How To Setup VLANS With pfsense & UniFI. Also how to build for firewall rules for VLANS in pfsense

Подписаться 332 тыс.

Просмотров 465 тыс.

50% 1

Our Most Current pfsense Tutorials lawrence.technology/pfsense/
Connecting With Us
---------------------------------------------------
+ Hire Us For A Project: lawrencesystems.com/hire-us/
+ Tom Twitter 🐦 / tomlawrencetech
+ Our Web Site www.lawrencesystems.com/
+ Our Forums forums.lawrencesystems.com/
+ Instagram / lawrencesystems
+ Facebook / lawrencesystems
+ GitHub github.com/lawrencesystems/
+ Discord / discord
Lawrence Systems Shirts and Swag
---------------------------------------------------
►👕 lawrence.video/swag
AFFILIATES & REFERRAL LINKS
---------------------------------------------------
Amazon Affiliate Store
🛒 www.amazon.com/shop/lawrences...
UniFi Affiliate Link
🛒 store.ui.com?a_aid=LTS
All Of Our Affiliates that help us out and can get you discounts!
🛒 lawrencesystems.com/partners-...
Gear we use on Kit
🛒 kit.co/lawrencesystems
Use OfferCode LTSERVICES to get 5% off your order at
🛒 lawrence.video/techsupplydirect
Digital Ocean Offer Code
🛒 m.do.co/c/85de8d181725
HostiFi UniFi Cloud Hosting Service
🛒 hostifi.net/?via=lawrencesystems
Protect you privacy with a VPN from Private Internet Access
🛒 www.privateinternetaccess.com...
Patreon
💰 / lawrencesystems

Хобби

Опубликовано:

17 дек 2017

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 316

@mattcero1 2 года назад

This guy's good! He blew Network Chuck's VLan video out of the water for sure. I'll be watching this again indeed when I'm in front of it all.

@decepti0n 2 года назад

Just started running pfsense in front of my home equipment. This video is extremely useful. Thank you Tom from 2017!!

@KILO993 6 лет назад

Dude, I just found your channel and all your vids are information gold. Where have you been all my life haha. Keep up the good work :D

@Crystawth 4 года назад

I had been struggling to understand how vlans work and how to use them with unifi and your videos are wonderful. You break it down in a way that makes it very manageable to learn.

@omgwtfbbqpwnages 2 года назад

I'm an absolute networking noob, and this was fantastic. Absolutely amazing that you do this work, and thank you so much for making this available.

@Impractical_Engineer 6 лет назад

This is invaluable and really saved me some time trying to figure it out myself! Well put together, super helpful and really easy to understand. For some reason I thought I would need a physical separate port on PFSENSE dedicated to each VLAN, Silly me haha.

@enderst81 6 лет назад

heh how the hell did you know I was trying to get this same setup working yesterday? it's a Christmas miracle! Thanks lol

@camf33 Год назад

Thank you very much.. I have a background in telecommunications and networking but it’s been decades I haven’t touched vLans, definitely what a refresher with pfSense. Kudos to the way you explained it and broke it down, what an excellent presentation!

@SteveFunk 2 года назад

Great guide, I use opnsense (similar enough) with a Unifi AP and this guide worked perfect. I appreciate you putting this together. I used it to get my VLAN knowledge from nothing to actually setting up my first IoT VLAN which I've been wanting to do for months now.

@BayAreaTechPros 6 лет назад

What an excellent guide and commentary. Thank you so much for this. Although I was looking for a guide on something different your explanations of your actions have helped me achieve exactly what I wanted. Thanks again this is very helpful!

@robersonsoliveira 3 года назад

You're simply the best. Better than any course out there. By the way, I'm from Brazil. I appreciate all your knowledge and everything you've taught us rich things like that.

@tbeehler 6 лет назад

I've always had issues with VLAN's and understanding them, and this video just make it "click" in my head. Awesome job!

@Preview43 4 года назад

I heard the clicks too... but it turned out it was just the gears stripping in my head

@esrtek5754 5 лет назад

Many thanks! ordered a PF-Sense sg1100 (direct) but used your Amazon link for the rest.. 8 port Unifi Switch and a AP-AC-Lite all thanks to your suggestions and awesome vids!!

@blackryan5291 Год назад

5 years later this is still schooling people. Thanks for making this. Also...I would like to wholeheartedly thank the person that setup VLAN 69. If they did it on purpose or not don't matter. That port assignment makes me giggle

@larthack80 4 года назад

This is a gem! I’m a fairly new subscriber so I’m binging your content and this one is great!

