New to pfSense and have some equipment questions

Networking & Firewalls
1

Hi, I’ve been researching pfSense a lot and am new so please forgive my newbie questions.

I’m coming from a network as follows:

Current Setup

  • 100Mb from ISP to a router that handles wireless
  • From the router I have a 24 port unmanaged switch with about 15~ clients on it. They are not all active at once.
  • There’s probably 5 wireless clients
  • Off of the 24 port switch is a 8 port PoE switch for security cameras and security computer

Future Setup

  • 100Mb from ISP to a Netgate 2100 or 3100?
  • From Port 1 of Netgate to a EnGenius EWS7928P Layer 2 switch or Unify USW-Pro-24 Layer 3. **Will have the same amount of clients
  • 5 wireless clients connected to a PoE AP

I want to set up VLANing:

  • VLAN1 - Internal Users, access to everything
  • VLAN2 - Internet Only / Guest Wifi
  • VLAN3 - Security devices, these devices would have no internet access, cannot access other VLANS but can communicate with each other. VLAN1 should have access to these units (but those units can’t see/communicate with VLAN1)

I plan on running or playing with the following packages:

  • DHCP
  • pfblocker
  • Wireguard for just one client
  • MAYBE Application blocking, but that’s just experimental
  • I’d like to play with Suricata but may not keep it

My understanding is, if the switch is not Layer 3, interlan routing goes up to the Netgate and on the 2100 I wouldn’t get 1Gb? Or would Layer 2 be sufficient?

2

I would go with at least an SG 3100 if you want to get 1GB for intervlan routing and using Suricata. Also, pfsense does not really do application blocking.

3

That’s what I was thinking as well. If I had a Layer 3 switch, would I really need the 3100 for 1Gb intervlan routing?

4

Yes, but unless you get a used one a switch that supports routing at 1Gb are going to be a bit more expensive and it also means configuring that switch with the routing rules and interVLAN rules in addition to configuring rules in the firewall.

1 Like
5

Thank you, that was helpful. Maybe you know this- I cannot find if the EnGenius EWS7928P Layer 2 switch can handle 1Gb routing.