pfSense Support Subscription

Author Topic: Home network to keep wife happy + VPN (TV 4k netflix) + reduce intranet downtime  (Read 4550 times)

0 Members and 1 Guest are viewing this topic.


Offline ChefRayB

  • Jr. Member
  • **
  • Posts: 67
  • Karma: +8/-0
    • View Profile
Update:

- Managed to play with a L2 Smart switch TL-SG2008 !  ( Big huge thank you to DennyPage)
- Did more reading and played with a switch

Can someone help me in validating the below:   ( Johnpoz, if you have time)

Network Design Summary:
- Create 4x vlans
- Each vlan has access to all other vlan (All ports in each vlan are untagged for each vlan with the exception of trunk of course )
- Each vlan shares the same subnet, meaning they can communicate with each other inside the same smart switch (arp should work) 
- Each vlan has DHCP server assigned to a specifc IP range
- Configure the router to route certain IP range through OpenVPN rather WAN(ISP)

I have 3 question bugging me

#1 Since all 4x vlans are sharing the same subnet and each vlan has access to each port on the switch, technically all machines can communicate to each other without routing ? Correct?

#2 In this design (vlan sharing same subnet), the only purpose of the VLAN is to allocate DHCP IP address so that I can route an IP range between ISP or OpenVPN at the router level (pfsense).  Feasible ? Will I end up with problems down the road ?

#3 If I enable IGMP Snooping on each VLAN,  I reduce broadcasting noise when devices are streaming data because only the devices subscribed will receive the packets on the port on the L2 smart switch.  Correct ?   (Is it really worth doing it if you have a few devices on gigabit switch ?)


thanks

Ray




Offline ChefRayB

  • Jr. Member
  • **
  • Posts: 67
  • Karma: +8/-0
    • View Profile
Update:  Just received qotom hardware today!


#2 In this design (vlan sharing same subnet), the only purpose of the VLAN is to allocate DHCP IP address so that I can route an IP range between ISP or OpenVPN at the router level (pfsense).  Feasible ? Will I end up with problems down the road ?

I just tried it, it says IPV address xxx.xxx.xxx.xxx is being used by or overlaps with VLAN xxx.xxx.xxx.xxx/subnet.
This means I can't use VLAN just for DHCP allocation ips but have all the VLANs share the same subnet.

I feel I am writing a blog here....

Anybody can comment, am I trying to find a solution to something that isn't really possible ?


Offline coxhaus

  • Full Member
  • ***
  • Posts: 157
  • Karma: +1/-3
    • View Profile
I think what you are building is complicated and you are going to have figure it out as you go.  Personally I think it much easier to build VLANs if you assign a network to every VLAN.  Also to better support multiple devices it is better to use tagged VLANs rather untagged. Only use untagged for the default VLAN. When you use a trunk only one VLAN untagged can pass and that is the default VLAN.  I think you are going to find Apple and probably Sonos are not going to route so you will compromise your setup to fit within these rules.

Personally I think a layer 3 switch works better when you use VLANs.  You can turn off your router and everything in your local network still works locally.  Watching TV off a NAS no problem, still works.

I run pfsense using a Cisco SG300-28 layer 3 switch in L3 mode.  So I kind of know what you are building.

Offline ChefRayB

  • Jr. Member
  • **
  • Posts: 67
  • Karma: +8/-0
    • View Profile
I think what you are building is complicated and you are going to have figure it out as you go.  Personally I think it much easier to build VLANs if you assign a network to every VLAN.  Also to better support multiple devices it is better to use tagged VLANs rather untagged. Only use untagged for the default VLAN. When you use a trunk only one VLAN untagged can pass and that is the default VLAN.  I think you are going to find Apple and probably Sonos are not going to route so you will compromise your setup to fit within these rules.

Hi Coxhaus,

I think you've perfectly summarized the problem and I've came to a very similar conclusion.  I lack experience & knowledge, therefore it takes me a bit more time because I need to play around with hardware (e.g. L2 smart switch) to really grasph it's limitation and flexibility.

I am breaking down my home project in 2 phases:

Phase 1: Pfsense (VLANs, uPnP, IGMP proxy, firewall, routing, OpenVPN) + L2 Smart Switch (IGMP snooping if required)
Phase 2: Replace main switch with L3/L2 and only use pfsense for firewall/OpenVPN/routing.

