0
I have a firewall (Pfsense). I have a managed switch (TP Link TL-SG108E.) I have a wireless access point (TP Link TL-WA801ND.)
The firewall (Pfsense) has 1 Ethernet port with four sub interfaces.
- em0.10 disabled - will be DHCP client after testing
- em0.20 192.168.0.1/25 (Network 192.168.0.0/25 [126 host addresses])
- em0.30 192.168.0.129/25 (Network 192.168.0.128/25 [126 host addresses])
- em0.40 disabled - will be 10.0.0.1/30 (Network 10.0.0.0/30 [2 host addresses]) after testing
The managed switch (TL-SG108E) is configured to operate on 4 corresponding 802.1Q VLANs:
- VLAN 10 (INTERNET)
- VLAN 20 (PRIVATE)
- VLAN 30 (GUEST)
- VLAN 40 (PUBLIC)
The wireless access point (TL-WA801ND) is set to Multi-SSID mode with VLANs enabled. There are two SSIDs configured:
- SSID-Private - VLAN 20
- SSID-Guest - VLAN 30
Here is a list of hardware plugged into the 8 port managed switch (TL-SG108E):
- unplugged - will plug in modem after testing
- Firewall (Pfsense)
- Wireless access point (TL-WA801ND)
- Router with successful internet connection.
- PRIVATE vlan hosts
- PRIVATE vlan hosts
- PRIVATE vlan hosts
- unplugged - will plug in web server after testing
Here are the VLAN settings for each of the ports on the managed switch (TL-SG108E):
- PVID 10 | VLANs: [10-untagged]
- TRUNK - PVID 1 | VLANs: [10-tagged], [20-tagged], [30-tagged], [40-tagged]
- TRUNK - PVID 1 | VLANs: [20-tagged, 30-tagged]
- PVID 20 | VLANs: [20-untagged]
- PVID 20 | VLANs: [20-untagged]
- PVID 20 | VLANs: [20-untagged]
- PVID 20 | VLANs: [20-untagged]
- PVID 40 | VLANs: [10-untagged]
Firewall rules have been set to allow all traffic among all interfaces for testing. I'll lock it down after I figure out how to enable Internet access to my guest SSID.
The hosts on the private network (VLAN 20 192.168.0.0/25) have Internet access and hosts on the guest network (VLAN 30 192.168.0.128/25) do not. The Internet facing router is providing DHCP addresses ending in 50-99 to the private subnet and the firewall (Pfsense) is providing DHCP addresses ending in 150-199 to the guest subnet.
I guess it could be NAT, firewall rules, DNS, or something else but I'm thinking it's probably a misconfiguration on my managed switch - but I'm not sure.
Are there any experts in the house?
what does it give you under (status > interfaces) for the virtual interface em0.30, does it show it as up and moving traffic? also only the first interface designated as lan gets default rules. you may just need to setup a default guest access rule. under firewall > rules > whatever you named em0.30. – Tim_Stewart – 2018-03-02T03:18:07.217
em0.30 is showing in/out packets as 3325/1077. I have the same firewall rule set on both em0.20 and em0.30 which is Proto=IPv4, Source=, SPort=, Destination=, DPort=, Gateway=* Queue=none, Schedule=(none), Description=(none) – Rhyknowscerious – 2018-03-02T05:56:51.947
1Which device is configured to act as the NAT for the Guest network? What is the private (LAN-side) IP address of that NAT gateway? When the firewall serves DHCP to the Guest network, what default gateway IP address is it telling those guest devices to use? – Spiff – 2018-03-02T19:56:10.250
I have a router (Buffalo Airstation N300 with DD-WRT) 192.168.0.2 plugged into the switch at port 4 (VLAN 20). I assumed it did NAT for all the traffic but maybe it's only providing NAT for the 192.168.0.0/25 subnet. I guess I should also check the Pfsense firewall to see if it has any NAT going on as well. Would it be best to setup NAT for all the internal networks on the DD-WRT router? or just add NAT settings for the guest network on the firewall? I don't have much experience setting up NAT rules - especially for multiple VLANS. – Rhyknowscerious – 2018-03-02T21:13:43.477
You would let pfsense(the h/w firewall) handle NAT. On dd-wrt you you go to setup > basic setup > connection type disable. And security > SPI firewall disable. This will turn it into true AP mode, (no routing). I'm not 100% on tp-links definition of a pvid. I looked at a setup guide for that switch using vlans and pvid's and it looked like it was for default port/vlan mapping and it looked like they were matching pvid with vlan. I'm using a very similar setup with my pfsense installations. I used Cisco small business switches though. And just plain port-vlan mappings. – Tim_Stewart – 2018-03-02T21:36:35.927
If I change "setup > basic setup > connection type" to "disable" I'm pretty sure that'll kill my Internet connection to all my subnets, won't it? Pfsense isn't connected to the WAN right now. It's only connected to the private (VLAN 20) and guest (VLAN 30) networks. And isn't the SPI firewall keeping the bad guys from the Internet from coming into the local inter-network? The way I have the WAN setup is like this: ISP --> modem --> DDWRT (WAN port). Then we have DDWRT (LAN port) --> Port 4 on the switch on VLAN 20. Pfsense's Em0.20 is on the same network as the router (subnet 192.168.0.0/25). – Rhyknowscerious – 2018-03-02T22:17:12.587
I'll make a diagram for you when I get home tonight. You don't want it connected like that. When using pfsense with a "router on a stick" configuration you want it as the central/core routing device between all vlans. – Tim_Stewart – 2018-03-02T23:31:36.437
I know it's a weird setup. I'm trying to get it all configured so that I can just move the cable from the router's WAN port to the switch on port 1 (VLAN 10) then remove the DD-WRT router and apply the default firewall rules for Pfsense. Why? So I don't disrupt the private network's Internet access for more than a couple seconds. – Rhyknowscerious – 2018-03-03T00:16:33.653