KalNet Message Board

Posted: **Fri Feb 20, 2015 11:41 am**

Setting up pfsense with VLAN's (particularly, with Smart Switches)

https://forum.pfsense.org/index.php?topic=28379.0
https://forum.pfsense.org/index.php/top ... l#msg78736
https://www.iceflatline.com/2013/09/how ... n-pfsense/

Posted: **Fri Feb 20, 2015 5:16 pm**

Shibby Tomato.

Basic
->Network
1. I disable WAN and bridge to br0 for another port
2. I enable STP, but disable DHCP on ALL networks
3. Set Gateway and DNS
4. Set and configure main wireless as you see fit.

->Static DHCP/ARP/IPT
1. I have "Ignore DHCP requests from unknown devices" unchecked.

Advanced
->DHCP/DNS
1. Use internal DNS is checked
2. Prevent DNS-rebind attacks is checked
3. Reduce packet size is checked
4. All others unchecked.
5. Enable DHCP via Dnsmasq by:

Code: Select all

interface=br1
dhcp-option=br1,3,192.168.xxx.1
dhcp-range=br1,192.168.xxx.100,192.168.xxx.125,255.255.255.0,24h
interface=br2
dhcp-option=br2,3,192.168.xxx.1
dhcp-range=br2,192.168.xxx.100,192.168.xxx.10,255.255.255.0,24h

->Firewall
1. All unchecked but the Comcast fix

->Routing
1. Mode = Router
2. Efficient Multicast Forwarding is checked
3. DHCP Routes MUST be checked (lil' PITA)

->VLAN
1. VLAN and VID should both rise sequentially
2. Bridge VLAN 2 to br1, VLAN3 to br2
3. Bridge eth1 to br0
4. Bridge wl0.1 to br1
5. Bridge wl0.2 to br2
6. Trunk override not checked

->Virtual Wireless
1. Setup wl0.1 as you see fit and have it bridged to br1
2. Setup wl0.2 as you see fit and have it bridged to br2
3. I click the Overview button at the top, not the bottom, as clicking the one at the bottom seems to erase my settings.

Administration
->Scripts
1. Under Firewall put:

Code: Select all

iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br2 -m state --state NEW -j ACCEPT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
iptables -I FORWARD -i br0 -o br2 -m state --state NEW -j DROP
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -I FORWARD -i br2 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br2 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br2 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br2 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br2 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport www -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport https -j REJECT --reject-with tcp-reset

QoS and Bandwidth limiting to follow.