Office Network Design and Planning with VLANs, LLDP, Rules, IoT, Guest using UniFi & pfsense
Vložit
- čas přidán 25. 06. 2019
- Amazon Affiliate Store
➡️ www.amazon.com/shop/lawrences...
Gear we used on Kit (affiliate Links)
➡️ kit.co/lawrencesystems
Try ITProTV free of charge and get 30% off!
➡️ go.itpro.tv/lts
Use OfferCode LTSERVICES to get 5% off your order at
➡️ lawrence.video/techsupplydirect
Tesla Referral Program Offer
🚘 www.tesla.com/referral/thomas...
Lawrence Systems Shirts and Swag
👕 teespring.com/stores/lawrence...
Digital Ocean Offer Code
➡️ m.do.co/c/85de8d181725
HostiFi UniFi Cloud Hosting Service
➡️ hostifi.net/?via=lawrencesystems
Protect you privacy with a VPN from Private Internet Access
➡️ www.privateinternetaccess.com...
Google Fi Service Referral Code
📱g.co/fi/r/TA02XR
More Of Our Affiliates that help us out and can get you discounts!
➡️ www.lawrencesystems.com/partn...
Twitter
🐦 / tomlawrencetech
Patreon
🔗 / lawrencesystems
Our Forums
🔗 forums.lawrencesystems.com/
GitHub
🔗 github.com/lawrencesystems/
Discord
🔗 / discord
Our Web Site
🔗 www.lawrencesystems.com/
PIA Internet Access Affiliates Link
www.privateinternetaccess.com...
Office Network Design and Planning with VLANs, LLDP, Rules, IoT, Guest using UniFi & pfsense. This network was built with the following hardware
UniFi Cloudkey Gen 2
amzn.to/2Yl5skc
Ubiquiti UniFi Switch - 24 Ports Managed (US-24-250W)
amzn.to/2RBCIRr
Ubiquiti Networks Unifi Protect 4K Ubiquiti G4-Pro
amzn.to/2X3msdh
Netgate SG-3100
www.netgate.com/solutions/pfs...
Review of the SG-3100
• Netgate SG-3100 Teardo...
#pfsense #Firewalls - Věda a technologie
I've been in IT for 20 years and this was the most succinct explanation on network design I've seen... well done.
Finally, a video that explains VLANs to actual humans! I wish I had seen it earlier...
Happy this video helped a fellow human.
This "best practice" video tutorial never grows old. I've used it as the basis for several SOHO setups and have never gone wrong with it. It covers all the common types of devices one might want to connect to a SOHO network. I especially like the LLDP-MED port provisioning for connecting VoIP phones having a pass-through network jack for desktop computers. The UI on the Unifi controller may have changed some since this video was made, but the same functionality is still there and this video is still just as relevant as when it came out 4+ years ago.
Thanks
Tom, this is an excellent video and covers a number of configuration consideration I need to address when revamping my home/lab network. I'm a retired systems programmer/Architect for the past 12 years, networking is new to me beyond the basic home router setup. I'm able to use your videos in my education on more complex networking configuration concepts, so, thanks and keep up the great videos.
Regards
Tom, you make it too easy! I can't imagine how much time I would have saved if I had this video when I was starting out. That being said I think I learned more by getting lost and finding my way back. Thank you!
3:45 Interface -> Assignments -> VLANs (Creates IOTCrap VLAN & iface)
6:00 DHCP Server
8:30 Firewall Rules
15:00 Unifi switch VLAN settings
26:15 Shows physical devices and connections
Great setup and great explanation!
I like the fact that you made the LAN into an IT management zone and make the regular users connect to another zone (OFFICE). This way, the pfSense anti-lock out rule will always bring the pfSense UI to the management zone and not back into the user network.
If there is IT staff on-site, they get to have ports to the LAN zone in their office. If there is no IT staff on-site, which is common in small businesses, I use a VPN to get into that zone. Of course, I always keep an available untagged port on that zone (VLAN) on the main switch just in case the VPN fails for some reason and I need a physical access to the management network to repair something.
