 for guests, and have known users mapped to 192.168.2.x (100 - 199) so they have access to network printers.  The guests will not have access  to the network equipment on 192.168.2.x

      The majority of people that connect to our network also use their devices at other locations so setting them to a static IP is not an option (not a full time IT department for support).

      The hope is that we do not need additional access points (with different SSID/passwords), and by adding the second subnet that by default connects to the guest network (192.168.1.x) will work…then I can map users as needed to static IP address on the 192.168.2.x subnet.

      Trial and error poking around has frustrated me.

      Thanks

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Why do you need to static map for your guest network?  So you can let them print to stuff on your lan?  Just get their mac and setup a reservation so they always get same IP when on your network..

        What AP do you have now?  Do they support vlans?  What switch(es) do you have now - do they support vlans?

        If they do not then you would want/need another nic for pfsense and then another AP for the guest..  Or need to replace your stuff with AP that have vlan support and switch that does as well.  Then you can run your guest wifi on its own vlan, etc.

        Also 2.1 is no longer a supported version..  You really should update..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • I
          indybm
          last edited by

          No- the guests will be DHCP on the 192.168.1.x subnet, while known users will get static reservations on the 192.168.2.x subnet.  Guests will not have any access to printers and such on the 192.168.2.x subnet.

          The 192.168.1.x will just have internet access.

          APs are Linksys & Netgear switches that do not support vlans.

          Was not aware that 2.1 was no longer supported - will look into upgrading.

          Thanks

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            If your just wanting another network segment on pfsense for this guest network, sure any AP will work with any switch that does not even even support vlans as long as you have another interface in pfsense to connect it too.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              You need to separate 192.168.1.0/24 from 192.168.2.0/24 either physically or virtually (VLAN).

              Putting two different layer 3 networks on one layer 2 segment gives you no security at all and is a very clear example of ghetto networking.

              Your best option is probably to get a managed switch and a couple APs capable of Multiple-SSID/VLAN tagging. See Ubiquiti Unifi (Or Ruckus, Aruba, Cisco, Xclaim, etc.)  Maybe DDWRT or OpenWRT.

              https://forum.pfsense.org/index.php?topic=88942.msg491727#msg491727

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • I
                indybm
                last edited by

                Thanks for your replies.

                So after reviewing your help and suggestions, the plan has been revised a bit….Add a 3rd NIC to the box which will be set up for the 1952.168.1.x subnet, replace current AP's with AP's that have dual SSIDs (one for the 1.x and the other for the 2.x subnets).

                One question...is pfSense able to do 2 DHCP servers (one for each subnet) or do I let the AP provide the DHCP for the second subnet?

                Thanks

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  s pfSense able to do 2 DHCP servers (one for each subnet) or do I let the AP provide the DHCP for the second subnet?

                  Yes. pfSense can do one DHCP server per interface.

                  How are you going to connect the APs to two physical ports? What you want to do is usually accomplished with VLANs and managed switches.

                  https://forum.pfsense.org/index.php?topic=88942.msg491700#msg491700

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.