Source
r/PFSENSE•
usb_mouse

Setting up a guest vlan and interfaces

Hi all,

In short, I have an unifi-ap which can broadcast two ssid and want to create a separate network for guests. I don't have a managed switch but my pfsense box has a free port.

To my understanding (and test) the unmanaged switch will allow interaction between the LAN and VLAN even if blocked at the router level, is it right?

In order to prevent buying an extra switch just for this I wanted to connect the AP to the extra port on the pfsense box and configure the interface to block LAN if belonging to the VLAN and pass if it's from the secured "lan wifi"

something like:

wifi_lan → pfsense [opt1]→ lan|wan
wifi_guest (vlan tag) → pfsense [opt1]→  wan
wired_lan → pfsense [lan] → wan|wifi_lan

Does this make sense? Or am I missing something?

Posted Jan 5, 2020, 5:43 AM UTC

246
Dufusite•

Doesn't make sense.

Unifi has features to enforce traffic on the "guest" ssid to be internet only. If you don't want to buy a managed switch, then that is your best bet.

Managed switches capable of Vlans are so cheap nowadays that I would recommend getting one if traffic segregation is a high priority for your network - they greatly simplify things in that regard.

8
julietscause•

and want to create a separate network for guests.

Curious, any reason why you arent using the built in guest portal that unifi has? It has built in rules to stop guest from communicating to your internal network AND client isolation so no guests can talk to each other.

https://help.ubnt.com/hc/en-us/articles/115000166827-UniFi-Guest-Network-Guest-Portal-and-Hotspot-System

You only need to have your controller running 24/7

If you want to pursue this method with the pfsense (i have something similar setup with unifi/pfsense). Keep the LAN port its own subnet. Dont attach any VLANs to it or try to bridge your internal SSID to your LAN port. Add all the VLANs to your OPT1 port.

Create the firewalls rules you want for each vlan/subnet on your pfsense:

For the LAN firewall, will have a deny at the top that block all comms to your guest network and then allow all

So for the internal VLAN, will have a deny at the top that block all comms to your guest network and then allow all

For the guest VLAN, you will have a deny at the top blocking all comms to your internal vlan and another firewall rule that is blocking all comms to your LAN subnet

7
usb_mouseOP•

Thanks, it's really informative.

Honestly, I didn't know they were so many feature with the unifi controller.

why?

I guess I want to learn new stuff and understandings the mechanics of networking, also I don't like the idea of having a non free service running on my network 24/7 I prefer starting it when needed.

Why did you this way?

1
sanujas•

I used the unfi controller sofetare to pushed VLAN info to my AP-LR unit.

In my pfSense I have 2 VLANS. Guest VLAN and IoT VLAN with restrictions. Then I have my regular home internet with no restrictions. All of these networks go through one single LAN interface.

I set up the VLAN IDs, firewall rules for each VLAN on the pfSense. Then on the Unifi Controller software, I created three different wifi connections. Two of which will take the VLAN ids from the pfSense and broadcast Guest and IoT wifi and the other has no VLAN tag filtering. It works without any issues.

Is this what you are trying to do? You don't need a managed switch as long as you setup the VLANs on the AP setup properly using the controller software and pushed it to the AP.

1
usb_mouseOP•

Yep that's what I want to do. Only I don't have an extra iot WiFi.

So you just plug

Unifi ap -> dumb switch -> pfsense LAN

Give a vlan tag to the guest network on the unifi controller then configure the vlan restriction on pfsense ?

1
sanujas•

What I have is guest WiFi networks. No LAN wired connections for guests at the moment. So my setup is Modem --> pfSense --> dumb switch --> Unifi AP (vLANS only on Unifi AP). Anyone connected to the switch directly with LAN will not get VLAN but my home LAN without any restriction.

In the future, I will do Modem --> pfSense --> switch --> LAN with VLANS + Wifi AP

But in my home lab environment, I have a pfSense that goes from Modem --> LAN --> pfSense --> VLANS for testing/learning network stuff.

So.... in summary, I have two pfSense running on my home network. One in production and the other in the LAB.

1