Tom, I've been watching your channel for a couple months and just wanted to say thanks for all great information, training and tips!!! I have been designing my dream home network for a new house that we are having built. I am starting to test some of the network hardware that I chose with the help and insight of all your experience in IT. I don't always get it the first time but I can't count how many times now I am working on something and think "boy did Tom have that right!" or "that's what he meant by that!". Thanks Tom!!!! And,now I finally joined your CZcams channel and I'm also going to check out your website!
I saw this last November and thought that moving the cameras to a separate VLAN and only allowing it to talk to the NVR from a separate subnet was cool. Did it with our office's hikvision cameras just last week. The unifi switch was a bit iffy when I configured each port in the port manager but managed to get it to work. My boss liked the suggestion so much as I explained that it was a great security measure in case someone outside would disconnect the camera/s and connect it to a laptop or a malicious raspberry pi, but he immediately got the gist of it. Thank you!
Exactly what i’m doing for my customers ))) Good job bro!
Hey Tom, great video. One really important step you missed in the video was creating the networks in the Unifi controller as well. It is not shown in the video and took me ages to work out. Lucky you had an older video from 2017 that should this step. Once I completed this step as well we were away and working perfectly!! Thanks for the amazing content. Keep it up!
Think i just ran into this as well. Lots of detail there that is missing. Presumably about what the VLAN & DHCP settings should be inside the unify controller - but no clue.
Hi Tom, thanks for the great video. I've been trying to get my UniFi cameras on an isolated VLAN for the exact reasons you described. One of the mistakes I had been making was giving the G3 a static IP so when I set the port to the 'video' profile I lost connection to the Protect server. But having watched this I've got it all sorted. Keep up the good work.
This should be the first watch for all that want to tinker with home networks. Tank you Lawrence for taking the time and educating us.
GREAT VIDEO!!! Very informative...keep up the good work Tom
Fantastic. I made some changes to address my particular setup (pfsense as a virtual machine within truenas scale with multiple bridged vlans), but this remains a fantastic resource --- 4 years later. Thank you!
I appreciate ALL of your networking videos. Especially pfsense. Thank you!
Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service
You have made a fan out of me with these type of videos. Keep em coming bud!
Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service
Thank you for doing this Lawrence
Really loved the video! great explanations, nice and easy to follow! something easy to get people thinking!
Tom, this is one of the best explanations of secure networks I have ever seen. Thank You for doing this.
Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service
Lawrence, you have a great full fan from da UP eh! Thanks for the excellent content
Thank you Lawrence that is exactly the same as my network. FYI, one thing that needs to be added is dhcp snooping needs to be disabled on vlans due to bug on usw Mike
Fantastic run through, thank you!
I can’t tell you how much this video has help me. Thanks! And keep it going
Another nice thing to do with Cameras switch ports is they should also be protected by only allowing the Mac address of the camera.
Great video - thank-you! I sat through the whole one to just revisit pfsense tinkering as I haven’t tinkered in a few years. Such great tutorials though and so clearly explained and demonstrated!
Great Vid specially explaining LLDP
It was very informative. Thank you for the video and the work on it.
Thanks for the time and effort.
When creating the pfsense firewall rules on each VLAN you don't need to create a rule blocking access to the firewall's web interface as all traffic is blocked by default unless there is another rule granting access (assuming the default deny configuration has not been changed in the main pfsense settings). In the example used in the video for the locked down VLANs you have a rule granting access to everything other than the private networks. As the pfsense web interface is on the private network, access will still be blocked by default with this rule.
Really great video gives me some ideas for my own home network
Ooh. Just got my sg1100 and erx combo working. It's quite a solid setup for home use. Thanks for the useful reviews. Definitely will use this so my cameras are not flat with my other devices.
Thanks bro you are a great presenter
Passed links to your videos and channel to family and friends and told them to subscribe. Thanks.
Love this, thank you
Great video! I've only just discovered your channel and you cover this stuff very well.
