Pfsense and Ubiquiti

I have 4 UAP-AC-PRO to deploy over 10000 square feet. I want to use pfsense to do all routing and firewall rules. I don’t have a USG, plan on doing a mesh network with the AP.

  1. have already installed latest pfsense on a hp5800, intel 4 port network card, installed pfblocker
  2. apart from the WAN, I’m assigning one port for office lan and one for student
  3. student can’t get to office lan , but office has access to everything
    Need to lock down student lan from, gaming, porn, gambling, social apps etc. All has to be replicated to APs. So my network would be : isp -> pfsense -> unmanaged switch-> APs.

Any guidance would be appreciated

The big problem you are going to run into is you are going to need a managed switch to do this properly. If it were me I would

  1. Create a student VLAN and create VLAN’s for your other networks as you see fit. You need to have proper logical separation so you can apply the right access to the right people/servers.

  2. Then create a student SSID that is tagged with the VLAN you created in pfsense and I would be careful about putting critical networks on wifi (Not best practice).

  3. You will have to have a unifi controller so use an old pc or create virtual machine (I recommend VM in case you need to add resources later). Minimum specs for that is like 2 core 2 gigs of RAM should do fine for what you are doing.

The reason you will need a managed switch is because when you configure multiple SSID’s you will have to set up a trunk port to your AP’s so you can specify the VLAN tags to the proper SSID.

I totally agree with @xMAXIMUSx where you need a managed switch to manage the VLans but in case you can’t get one at the moment, you can connect one Unifi AP physically and create the VLans from there and have it meshed wireless to the APs via the Unifi Controller.

Please view this tutorial from my mentor @LTS_Tom it should guide you and may fit what you are trying to achieve in the absence of a managed switch.

Got a tplink tl-sg1016pe, created a vlan for student and office on pfsense opt 1 and 2. Installed and configured pfblockerng-devel and selected the categories i needed blocked. Created the allow all, block dns, block lan, and allow dns to pfsense for student and office. With my managed switch and four aps, do i apply to the four ports the aps will be plugged into, then plug all other devices eg network printer. Would the pfblocker suffice or other firewall rules need to be setup for the two vlans.

Sorry I am having trouble following what you are asking. Are you saying you want to block students from the printer?

Not blocking students from printer access, blocking access to sites and aps while in school, as well as access to office vlan.

Testing it now, still have access to netflix, discord, skype etc on student vlan. What did i miss?

I have created my vlans, added them to the unifi controller, yet i’m not able to get an ip address from either vlans. Vlans have been configured on the switch.

Do you have a trunk port setup for the AP and the AP has the right VLAN assigned for each SSID?

Did you setup DHCP on the proper interfaces?

Screenshots of your setup would help a lot in troubleshooting.

From my pfsense lan port -> port 1 on switch. Vlans configured on port 2-8. Ap plugged into any tagged ports.

In the diagram above should help with this setup. Also haven’t used TP-link much so this will be fun lol.

The trunk ports for all AP’s have to be the same. Right now in your screenshots you have EM1 setup as your trunk port that should be connecting to the switch. Then your switch should have trunk ports going to each AP. You’re unifi controller looks right.

The fact that i need to push out vlan 3 and 50 from the unifi APs, can both be set on the same port. When i configure the vlan i loose connectivity to the ap from the controller.

You are using vlan 1 office and management, vlan 3 students, and vlan 50 guests. This means your trunk ports should be config with vlan 1 untagged with a pvid of 1 and vlan 3 and 50 tagged.

If you are loosing connectivity between the AP and controller you most likely have a management vlan mismatch.

Wish I could sit with you to review. All other ports are set with Vlan1, and ports 2-8 are tagged with vlan3 and vlan 50. So lost as to why.

I think your controller and pfsense is set up properly I just don’t know how to configure a tplink switch with native VLAN 1 and trunk ports. :confused: I’ve only done this with Cisco switches.

Lawrence does have a youtube video with a TP link switch, and gets it to work, which i followed, but got lost in the process somehow.

1 Like

Looking at your photos I would say the switch is configured incorrectly. Do you have your pfsense connected to port 1 on the switch? That is what I think you said, and if you do it will never work. You need to make sure port 1 on the switch has a PVID of 1 and an be untagged set to 1, it MUST also have a tagged port of 3 and 50. Ports on switches can generally only have 1 untagged port, but they can have multiple tagged ports. The multiple tagged ports are what effectively make them a trunk port. The ports going to the APs should also be configured with the same settings. The only time you would want to set a port to be untagged and with a PVID of say 3 or 50 is if you had a device connected to that port that didn’t understand about VLANs and needed to be on a specific VLAN. For example, if you had a wired PC that had to be on the student VLAN (3) then you would set that port to untagged 3 with a PVID of 3.

This is exactly what @sdfungi told you to do earlier. Maybe post some more images of what you have now configured, and let us know exactly what you have connected to which ports.

See above Vlan setting and PVID setting

The pvid on your ports are wrong. If the untagged vlan is 1 the pvid should be 1.

Also if you are goign to have ssids for all 3 vlans then the ports need to be configured

vlan1 untagged
pvid 1
vlan 3 tagged
vlan 50 tagged

right now you have no overlapping ports for vlan 3 and 50 which means a single AP could not service both vlans.