@davidtoddhoward 6 лет назад

The information you share on pfsense (and other topics like FreeNAS) is so, so helpful. I'm following much of what you what you do for my own personal development at the moment, and really appreciate all that you do. It's awesome that you dedicate so much time to openly share knowledge. It really helps engender trust and confidence in your company and skills. If I need expert services in the future, I'd have no hesitation in taking my business to you guys. Thanks so much Tom, and team.. :-)

@LAWRENCESYSTEMS 6 лет назад

+Todd Howard thank you, it means a lot to me.

@myozone 6 лет назад

@haimsadia 5 лет назад

@@LAWRENCESYSTEMS How do you do your testing of PFsense within your network? I would like to set up a box and test it before I go live and take down the main router/internet connection.....if that makes sense?

@JCrossMsM 4 года назад

@@haimsadia Late reply, but this may help future viewers. pfSense works great as a VM. You could create a small scale, virtual lab on your main computer with the pfSense VM as the gateway. Replicate the settings of your production pfSense to the VM, and then test whatever settings/features you wish.

@user-il6ei7mh5o 5 лет назад

And.. subscribed. As someone new to PFSense, this was clear as day to myself. I completely forgot about my old USG VLAN10 I setup for IoT :)

@jimmytopete2077 3 года назад

Learned a lot here. Now I got a clear picture of how to start a homelab with vlans. Now to tinker.

@stuartwilson2277 6 лет назад

Thanks, great explanation. You Clarified the connection between pfsense and unifi for me. Turns out it's not complicated at all :)

@steelrides4462 3 года назад

Thank you for your clear explanation! I've been trying to get this to work for hours. I just needed to switch the Unifi switches from the default Lan profile to All and it pushed the DHCP address right through. Thanks.

@johnarrington6292 2 года назад

Thank you so much for this---it really helped me get the VLANs, switch, and AP wifi networks finally playing together nicely and it's really satisying! I actually know what I'm doing now. I have to say maybe the hardest part was getting the Unifi Controller software running on an older linux laptop without breaking it. I tried the neglected docker image but no go even after sshing into the AP. The Dutch guy's excellent script referenced in the Unfi forums was where I should have gone first!

@memyself6857 5 месяцев назад

Always informative, clear, and detailed! Thanks for all the effort you put into your videos!

@LAWRENCESYSTEMS 5 месяцев назад

Thank you

@rickabrams3422 5 лет назад

thank you so much for these videos. i can see the benefit of having IOT on vlans. i'll set this up on my own network and see what i all break :)

@mdd1963 6 лет назад

Given the high quality of your tutorials, I have decreed 100% forgiveness/pardon for the man-bun! Well done tutorials! Keep 'em coming!

@user-pd3zd7is1v 5 лет назад

Given the high quality of his tutorials I want his man buns

@Dorff_Meister 2 года назад

I bought a pair of Unifi APs (my first Unifi products) so I could add an 'Internet Only' SSID for my IOT devices (and guest network and such) with my pfSense. Setup has been a snap with your help. Thanks!

@MrTCard91 3 года назад

You are amazing. Please don’t ever stop these videos.

@ColbyPerry 6 лет назад

Thank you Tom for making this video, I think it just solved a problem I have..I'm not the smartest person in the world when it comes to networking.

@Topdoozie 6 лет назад

One of your best videos to date

@reubx 6 лет назад

Very helpful video, thank you. Question: When defining the second firewall rule (~8:00) why do you select the source of "any" rather than just "IOT net" ?

@amosgiture 5 лет назад

That is simple enough and detailed enough at the same time

@foquismo6076 2 года назад

Its one of those days when your glad to know about this guy..

@cybrnook 6 лет назад

Loving the content guys, you are hitting the perfect sweet spot for tech enthusiasts like myself. Also a fellow metro-detroit resident here in the process of building out my server rack at home, and you guys just so happen to be using all the same equipment and features I am at home (Pfsense, Unifi, IPS, VLANS, Virtualized etc.....), so you have been a great help. Keep up the great work, and good luck with the business. Shop looks great, real inviting and you guys seem to have everything you need. EDIT: Maybe I missed it, but you run your Unifi controller on a CK or a VM?

@LAWRENCESYSTEMS 6 лет назад

+Hans Geiblinger thank you ;)

@LAWRENCESYSTEMS 6 лет назад

In a VM

@cesarcuellar6540 2 года назад

Thanks a lot for your videos. Greetings from Troy!

@VajiraLasantha 3 года назад

Just what I was looking for while setting up my Omada system. Thank you.

@LAWRENCESYSTEMS 3 года назад

Glad it was helpful!