I would be interested to hear more about designing subnets for route aggregation and stuff like VLAN tagging.
best video of the year! great work!
Thank you.. the more I see you make videos on the SG-3100 the more I am considering upgrading to it from my USG. I had thought about the ER-4 but pfsense looks quite nice.
Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service
Nice one Lawrence 👍
Yes please do Untangle!
Great video, can't wait for the same with a Untangle router, I would like to compare what you have done vs. what i have done with home/small business networks for VLAN, and IoT isolation. I have been able to get 5 or 6 of my fiends to move away from the cheep all-in-one router/WiFi solution once they understood how vulnerable their home networks are with a flat addressing plan.
This is fantastic! Thanks
great content - thanks
Thanks for this
Great video, you gave me ideas howto setup my new network, it used to be flat🤣. Your Pfsense tutorials gave my 6yo laptop a new life and provided me with new insights👍
Nice to hear you improved your lan! :D Just not sure if I understand the relation to an old laptop? Or are you now using it as your pfsense instance and routing all (including incoming/outgoing) over 1 physical port? :P If yes, are you using any IDS/IPS functions and/or VPN tunnels? What performances are you getting out of an old laptop? You could consider getting something cheap/power efficient, ie from Aliexpress (like I did).. Just search for pfsense and you'll get tons of options, anywhere from a simple j1900 to a nice i7 :)
Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service
Excellent video :)
Really liked this one! Big fan of pfsense and was happy to see pfsense tied in with something as nice as the ubiquiti stuff
Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service
You are awesome!
Stellar job again
Hey Tom, thanks for all of the help! I am setting up a SOHO network now with a Netgate SG-3100 and unifi ap and have had trouble finding the right guides for getting it setup (I am fairly new to all of this). Is there anyway you'd be able to organize a playlist from the videos you have for getting pfsense setup in a manner that would be useful for a home office/small business?
Thanks! Wondering what I would miss if I try the same setup using omada firewall.
This is so good.
Cool thanks a bunch Tom , yes there are additional features one can add in pfsense like pfblocker , snort , VPN , adding to Zabbix server for monitoring , running virtualized etc , but great for home use as is .… keep smiling and have a great one :-)
You're good.
Awesome video
Nice one Tom
great video; how would you handle EPOS?
Tip: The problem you discuss at 3:00 can be mitigated with IPv6 addressing. :)
Love ya work very informative indeed thanks chap. And yes could you do Untangle equivalent, please?
Excellent video, I really appreciate the hint on using lldp-med to inform the phones what vlan to use.
Another way of doing that, if you don't like adding broadcast or multicast traffic to your network, such as LLDP, is to supply option 132 (named "VLAN ID") in the DHCP leases on the OFFICE interface pointing to the PHONE VLAN ID (300 in this video). This way, when an IP phone boots up, it will first get an IP address in the OFFICE (untagged) network. When the IP phone sees that an option 132 is supplied, it will immediately release that IP address, start tagging its traffic on the VLAN ID received in option 132 and make a new DHCP request on that VLAN. The nice thing about this is that the traffic that passes through the PC port at the back of the phone will remain untagged in the OFFICE network. Most IP phones on the market support VLAN configuration with DHCP option 132, it is really easy to set up. Of course, you still need to create a port profile on the switch to supply the tagged PHONE VLAN.
@@viaujoc Is this entered in the Additional BOOTP/DHCP Options section? Should it be entered as a String or Text? Is the Value format (vlanid=300)? Thanks, in advance.
@@basiliodiaz1411 It is indeed entered in the Additional BOOTP/Options section in the pfSense DHCP Server for the OFFICE interface (the interface on the untagged VLAN). It is not clearly documented how the option should be entered: as a string or an integer, with or without quotes. I guess it depends on how the phone firmware was programed to handle that setting. In my case, I am using Yealink T4 phones and I have configured option Number 132, Type String and Value "300" (with the quotes in the field). You should check your IP phone documentation about how it handles the VLAN ID option in case this method does not work for you, many phone will support more than one format. In my case "VID=300" (still including the quotes) would probably work too.