Personally I think a layer 3 switch works better when you use VLANs.  You can turn off your router and everything in your local network still works locally.  Watching TV off a NAS no problem, still works.

I run pfsense using a Cisco SG300-28 layer 3 switch in L3 mode.  So I kind of know what you are building.

Yeah that' my ultimate destination.  It will be an interesting journey that will take me many months to get there.

Until today, arp -a is my best friend command !  Loving it :)


Offline coxhaus

  • Full Member
  • ***
  • Posts: 157
  • Karma: +1/-3
    • View Profile
You may find phase 1 may be all you need.  You are going to able accomplish everything with an L2 switch except you won't be able to turn off pfsense and have your local network work as there is no layer 3 device to route local traffic locally.  The other thing is all your network setup will be in 1 place.  I like my setup spread out as it is easier to work on for me.  I do router things on the router, I do switch things on the switch and I do wireless on the wireless devices. To me it is much simpler that way. 

Offline ChefRayB

  • Jr. Member
  • **
  • Posts: 67
  • Karma: +8/-0
    • View Profile

Agree in principle, breaking down each component makes it simple.

Spent a few hours on IGMP Proxy and wasn't able to get it working, doesn't seem to work across VLANs.

This will take much more time than expected.

Reading on Cisco SG300-10



Offline coxhaus

  • Full Member
  • ***
  • Posts: 157
  • Karma: +1/-3
    • View Profile
I seen some the Cisco SG300-10 cheap on eBay.  If you buy one flash it to the latest firmware before you set it up.  Download the latest software from Cisco for the small business switches as it is free.  It is the reason I run Cisco small business devices instead of the IOS Pro Cisco gear which is not free software.   

One other thing is start in L3 mode otherwise you will wipe out your config when you move over to L3 from L2.

Offline ChefRayB

  • Jr. Member
  • **
  • Posts: 67
  • Karma: +8/-0
    • View Profile

I have been reading exactly the same thing on the forum, it's the top 2 tips everyone suggest !  (1- Upgrade latest firmware 2-Activate L3 right away  3- Don't forget to click save or else next reboot it's gone)

Will it be easy activating IGMP Proxy across 2 VLANs ? ( IGMP Proxy in pfsense doesn't seem easy)

I was thinking of SG300-10P so that I can use 2 ports with FOSCAM, I checked the specs, the P, PP, MP and MPP use 13 watts minimum compared to 10 using 10 watts.



Reference:

http://www.cisco.com/c/en/us/products/collateral/switches/small-business-smart-switches/data_sheet_c78-610061.html


SG-300-10P = 62watts
SG-300-10PP = 62watts (POE+ Supported)
SG-300-10MP = 124watts
SG-300-10MPP = 124watts (POE+ Supported)

SG300-10P 62 Watts 8 802.3af
SG300-10PP 62 Watts 8 802.3at
SG300-10MP 124 Watts 8 802.3at
SG300-10MPP 124 Watts 8 802.3at

SG300-10P 104 degrees Fahrenheit (40 Centigrade)
SG300-10PP 113 degrees Fahrenheit (45 Centigrade)
SG300-10MP 104 degrees Fahrenheit (40 Centigrade)
SG300-10MPP 113 degrees Fahrenheit (45 Centigrade)
SG300-10SFP 113 degrees Fahrenheit (45 Centigrade)

SG300-10P 62 Watts 8 802.3af
SG300-10PP 62 Watts 8 802.3at
SG300-10MP 124 Watts 8 802.3at
SG300-10MPP 124 Watts 8 802.3at

SG300-10P
Energy Detect Short Reach
110V=13.13W
220V=13.48W
110V=81.44W
220V=81.16W
277.87
 
SG300-10PP
Energy Detect Short Reach
110V=13.37W
220V=12.99W
110V=83.47W
220V=81.58W
278.36
 
SG300-10MP
Energy Detect Short Reach
110V=12.21W
220V=12.25W
110V=154.36W
220V=152.42W
526.68
 
SG300-10MPP
Energy Detect Short Reach
110V=13.41W
220V=13.72W
110V=145.7W
220V=144.5W
493.05
 


Offline coxhaus

  • Full Member
  • ***
  • Posts: 157
  • Karma: +1/-3
    • View Profile
I don't use ICMP Proxy so you will need to figure it out.  There is a drop down for it in the menus.  What are you going to use it for?  I think you are going to run out of ports before you have to have it. So your multicast hits a few extra ports. You only have 10 ports.