@jdurham 4 года назад

This has been so helpful. Thank you!

@miketarbox1190 6 лет назад

Tom, great videos, and I greatly appreciate all of the helpful information you put out. Question for you. Do I have to setup manual outbound NAT rules for the VLAN's? Currently my pfsense box is setup with manual, but it almost seems like it should be automatic rules.

@bsodmike 6 лет назад

Nicely done Tom - thanks!

@anthonyscott2368 2 года назад

Great vid. Easy to follow along

@SamAndrew27 5 лет назад

Excellent tutorial, THANKS!! :D

@tesla2115 Год назад

Thanks this is very helpful and useful information. Good job!

@iscariotproject 6 лет назад

really good walk trough,thank you for sharing

@JensHove 6 лет назад

Very well made video! Thank you.

@aaronsharp3858 4 года назад

Great video helped me alot..... Anyone running hyper v and can't get this working me neither took me hours too get this working, hyper v cannot does not allow trunking of vlans on a virtual switch without running a special powershell command Google vlans pfsense hyper v you will find the command you need as soon as I ran the command my setup worked perfectly

@samanbalal824 4 года назад

THANK YOU so much. This helped me a lot.

@gh8447 6 лет назад

I learned something today. Thank you.

@LAWRENCESYSTEMS 6 лет назад

\o/

@onyx0r 6 лет назад

great video, as allways. keep up the good work!

@skrueger0 3 года назад

Thank you, Lawrence! I just got my IoT network setup for my secure devices.

@LAWRENCESYSTEMS 3 года назад

😎

@BarryArendt 6 лет назад

Great video Tom,

@StructuredChaos 3 года назад

This video is still relevant. Thanks.

@KingLouieX 5 лет назад

Thanks for the video, just jumped on the PfSense bandwagon and this saved me from buying another NIC..

@RichardBuckerCodes 4 года назад

This was a great primer. I was able to apply these rules to my edgerouter X with little advanced knowledge. However there is one missing link. I have an odd shaped house and getting my amplifi wifi in bridge mode in the middle of the house for a more "average" coverage... and then there are IOT that are wired and wireless. So while my router is happy and I have my vlan configured I cannot actually use it. Any ideas on how to approach this?

@jphillips5700 6 лет назад

This is awesome! Was pulling my hair out trying to get VLANs to cooperate with PFsense and my 24 port UNIFI switch. Thank you thank you thank you! Is there a video on how to create a VLAN to separate Open VPN traffic on certain ports such as NordVPN or similar. I've created certs etc. Just want to apply it to certain ports that machines are running on. Thanks again this was incredibly well done. Subscribed!

@cjonesuk86 4 года назад

Hi Tom, thanks for your all your tutorial videos on VLANs. One thing I would like to know is, how would I create a typical 'IOT' network that is isolated, but I can still have one-way access to these devices from the normal LAN?

@thomask.9347 2 года назад

Thank you guys! That is such a good video made in a way even a potato like I am understands it :)

@wheresmyspanner 6 лет назад

Thanks a lot for this tutorial, finally been able to setup VLANs on my network thanks to this! One question - I have a PiHole running as a DNS server on my 'management' (.5) VLAN. Any idea on how can I get my intranet (.10) VLAN to talk to the pihole for dns lookups? Right now can't seem to suss out how to get internet accesss on the intranet VLAN whatsoever, even when setting DNS to 1.1.1.1 on the DHCP server. Thanks for your help!

@TulioCamargo179 6 лет назад

Thank you! x1000000...if there is a channel im glad to subscribe, its lawrence systems ;)

@LAWRENCESYSTEMS 6 лет назад

;)

@lalala987 2 года назад

Thank you for the video! Great information!

@LAWRENCESYSTEMS 2 года назад

Glad it was helpful!

@NatesToob 2 года назад

@@LAWRENCESYSTEMS Hey Tom! Any chance of an updated version of this content now that it's been a few years? With the new Unifi interface, it's not quite step by step anymore (plus, I tried it today and hit some issues, and want to see what I screwed up. =D )

@h4X0r99221 4 года назад

Great video Tom

@muhammadbutt7994 3 года назад

In the example above, what FW rules we need to set up on the LAN (igb0) interface? In my understanding, the LAN (igb0) is going to be connected the Switch1 and only use for getting traffic from the switch. All VLANs are set up on the same port igb0. Thank you. All of your videos are incredible.

@mikesuter7185 3 года назад

Great video. Have you experienced both immediate & intermittent network drop-offs when passing "x" amount of data between two VLANS despite Suricata being disabled?