If you have many brands of phones on your network with different VLAN ID option requirements, you may need to configure each brand to expect a different DHCP VLAN ID option number in the phone configuration: Yealink on option 132, Cisco on option 133, Fanvil on option 130, ... This way, you may avoid struggling to produce a single format that will satisfy every brand at the same time.
Don't forget to also tag the switch port with the Voice VLAN. This is a personal experience: I cursed during an hour trying to find a working DHCP option that would allow my phone to boot and all that time I had forgotten to add the switch port as a tagged member on the voice VLAN.
@@viaujoc I failed to mention that the phones are Mitel 5320's. I found some information indicating to try Option 43 but failing that, to use an Option between 128-132. I'll give that a try and see what works. Thank you for your reply.
@@basiliodiaz1411 Mitel phone seems to use a single "Magic" configuration string for VLAN ID, TFTP server address and other basic settings on option 43 or 156. Some guy seems to have figured it out: unixwiz.net/techtips/mitel-ipphone-networking.html. pfSense does accept to push option 43 in the Additional option, maybe you should try it out. In this case, because the DHCP option supplies more than the VLAN ID, you have to push it both on the OFFICE (untagged) VLAN and on the VOICE VLAN.
Hello , This is great for people to understand basic networking, the only thing i would change is Intra-VLAN routing on the router.
For example, a VLAN want to communicate with another VLAN, The packet will need to go all the way to the router to be routed, then go back to the switch.
A layer 3 managed switch with Intra-VLAN routing, route the traffic without reaching the PFsense router, but all vlan gateways should point to the switch interface IP ( Layer 3 ).
if a PC on the PC network ( PC VLAN) want to open a camera ( CCTV VLAN) , the router would be involved , in a small office its fine but i recommend a layer 3 switch to handle your intra-vlan routing.
Thank you,
Nader
AFAIK most L3 switches are stateless. This makes it hard or impossible to allow TCP connections from subnet A to subnet B without also allowing subnet B to initiate connections to subnet A.
Similar Untangle Video would be great!
Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service
Thanks for making this video. I tried to do this a year ago and never got it working. Your video had the missing pieces I needed to get it working. I now have a secure IoT and Camera network.
I don't get it. If the iot crap is blocked from private networks, how do you use those devices? Wouldn't you allow the mothership ip on wan only, and allow on LAN?
James McBride most iot crap wants to work inside and outside the home. To do this it needs internet access not lan access. Eg ecobee thermostat works from app -> internet -> lan > thermostat. Not directly from device to app. Therefore if you are giving an unknown device both lan and wan access it could do whatever it wants on your lan and send it over the internet. By making an iot network that can’t access the lan you secure your lan. It’s the opposite for cameras. You want them to have lan only access and no wan access.
I just started researching youtube for training, and maybe I will eventually find a video that has the Office network & planning not just in the Firewall software (i assume pfsense dashboard for assignment only). I REALLY NEED A DIAGRAM, OR DRAWING OF SOME SORT... I will keep looking though. Thanks for the info
Where do you put the printers (and stuff like that)?? I use to put them on a seperat VLAN and only allow access to the printserver/smtp for scan.
Also a good reason to set the static IPs manually on each device is that if the router (DHCP server) ever goes down, they can still talk to each other. I did that with my servers at home. the rest of the devices are managed by the DHCP server.
Great vid. I manage a private school's network with pfsense, cisco switches, and unifi access points and a vpn to another campus. Separating students from teachers, restricting what students can touch is the game. We'll be adding voip phones soon, seeing how that is setup on unifi switches is nice. I'm so used to cisco's command line.
Might want to do the same for the teachers.
@@springbok4015 Teachers have their own restrictions.
I hate Cisco’s command line, but their GUI is improving on the SG switches.
