Re: [pfSense] Access Point config: separating guest from permissible users

[Antonio]

Interesting! Does this mean that by disabling the WAN port on the DD-WRT
device and getting it to act as switch, then the pfSense router device
actually sees multiple network domains on the same LAN port? I guess
this is probably due to the fact that I don't understand VLANs ...

Currently, I have LAN port on pfSense device set to 192.168.2.2 and WAN
port on DD-WRT set on 192.168.2.3. The wireless network is set on
192.168.3.X.

From what I understand from your guide, it would seem that you have
created virtual wireless networks (wl0.1, wll0.2) in STEP 2, then you
activate VLAN 5 and 15 and assign them to the WLAN port, then you create
the bridges which tells DD-WRT to assign wl0.1 to VLAN 15 via bridge 1
and wl0.2 to VLAN 5 via bridge 2. Correct? This seems to be quite
powerfull but I guess the art is actually happening on the router
(pfSense) where you have to craft the firewall rules correctly or the
there could be problems. Is this where jmitchel's answer can help?

Thanks for your help both, much appreciated.
Antonio

--
Respect your privacy and that of others, don't give your data to big 
corporations.
Use alternatives like Signal (https://whispersystems.org/) for your messaging 
or 
Diaspora* (https://joindiaspora.com/) for your social networking.


Il 11/03/2018 01:47, Moshe Katz ha scritto:
> The most reliable way to do it is to set up two VLANs for your
> wireless, with your Home network on one of them and your Guest network
> on the other, and to configure the firewall rules in pfSense for the
> LAN-LAN traffic.
>
> DD-WRT officially supports VLAN tagging (802.1q), but it only works on
> some hardware. On other hardware, you need to use "Port-based" VLANs,
> which would probably require an additional LAN port to be configured
> on your pfSense.
> Here are instructions for "Port-based" VLAN configuration, with an
> example that uses three
> networks: 
> https://community.spiceworks.com/how_to/32549-ddwrt-multiple-ssids-with-vlans
>
>
> NOTE: I do not currently have hardware that is running DD-WRT at home,
> so I am writing this from memory (and from links to resources I have
> used in the past).
>
> Also, note that you don't need to use the separate 2.4Ghz and 5Ghz
> radios in order to do this. Most hardware supports running multiple
> SSIDs (a.k.a. WiFi network names) on a single band, so you could have
> both of your WiFi networks on both bands - 5Ghz for performance and
> 2.4Ghz for longer range. Most modern dual-band devices will
> automatically pick the best oft eh two signals.
>
> --
> Moshe Katz
> -- mo...@ymkatz.net 
> -- +1(301)867-3732
>
> On Sat, Mar 10, 2018 at 6:54 PM, Antonio  > wrote:
>
> Hi pfSense experts,
>
> I was hoping you could help me with a config questions. I have pfSense
> configured as main routed for my network. The WAN is connected to DSL
> modem, one LAN on a ethernet switch and another LAN port on a Netgear
> R8000 with dd-wrt installed. One of the cool features of the R8000 is
> that it has two seperate wireless networks: 2.4GHz and 5GHz.
>
> I wanted to use one for guest and only allow access to internet while
> the other for permitted users (family members) that would also have
> access to the local network. How am I going to achieve this on pfSense
> though? is it a matter of closing access to local network for all IPs
> coming from the AP except those I want to permit (family devices)
> or is
> there a simpler way of doing this i.e. VLANs?
>
> I look forward to your reponse.
>
> Thank you
>
> --
>
>
> Respect your privacy and that of others, don't give your data to
> big corporations.
> Use alternatives like Signal (https://whispersystems.org/) for
> your messaging or
> Diaspora* (https://joindiaspora.com/) for your social networking.
>
> ___
> pfSense mailing list
> https://lists.pfsense.org/mailman/listinfo/list
> 
> Support the project with Gold! https://pfsense.org/gold
>
>

___
pfSense mailing list
https://lists.pfsense.org/mailman/listinfo/list
Support the project with Gold! https://pfsense.org/gold

[pfSense] SIP Port forwarding - will the SIP Proxy help me with this?

[Moshe Katz]

I have an installation with a single public IP address that uses an
Asterisk PBX connected to a Twilio SIP Trunk. The provider does not offer
additional IP addresses.

Right now, in order for the SIP audio to work, I need to forward UDP ports
1-2 to the PBX since Twilio says media can come on any of those
ports.
However, this breaks the ability of other users on that connection to use
WebRTC media because WebRTC uses that same port range for media.

The only real information that I have found discussed in the past is about
using sipproxd in the case of having multiple SIP devices inside the
firewall to allow all of them to use port 5060 (SIP signaling) and have the
firewall rewrite the SIP traffic for each one.

However, I can't seem to find any information about my use-case of a single
SIP device and not having to forward the ports for the media.
Can sipproxd help me with that?
Any other ideas?

Thanks,
Moshe

--
Moshe Katz
-- kohenk...@gmail.com
-- +1(301)867-3732
___
pfSense mailing list
https://lists.pfsense.org/mailman/listinfo/list
Support the project with Gold! https://pfsense.org/gold

Re: [pfSense] Access Point config: separating guest from permissible users

[Moshe Katz]

The most reliable way to do it is to set up two VLANs for your wireless,
with your Home network on one of them and your Guest network on the other,
and to configure the firewall rules in pfSense for the LAN-LAN traffic.