@jrnmadsen2710 5 лет назад

Great video, thanks. Textbook example of a well designed network. One question,- I'm a big fan of pfSense,- but what is the reasons not to keep a "clean" Unifi setup,- using a UniFi Security Gateway? As far as I can tell, a UniFi Security Gateway could do the job. Same vlans, NAT''ing, DHCP and firewall rules Is it to counter any future orders from the customer, pulling the more advanced features of the pfSense? Another reason,- perhaps you want to use ssh tunneling for management?

@power-max 3 года назад

Do you have to create a specific vlan with tag=1 for the basic network or is that assumed with the bare interface w/ a specific hardware port selected?

@linuxpc4me555 5 лет назад

Thanks for such a great video. As I am very new to networking I shudder asking this question - You show two switches connected together. switch 2 is connected via port 1 to switch 1 port 5, then switch 1 is connected to wan via port 1. I am guessing switch 1, port 1 is a trunk port. Is switch 2 port 1 also designated as a trunk port?

@Witzkito 3 года назад

I finally understood!!! thanksss

@sabir4094 6 лет назад

Thanks for the video.

@UnkyjoesPlayhouse 6 лет назад

great explanation :)

@fbifido2 6 лет назад

Can you add a different captive portal for each VLAN? Can you make a UniFi AP give out different SSID for the different captive portal on each VLAN in pfSense? without using a USG?

@raykall 6 лет назад

great video! Thanks man

@DoBaMan77 3 года назад

Hi, awesome video and everythings works flawlessly. One thing I did not find out yet ist how to define a "Master" Device which is able to coltroll different Vlan-devices without changing the Wireless Network. And of course there ist the question of security. Maybe I am searching the iNet for the wrong subject?

@mervinmercado4755 6 лет назад

Followed question, I have here 1 typical computer unit installed pfsense 2.4.3 single wan and single NIC do I need to add another NIC? thank you again and hoping on you response many many thanks

@ilducedimas 5 лет назад

There should be a "double thumbs-up" button for all the videos of this channel.

@BillyDickson 6 лет назад

Good explanation and easy to understand, I’m using the Netgear GS108tv2 as a cheaper home option. :-)

@mervinmercado4755 6 лет назад

I would to ask Mr. Billy if it is possible to set up on my pfsense I installed in single computer unit purely pfsense not using vitualbox or any apps. thanks

@alonzosmith6189 5 лет назад

Can you have multiple network ports on Pfsense box then separate the vlans across the ports? Will 2 trunks connected to the 1st switch.

@LIDHosting 5 лет назад

Hello, great learning videos thanks for sharing. I have a question I really could use your help... I have Pfsense setup I want to have a server outside the network but I want it to be able to talk to another server thats on the network. for One on network is a master the one off is a master...

@r7_guy941 7 месяцев назад

Very good explanation thanks a lot. I am going to build a home network with netgate and unify,, but I do not know how to connect a voip/dect phone to the router and how this works. Is it possible for you to explain this ?

@troller4jesus 3 года назад

Cool ty. And do you know why that Add Tab button might be missing from the Interfaces > Switch > VLANs page?

@meadowlarkmarsh122 4 года назад

oh you fixed it! thx alot!

@nacbk1 5 лет назад

Any chance you can do a video on setting up VLANS on a SG-1100? I understand VLANS but the SG-1100 has me confused. I've looked for documentation but a lot of links just point back to the sg-3100 documentation

@jerricho1422 4 года назад

I am trying to configure essentially the same setup (sg3100 & unifi 24poe switch). As soon as I change my switch port profile to match the vlan, the switch disconnects. Did you have to enable 802.1q VLAN mode?

@mal798 3 года назад

You are an inspiration.

@LAWRENCESYSTEMS 3 года назад

Thanks

@PiKniOb4 3 года назад

Hi Lawrence, is it possible to trunk subset of VLANs with Unifi switches? From what I can tell, the only option is to configure an access port or trunk ALL VLANs. I am thinking about moving from Cisco to a Unifi switch but this is holding me back. Please let me know your thoughts. Thanks!

@SyberPrepper 6 лет назад

Great video. I liked how you brought real world issues in. One other issue would be printing. If you only have one (wired) printer and want to use it between your main LAN and a separate VLAN for wireless devices, how would be the best way to allow access to the printer for everyone? Thanks.

@LAWRENCESYSTEMS 6 лет назад

+SyberPrepper create a firewall rules to allow access just to that printer

@SyberPrepper 6 лет назад

Cool beans. I'll give it a try.

@tylerc5311 5 лет назад

Ok now get this to work with different VLANs and subnets and I'll be impressed.