One challenge (I've not tried this on the Unifi yet so it may not be challenging on better kit) - IoT things like TVs and Streaming Players and ChromeCast that want to be found by broadcast packets. I guess it means that the adults in the house need to be on the same network as these devices, but we can keep kids and guests off so they can't change what we're watching on the TV.
I guess this is like your printers. Ours also likes broadcast but we can hand configure IP address in clients if needed.
Looks like I need an MDNS Repeater - yay for more standardised network protocols rather than the pick-some-port-and-code-it we had in the 90s when I was coding these things.
Tom for President #2020
So I followed this guide, as I am new to UI but not pf/opn but I cant connect to a IoT SSID now.
Interesting detail I hadn't observed before this walk-through is pfSense firewall rules are created/applied per interface. My experience is with Checkpoint and it's not the case there (at least it wasn't the case 10 years ago).
you mentioned that the usg doesnt have all the features needed in the firewall rules could you use the usg pro?
I have been looking for an example that I can use in my home lab. My goal is to replicate a similar network topology for professional development. Thanks!
Howdy. I appreciate your videos. I'm late to the party. I have a Protectli with Pfsense on it. And a tplink tl-sg1024DE behind it. At this point I think I want/need 5 or 6 VLANS. Would you recommend having pfsense to control the vlans and trunk to the tp link switch OR have the switch to handle the vlans?
Weird seeing a cameras link state at 1gbps.. Good work!
It sure is weird because it is not needed, even with the 4k resolution. But hey it looks nice
Would it be beneficial to get a Ubiquiti Edge Switch (ES-16-150W) instead of a Ubiquiti UniFi Switch? What are the pros and cons?
Hi Tom. Thanks for another great video. Not sure if you said it in this video, but I know I've heard you comment/remind us that when you setup VLANs this way, it's all on one physical cable/port. Meaning, bandwidth can be a factor. So when you have a Netgate 4100 for example, I would ask why not utilize the four ports and spread those networks/VLANs across them? Maybe LAN and OFFICE on one port, CAMERAS on one port, and the rest PHONES/GUEST/IOT and a third? Maybe keep one port open for future needs. Again, looking for the Pros/Cons on this design. Thanks in advance.
Using vlan instead of individual ports is for convenience
Hey Tom, great video. I see that the LAN network (192.168.5.0/24) is more like a management network for the devices - firewall, switch, camera, etc. I believe the VLAN for this network is the default VLAN 1 right?
So, I'd like to ask, what if I want to change that VLAN ID to something else? Is it possible?
Hi Tom! Thank you so much for the video. I would like to know how you were able to put 2500baseT Speed duplex for the LAN Network?
Etherchannel?
Thanks again
His environment runs on virtualization. It's likely sitting on a server with SFP+ ports. If you have a spare PCIex4/8 slot in your PFSense server, you could add an SFP+ card and link it to a compatible switch. It will downclock to 2500BaseT for none 10Gb switches.
The SG-3100 is connected internally to the switch at the back at 2.5GBase-T
Here is the description from Netgate web site:
2x 1GbE, configured as dual WAN or one WAN one LAN
four-port 1 gbps Marvell 88E6141 switch, uplinked at 2.5 gbps to the third port on the SoC for LAN.
So, in reality, the pfSense "PC" inside the SG-3100 box has only 3 physical ports: two at 1Gbps that are exposed as RJ45 connectors at the back (WAN and OPT1) and one 2.5Gbps connected by the circuit board to a Marvell switch which is exposing four 1Gbps RJ45 ports (LAN1 to LAN4).
Liked the video. Would have liked to see what the UniFi dashboard looked like with the pfsense appliance matched up with the UniFi switch and AP.
It doesn’t show anything. Only shows UniFi hardware. Otherwise blank.
Can you do a video like this, but address VLANs by MAC address and or port and MAC VLANs on the same network?
How do the phones and devices know what vlan network to connect to? Is that with the dhcp reservation? I’m just confused because you didn’t show reserving the phone ?
I suppose another way to do it would be to have a LAN, a WAN, outside access rules, and then point to a Layer 3 switch on the internal LAN which can route, create vlans, ACL's and so forth.