I like I said this is stuff you are going to have to figure out as you go.

I would go for a SG300-10 switch without power. 
« Last Edit: June 05, 2017, 10:16:22 pm by coxhaus »

Offline ChefRayB

  • Jr. Member
  • **
  • Posts: 67
  • Karma: +8/-0
    • View Profile
Let's say I would buy SG300-10PP (PoE+),  I would install 1 AP Ubiquiti AC PRO (PoE+) and perhaps 1 IP CAM (PoE) to put near my living room TV stand.  Isn't having PoE+ for AP is practical, less wires visible when you put the AP on  wall along door frame (I don't own a house).  My current TV stand has over 15+ power adapters...  it's getting scary ! :-[

To compensate the lost of 2 ports on SG300-10,  I would bundle a few common devices together (e.g. TV, Android Box, Xbox, Nintendo Wii) under 1 port by using my smart switch since I can only operate 1 device at the time anyways)

On ebay  SG300-10 is ~120 USD and SG300-10PP is ~200 USD. I figure spending the extra $80 is worth it considering  buying a separate PoE Adapter cost $30 each. :-\  :-\   :-\

After I get this working, I am eyeing Ubiquiti AC PRO (multiple SSDIs)  for holidays 2017 :D

Loosing patience with pFsense IGMP Proxy !

Care to share your home setup ?

Offline coxhaus

  • Full Member
  • ***
  • Posts: 157
  • Karma: +1/-3
    • View Profile
I still don't see why you need IGMP proxy?  How are you using it?

Offline ChefRayB

  • Jr. Member
  • **
  • Posts: 67
  • Karma: +8/-0
    • View Profile
Sorry, I miss understood your question.

For IGMP Proxy, I would have multiple VLANs sharing  Media Streams:

- Synology DLNA (Server), Synology Plex Server (server)
- Sonos (server), Windows Media Center (client, server)
- Android TV Box (Client),
- Android Tablet & Mobile Phone (client), 
- TV (Client)

In the future....year 2018-2019.... I was thinking Google TV, Free 2 air HDTV channels (get a antenna + tuner card + Android TV Box)... Perhaps in 2019 everything will be in the cloud and I don't need to do anything anymore.... :)


Online johnpoz

  • Hero Member
  • *****
  • Posts: 14299
  • Karma: +1330/-193
  • Not a pfSense employee, they cannot fire me...
    • View Profile
You don't need igmp proxy to share media across subnets..  You only need that for shitty apps that don't understand that people might have more than one L2..

As to to the L3 advice of sg300.. Makes zero sense to me to be honest, I have mine in L2 mode.. Since not planning on using L3 mode..  If I did switch it and lost the config - what would it really matter?  Since I would be switching to L3 vs L2.. would be a different config, etc.

if you have devices that need to be on the same L2 for some feature - then put them on the same L2..
« Last Edit: June 06, 2017, 05:24:23 am by johnpoz »
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.3.4_p1 (work)
1x 2.4.2-RELEASE on VM esxi 6.5 (home)

Offline ChefRayB

  • Jr. Member
  • **
  • Posts: 67
  • Karma: +8/-0
    • View Profile
You don't need igmp proxy to share media across subnets..  You only need that for shitty apps that don't understand that people might have more than one L2..

Then I  must have shitty apps ?

As to to the L3 advice of sg300.. Makes zero sense to me to be honest, I have mine in L2 mode.. Since not planning on using L3 mode..  If I did switch it and lost the config - what would it really matter?  Since I would be switching to L3 vs L2.. would be a different config, etc.

I believe the whole point of the L3 advice is to let people know that if they intend to use L3 from the get go, suggest to activate L3 feature  before configuring the switch so that they don't need to re-start from scratch.  It's just a heads up / guideline for newbie people. keep in mind some people are doing this as a hobby, it's not daily job, they don't have a strong network background, many people would expect a L3 flag On/Off without loosing the configuration,etc.... 

if you have devices that need to be on the same L2 for some feature - then put them on the same L2..

By putting them on the same L2, then you loose other features that the user (e.g. myself) require...  Perhaps at the end it's not worth doing it and everything will be in 1 subnet...call it a day...time will tell....