Netgate SG-1000 microFirewall

Author Topic: Create a guest network with VLAN tag 1003  (Read 1206 times)

0 Members and 1 Guest are viewing this topic.

Offline wgstarks

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +0/-0
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #15 on: December 30, 2017, 10:27:24 pm »
Why are you creating a VLAN for desktops etc.?  Normally, those don't need a VLAN, so you'd have to set up access ports on VLAN 10.  Also, each VLAN in pfSense appears as a separate logical interface, which you'd use as any other interface.  The rules etc., will depend on what you want to do.
When I set those vlans up I was using a guide that I modified slightly to meet my needs. That’s all up and running except for the guest WiFi. I’m just not sure what I need to do to get pfSense to read the tags. Is this done in the background or do I need to configure a rule to match the packets with the 1003 tag to my guest network?

pfSense vs 2.4.3
Box: Minisys IBOX-501 N10E
CPU: Intel Atom E3845
NIC: Intel WG82583 1000M x 4
RAM: 8GB

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10258
  • Karma: +1176/-313
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #16 on: December 31, 2017, 01:19:48 am »
Create a VLAN 1003 on the physical interface to your switch (using eth0 below as an example).

Assign an interface to that VLAN 1003 on eth0 interface.

Create appropriate firewall rules, DHCP services, etc on that interface.

Everything transmitted by that interface will be tagged with 1003. Everything arriving tagged 1003 will be processed by that interface.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Michel-angelo

  • Jr. Member
  • **
  • Posts: 38
  • Karma: +0/-1
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #17 on: December 31, 2017, 04:23:01 am »
I’m attempting to get my guest network setup on my Airport Extremes and this thread has been very helpful but a couple of things I’m not sure about.

I’m using a Netgear GS724Tv2 switch to create the vlans MAIN_VLAN10 (pvid10) for all my desktops, printers and servers and WIFI_VLAN20 (pvid20) for the Airports. If I’m understanding correctly the Airports will tag guest traffic with 1003?
I will just clarify the airport Extreme (or Express, or time Capsule) side.
When used as a router, an Airport Extreme (and the other new Airport base stations) will be able to *create a guest network by VLAN tagging, assigning the Vlan tag 1003 to packets going to the guest network (ethernet or wireless).
When used as a wifi simple access point, an airport Extreme base station will recognise packets Vlan tagged 1003 and be able to send them to the wireless guest network.
Given that your airport base stations are wifi access points and not routers, none of them will do the Vlan tagging. But they will need it. You need to do it on your guest interface in the pfSense router. pfSense > Interfaces > VlanAssignment > Vlans. I attach a copy of my setup. HTH

Offline wgstarks

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +0/-0
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #18 on: December 31, 2017, 07:05:52 am »
Create a VLAN 1003 on the physical interface to your switch (using eth0 below as an example).

Assign an interface to that VLAN 1003 on eth0 interface.

Create appropriate firewall rules, DHCP services, etc on that interface.

Everything transmitted by that interface will be tagged with 1003. Everything arriving tagged 1003 will be processed by that interface.
Outstanding. That's what I thought. Just wanted to be sure.
pfSense vs 2.4.3
Box: Minisys IBOX-501 N10E
CPU: Intel Atom E3845
NIC: Intel WG82583 1000M x 4
RAM: 8GB

Offline wgstarks

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +0/-0
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #19 on: December 31, 2017, 07:19:27 am »
Given that your airport base stations are wifi access points and not routers, none of them will do the Vlan tagging. But they will need it. You need to do it on your guest interface in the pfSense router.
This is all fairly new to me, but I don"t see how this could be? You are able to login to the wifi guest network and also into the regular network that you have setup right? The Airport must have some way to distinguish between the 2 different wifi networks. I would think that the Airport must be applying tags to all traffic entering the guest network via wifi. Of course there's always the chance that I'm completely wrong.  :D
pfSense vs 2.4.3
Box: Minisys IBOX-501 N10E
CPU: Intel Atom E3845
NIC: Intel WG82583 1000M x 4
RAM: 8GB

Online johnpoz

  • Hero Member
  • *****
  • Posts: 15744
  • Karma: +1470/-210
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #20 on: December 31, 2017, 09:11:54 am »
My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..

https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs

- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.3-RELEASE (work)
1x SG-3100 2.4.3-RELEASE (work)
1x SG-4860 2.4.3-RELEASE (home)

Offline wgstarks

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +0/-0
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #21 on: December 31, 2017, 10:27:04 am »
My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..

https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs
Thanks. I think I’ve kinda got my head wrapped around the basics of the tag routing now. Having a family day today, but I’ll give it a shot tomorrow and see if I can get it to work.