Hi Tom, apologies for questioning an old video, but I thought it pertinent. Could you please do a video explaining how you would set up an office / home environment with a network that has over 253 devices, so keeping .1 as the gateway and .255 as a broadcast, if you had 300 devices how would you configure PFSense securely to segment and talk across the networks? Thanks.
If you want them all on the same network just use a /22 instead of a /24.
I've found the Cloud key extremely limited - on the first one at least, mongodb will break if you turn up the logging.
Same here. Went to a vm which is working flawlessly.
7:40 Yes! And that's why I hate UDM Pro :-) Anything like this config would be too complicated there.
With all these vlans. Cross talk packets must go back to the router right?
If i am moving a large file from device A to Device B will that go back to router to change vlans?
How often would One need to worry about saturating the GB link?
While I do get why some people often pick up on blocking addresses normally associated with internal LAN addresses, there's another thing to bear in mind; ISPs now are starting to use CGNAT, so you're going to see "internal" IPs in some WAN connections.
Hi! Thanks for the video.
I noticed that you put an explicit block rule in the firewall configs for "This firewall" over all interfaces... I thought it was block by default?
In my personal setup I have an alias called "PrivateNetworks" consisting of "192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8", all of my interfaces are in the 192.168 range, and my allow rules all say "Destination !PrivateNetworks"... Above these allow rules i configure any rules that hit nodes on the private network / across subnets.... Is this sufficient??? I'm pretty new to writing my own firewall rules
i'm a bit late to finishing this video, though i'm not completely through yet, Is there any reason you're not doing the routing in the switch vs pfSense? It doesn't look like you're doing a lot of rule sets in this case. Or is that switch not capable? I've recently started looking for a decent l3 managed switch with poe for my home use. The ones we use at work or very expensive and maybe that's why. I'm seeing different levels of managed poe switches in my searching. I've messed with a couple other brands; but still no unify.
What do you do for live?
What would you propose for multiple cameras? A POE switch on your port you set up for the camera in your example (like a dumb poe switch extending that 1 port) or map more ports to the smart switch?
ideally mapping more ports to the smart switch.
14:50 I'm confused. Why wouldn't an allow only to WAN interface rule not work? Or not be easier/better?
Everything looks great. Had a few questions.
Once you setup the VLans in pFsense, do they automatically show up in the Unifi switch?
Regarding the Unifi Protect network, wouldn't blocking the cameras from accessing the internet block firmware updates when they become available or would it try and pull the update from Unifi Protect?
Worse case scenario, someone disconnects the switch from the pFsense box and plug it in to their pc or Raspberry Pi, would they have access to all VLans if it they make it appear they are a switch?
As I said in the video, you need to create them both on the pfsense and UniFi, the NVR is pushing the firmware updates so as long as it has internet access it will push them to the camera, if someone has physical access they can move what ever port they want.
Hey Tom. I'm not quite tracking what you're saying about the port 443 that you changed to 10443. Where is it assigned by default in the settings? There's so much to learn. It's overwhelming but I'm getting there. Thanks for your videos. Hopefully I get a nice segmented network going on at home.
you do that here docs.netgate.com/pfsense/en/latest/recipes/remote-firewall-administration.html
I wouldn’t have thought routing HD Cameras through the FW would be a good idea. Maybe it’s quite common I don’t deal a lot with CCTV side of things.
Is there a course we can take to learn how to set-up small business network?
Why have the source as IOTcrap net on the (Block Firewall Web Access) rule and as (any) on the other networks?
Add the raspberry pi on using a Ubiquiti Nanoswitch or similar and the camera won't even be offline to attract attention beyond the time it takes to plug that in.
Excellent presentation for a very powerful tool ready to be used by a SOHO user/admin. I would alos like to ask a question if anyone knows. Can I setup any LAN port on a netgate 2100 or 4100 as WAN for VPN failover? Thank you in advance to anyone that knows.
The ports can be assigned to different purposes.