@elb0rto 4 года назад

Thanks for this

@joaomedina 6 лет назад

HI!! Thanks for your video it helped me A LOT!!! Maybe, can you solve a "little" issue that my PFSense have. When i check ""Enable DHCP server on VLANWIFI interface"" and Save, my DHCP over LAN stops working. Did you have seen something like this?

@LDdrums20 6 лет назад

Great video Tom! I was wondering if you have planned a domain administration video with some tool under linux. Do you guys use domain servers for any of you clients? Thanks for all the content you upload!

@LAWRENCESYSTEMS 6 лет назад

We have a lot of clients with Windows Domain servers, but none with Linux domain servers. It has been a while since I tried it, but as I understand, Linux does not do that well as a domain controller.

@electricdorito 3 года назад

If anyone is following along and is trying to get traffic passing through a Cisco managed switch, in the switch settings you have to add the VLAN # in VLAN Settings. Then under Port to VLAN, change the filter to list VLAN # membership. Make sure whichever port you have the pfSense device plugged into is Tagged and then the device(s) that you want to be a member of that VLAN is Untagged. I spent hours troubleshooting because this was my first time setting up a VLAN. But what I didn't realize was that when I selected Tagged, it was tagging it as the Trunk which is what the pfSense device needs to be, and devices you want to add to that VLAN need to be Untagged so they are a member but not the Trunk and all other ports remain as Excluded.

@mnoble247 3 года назад

I just do intervlan routing on the switch and only send traffic to the pfSense box as needed. If you are doing a GBe or multiple, or even 10GBe you can't get the backplane bandwidth that you get keeping data plane on the L3 switch itself.

@2006Agent 6 лет назад

Wow your videos are awesome, I've grown to like pfSense thanks to you, can you perhaps do a video on how to use DHCP Relay with a windows server as DHCP Server perhaps, or point me in the right direction, appreciate all your videos it help me a lot

@LAWRENCESYSTEMS 6 лет назад

DHCP relay is used to relay it over to another Network on a different subnet is that what your goal is?

@TheRangeControl 4 года назад

I'm just beginning the video(2:30)... HOWEVER, I have a question that I always seem to land on: As you show the diagrams with switches and talk about ports.... are you talking about assigning a physical RJ45 cable connection point? OR, are you talking about some digital unseen connection?

@Max34557 6 лет назад

What i did for my IOT VLAN is just created an alias for all RFC1918 networks (Private IP range) and blocked everything from IOT to RFC1918 except for the gateway address of the IOT vlan.

@publictoilet7832 3 года назад

hello so once you created a two vlan for example so the two vlans broadcast block by default?

@rugo6933 4 года назад

Hi, could I set up a VLAN with only 1 switch I was only going to plug my PC into hoping to beef up my security The documentation with my Netgear GS108 switch wasn't helpful in describing the various types available, so I wound up scrapping it and buying another Synology AP which I don't think those routers communicate well with switches for whatever reason..perhaps because Synology does not make switches that I am aware of. maybe should just stick to having it as PNP, what do you think? Thanks and keep up the good work and I look forward to your future podcasts.

@gomez758 2 года назад

How would I assign different devices ie iot, phones,management,office on the the same SSID but have them get assigned the dhcp ip of their category or vlan? I have the same setup offense as the gateway and a ui 8 Poe switch with 6 lite access point.

@pedronrivera22 5 лет назад

Nice Vid!!!

@MrXuegui 3 года назад

Unifi defaults ports to use the "All" port profile. Is there a simple way to change the default profile and then change only the ports needed for specific VLANs?

@pandabrain 4 года назад

The DNS block is only working on devices that either receive the DNS server address via DHCP or have it already set up. If a device would be set up to use a different one, the DNS lookup would just fail. That's why i redirect the target of DNS to my opnsense box in the firewall. That way, DNS always works for any client and the reply always comes from my own DNS server. Works like a charm with plain DNS requests.

@fbifido2 6 лет назад

love this video :)

@nicholasbackwell1869 4 года назад

Perhaps someone already asked this but what's the difference in Unifi under network settings clicking VLAN vs Guest when asked the purpose?

@wstrater 2 года назад

When you were setting up DHCP on the VLAN you mentioned that pfSense blocked broadcast by default and you need to allow it. I didn't see you allowed it. I have a VLAN with one fire wall rule to allow any IPV4 protocol from any source to any destination. I still can't get an IP address when connecting to a Unifi WiFi or switched tagged with the VLAN. I can get an IP address for the LAN both wirelessly and wired.