DD-WRT officially supports VLAN tagging (802.1q), but it only works on some
hardware. On other hardware, you need to use "Port-based" VLANs, which
would probably require an additional LAN port to be configured on your
pfSense.
Here are instructions for "Port-based" VLAN configuration, with an example
that uses three networks:
https://community.spiceworks.com/how_to/32549-ddwrt-multiple-ssids-with-vlans


NOTE: I do not currently have hardware that is running DD-WRT at home, so I
am writing this from memory (and from links to resources I have used in the
past).

Also, note that you don't need to use the separate 2.4Ghz and 5Ghz radios
in order to do this. Most hardware supports running multiple SSIDs (a.k.a.
WiFi network names) on a single band, so you could have both of your WiFi
networks on both bands - 5Ghz for performance and 2.4Ghz for longer range.
Most modern dual-band devices will automatically pick the best oft eh two
signals.

--
Moshe Katz
-- mo...@ymkatz.net
-- +1(301)867-3732

On Sat, Mar 10, 2018 at 6:54 PM, Antonio  wrote:

> Hi pfSense experts,
>
> I was hoping you could help me with a config questions. I have pfSense
> configured as main routed for my network. The WAN is connected to DSL
> modem, one LAN on a ethernet switch and another LAN port on a Netgear
> R8000 with dd-wrt installed. One of the cool features of the R8000 is
> that it has two seperate wireless networks: 2.4GHz and 5GHz.
>
> I wanted to use one for guest and only allow access to internet while
> the other for permitted users (family members) that would also have
> access to the local network. How am I going to achieve this on pfSense
> though? is it a matter of closing access to local network for all IPs
> coming from the AP except those I want to permit (family devices) or is
> there a simpler way of doing this i.e. VLANs?
>
> I look forward to your reponse.
>
> Thank you
>
> --
>
>
> Respect your privacy and that of others, don't give your data to big
> corporations.
> Use alternatives like Signal (https://whispersystems.org/) for your
> messaging or
> Diaspora* (https://joindiaspora.com/) for your social networking.
>
> ___
> pfSense mailing list
> https://lists.pfsense.org/mailman/listinfo/list
> Support the project with Gold! https://pfsense.org/gold
>
___
pfSense mailing list
https://lists.pfsense.org/mailman/listinfo/list
Support the project with Gold! https://pfsense.org/gold

Re: [pfSense] Access Point config: separating guest from permissible users

[jmitchel]

On 2018-03-10 18:54, Antonio wrote:

Hi pfSense experts,

I was hoping you could help me with a config questions. I have pfSense
configured as main routed for my network. The WAN is connected to DSL
modem, one LAN on a ethernet switch and another LAN port on a Netgear
R8000 with dd-wrt installed. One of the cool features of the R8000 is
that it has two seperate wireless networks: 2.4GHz and 5GHz.

I wanted to use one for guest and only allow access to internet while
the other for permitted users (family members) that would also have
access to the local network. How am I going to achieve this on pfSense
though? is it a matter of closing access to local network for all IPs
coming from the AP except those I want to permit (family devices) or is
there a simpler way of doing this i.e. VLANs?

I look forward to your reponse.

Thank you

Hello,

The simple answer is to configure the dd-wrt box to give different IP 
addresses to the two separate wireless bands. Let's say you make the 
2.4Ghz band 192.168.24.0/24 and the 5Ghz band 192.168.5.0/24. (I'm 
assuming you'll use the 5Ghz band for family members, just to make 
things easy for me). You then write firewall rules that allow 
192.168.5.0/24 to access the LAN and WAN while 192.168.24.0/24 can only 
access the WAN. The easiest way for the first set of rules is to block 
access to 192.168.24.0/24 from 192.168.5.0/24 (your trusted users). And 
the easiest way for the second set of rules is to block all traffic to 
RFC 1918 address. So block all access to 10.0.0.0/8, 172.16.0.0/22, & 
192.168.0.0/16. You could be specific, but if you don't want the guests 
to be able to access anything but the Internet, then it's easier just to 
block all private address. That way if you change something elsewhere on 
your network, you won't have to mess with the firewall rules for the 
wireless.


Of course dd-wrt can do firewalling on its own, so (assuming you could 
assign different IP ranges to the different wireless networks) you could 
do the firewalling there. And in my example it's important for dd-wrt to 
act as a bridge. If it's a router, you would have to set up firewalling 
there to prevent your guests from connecting to trusted computers 
(prevent the two wireless networks from talking to each other). If you 
can't get dd-wrt to do that, I'd do the firewalling there.


Hope this helps.

Jason M.
___
pfSense mailing list
https://lists.pfsense.org/mailman/listinfo/list
Support the project with Gold! https://pfsense.org/gold

[pfSense] Access Point config: separating guest from permissible users

[Antonio]

Hi pfSense experts,

I was hoping you could help me with a config questions. I have pfSense
configured as main routed for my network. The WAN is connected to DSL
modem, one LAN on a ethernet switch and another LAN port on a Netgear
R8000 with dd-wrt installed. One of the cool features of the R8000 is
that it has two seperate wireless networks: 2.4GHz and 5GHz.

I wanted to use one for guest and only allow access to internet while
the other for permitted users (family members) that would also have
access to the local network. How am I going to achieve this on pfSense
though? is it a matter of closing access to local network for all IPs
coming from the AP except those I want to permit (family devices) or is
there a simpler way of doing this i.e. VLANs?

I look forward to your reponse.

Thank you

-- 


Respect your privacy and that of others, don't give your data to big 
corporations.
Use alternatives like Signal (https://whispersystems.org/) for your messaging 
or 
Diaspora* (https://joindiaspora.com/) for your social networking.

___
pfSense mailing list
https://lists.pfsense.org/mailman/listinfo/list
Support the project with Gold! https://pfsense.org/gold