Thanks to everyone for your help so far.
pfSense vs 2.4.3
Box: Minisys IBOX-501 N10E
CPU: Intel Atom E3845
NIC: Intel WG82583 1000M x 4
RAM: 8GB

Offline wgstarks

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +0/-0
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #22 on: January 01, 2018, 05:12:38 pm »
My understanding is the guest network on a airport will be tagged 1003.. You need to setup your switching and pfsense correctly to understand that tag..

https://www.thegeekpub.com/5191/use-airport-extreme-guest-network-bridge-mode/
The Airport Extreme Guest Wireless network can be used with almost any other brand of router as your main router, as long is it supports VLANs
Thanks. I think I’ve kinda got my head wrapped around the basics of the tag routing now. Having a family day today, but I’ll give it a shot tomorrow and see if I can get it to work.

Thanks to everyone for your help so far.
Well that didn't turn out too good. I created a VLAN10 (pvid 10) on my switch with associated ports tagged. Created VLAN10_MAIN on my firewall for approved laptops and other wireless devices and created VLAN1003_Guest for guest use.


VLAN1003 should have no access to local network. Only internet. I believe that's working.




VLAN10 needs to have full access to the local network as well as the internet. I can get access to the internet but not the local network.



I'm hoping I've just missed a rule or misconfigured one?
pfSense vs 2.4.3
Box: Minisys IBOX-501 N10E
CPU: Intel Atom E3845
NIC: Intel WG82583 1000M x 4
RAM: 8GB

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10258
  • Karma: +1176/-313
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #23 on: January 01, 2018, 05:52:27 pm »
No way to know without knowing what that LOCAL_NETWORKS Alias and those port aliases are. Those rules don't make much sense.

What are you trying to do here?

I personally despise "blocking" traffic with pass ! rules. Hate it. Loathe it. Wish it would die in a fire.

If you want to block it, just block it. Then pass any.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline wgstarks

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +0/-0
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #24 on: January 01, 2018, 07:45:07 pm »
No way to know without knowing what that LOCAL_NETWORKS Alias and those port aliases are. Those rules don't make much sense.

What are you trying to do here?

I personally despise "blocking" traffic with pass ! rules. Hate it. Loathe it. Wish it would die in a fire.

If you want to block it, just block it. Then pass any.

local_subnets


These rules aren't mine really. Straight from a guide. Would be glad for any suggestions to simplify them.

As far as what I want to accomplish. I have 2 airports that are configured with a WPA2 “Home Network” which works and a “Guest Network” which shows “no internet”. I’m trying to setup a vlan that will allow guest connections to DHCP server and WAN only, without interfering with the “Home Network” which needs full access to local networks.
pfSense vs 2.4.3
Box: Minisys IBOX-501 N10E
CPU: Intel Atom E3845
NIC: Intel WG82583 1000M x 4
RAM: 8GB

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10258
  • Karma: +1176/-313
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #25 on: January 01, 2018, 07:49:19 pm »
Just because it's in a "guide" doesn't mean it's correct.

You only gave half the picture. What destination ports are you passing?
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline wgstarks

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +0/-0
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #26 on: January 01, 2018, 07:56:46 pm »
Just because it's in a "guide" doesn't mean it's correct.

You only gave half the picture. What destination ports are you passing?

Not sure what you mean by destination ports?
pfSense vs 2.4.3
Box: Minisys IBOX-501 N10E
CPU: Intel Atom E3845
NIC: Intel WG82583 1000M x 4
RAM: 8GB

Offline wgstarks

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +0/-0
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #27 on: January 01, 2018, 08:22:40 pm »
Just because it's in a "guide" doesn't mean it's correct.

You only gave half the picture. What destination ports are you passing?

Not sure what you mean by destination ports?

Guess I'm a little slow tonight.:)





pfSense vs 2.4.3
Box: Minisys IBOX-501 N10E
CPU: Intel Atom E3845
NIC: Intel WG82583 1000M x 4
RAM: 8GB

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10258
  • Karma: +1176/-313
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #28 on: January 02, 2018, 11:12:11 am »
I would disable those rules and add a pass any any rule. Does it work? Then you are not passing traffic you need to pass.

You do realize that you will be unable to ping with that configuration because it is not passed, right?

I can be confident that pfSense is behaving exactly as it is being instructed to behave.

Check the firewall logs for what is being blocked and evaluate whether it should be passed and pass it or don't.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline wgstarks

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +0/-0
    • View Profile
Re: Create a guest network with VLAN tag 1003
« Reply #29 on: January 02, 2018, 12:02:23 pm »
I would disable those rules and add a pass any any rule. Does it work? Then you are not passing traffic you need to pass.
Thanks. Makes a lot of sense. Maybe one of these days I’ll learn to quit following these online step-by-step guides.🙄
pfSense vs 2.4.3
Box: Minisys IBOX-501 N10E
CPU: Intel Atom E3845
NIC: Intel WG82583 1000M x 4
RAM: 8GB