I've been in IT for 20 years and this was the most succinct explanation on network design I've seen... well done.

Finally, a video that explains VLANs to actual humans! I wish I had seen it earlier...

@LAWRENCESYSTEMS

3 жыл бұрын

Happy this video helped a fellow human.

This "best practice" video tutorial never grows old. I've used it as the basis for several SOHO setups and have never gone wrong with it. It covers all the common types of devices one might want to connect to a SOHO network. I especially like the LLDP-MED port provisioning for connecting VoIP phones having a pass-through network jack for desktop computers. The UI on the Unifi controller may have changed some since this video was made, but the same functionality is still there and this video is still just as relevant as when it came out 4+ years ago.

@LAWRENCESYSTEMS

7 ай бұрын

Thanks

Tom, you make it too easy! I can't imagine how much time I would have saved if I had this video when I was starting out. That being said I think I learned more by getting lost and finding my way back. Thank you!

Tom, this is an excellent video and covers a number of configuration consideration I need to address when revamping my home/lab network. I'm a retired systems programmer/Architect for the past 12 years, networking is new to me beyond the basic home router setup. I'm able to use your videos in my education on more complex networking configuration concepts, so, thanks and keep up the great videos. Regards

3:45 Interface -> Assignments -> VLANs (Creates IOTCrap VLAN & iface) 6:00 DHCP Server 8:30 Firewall Rules 15:00 Unifi switch VLAN settings 26:15 Shows physical devices and connections

Hi Tom, thanks for the great video. I've been trying to get my UniFi cameras on an isolated VLAN for the exact reasons you described. One of the mistakes I had been making was giving the G3 a static IP so when I set the port to the 'video' profile I lost connection to the Protect server. But having watched this I've got it all sorted. Keep up the good work.

Tom, I've been watching your channel for a couple months and just wanted to say thanks for all great information, training and tips!!! I have been designing my dream home network for a new house that we are having built. I am starting to test some of the network hardware that I chose with the help and insight of all your experience in IT. I don't always get it the first time but I can't count how many times now I am working on something and think "boy did Tom have that right!" or "that's what he meant by that!". Thanks Tom!!!! And,now I finally joined your KZread channel and I'm also going to check out your website!

Thank you Lawrence that is exactly the same as my network. FYI, one thing that needs to be added is dhcp snooping needs to be disabled on vlans due to bug on usw Mike

Great setup and great explanation! I like the fact that you made the LAN into an IT management zone and make the regular users connect to another zone (OFFICE). This way, the pfSense anti-lock out rule will always bring the pfSense UI to the management zone and not back into the user network. If there is IT staff on-site, they get to have ports to the LAN zone in their office. If there is no IT staff on-site, which is common in small businesses, I use a VPN to get into that zone. Of course, I always keep an available untagged port on that zone (VLAN) on the main switch just in case the VPN fails for some reason and I need a physical access to the management network to repair something.

This should be the first watch for all that want to tinker with home networks. Tank you Lawrence for taking the time and educating us.

Fantastic. I made some changes to address my particular setup (pfsense as a virtual machine within truenas scale with multiple bridged vlans), but this remains a fantastic resource --- 4 years later. Thank you!

Exactly what i’m doing for my customers ))) Good job bro!

I saw this last November and thought that moving the cameras to a separate VLAN and only allowing it to talk to the NVR from a separate subnet was cool. Did it with our office's hikvision cameras just last week. The unifi switch was a bit iffy when I configured each port in the port manager but managed to get it to work. My boss liked the suggestion so much as I explained that it was a great security measure in case someone outside would disconnect the camera/s and connect it to a laptop or a malicious raspberry pi, but he immediately got the gist of it. Thank you!

Hey Tom, great video. One really important step you missed in the video was creating the networks in the Unifi controller as well. It is not shown in the video and took me ages to work out. Lucky you had an older video from 2017 that should this step. Once I completed this step as well we were away and working perfectly!! Thanks for the amazing content. Keep it up!

@crankharder123

3 жыл бұрын

Think i just ran into this as well. Lots of detail there that is missing. Presumably about what the VLAN & DHCP settings should be inside the unify controller - but no clue.

Great video - thank-you! I sat through the whole one to just revisit pfsense tinkering as I haven’t tinkered in a few years. Such great tutorials though and so clearly explained and demonstrated!

Tom, this is one of the best explanations of secure networks I have ever seen. Thank You for doing this.

@emmettbradford6983

3 жыл бұрын

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

Fantastic run through, thank you!

Thank you for doing this Lawrence

Really loved the video! great explanations, nice and easy to follow! something easy to get people thinking!

GREAT VIDEO!!! Very informative...keep up the good work Tom

Ooh. Just got my sg1100 and erx combo working. It's quite a solid setup for home use. Thanks for the useful reviews. Definitely will use this so my cameras are not flat with my other devices.

I appreciate ALL of your networking videos. Especially pfsense. Thank you!

@emmettbradford6983

3 жыл бұрын

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

I can’t tell you how much this video has help me. Thanks! And keep it going

Another nice thing to do with Cameras switch ports is they should also be protected by only allowing the Mac address of the camera.

You have made a fan out of me with these type of videos. Keep em coming bud!

@emmettbradford6983

3 жыл бұрын

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

Great video! I've only just discovered your channel and you cover this stuff very well. I would be interested to hear more about designing subnets for route aggregation and stuff like VLAN tagging.

Love this, thank you

It was very informative. Thank you for the video and the work on it.

Really great video gives me some ideas for my own home network

Cool thanks a bunch Tom , yes there are additional features one can add in pfsense like pfblocker , snort , VPN , adding to Zabbix server for monitoring , running virtualized etc , but great for home use as is .… keep smiling and have a great one :-)

Great video, can't wait for the same with a Untangle router, I would like to compare what you have done vs. what i have done with home/small business networks for VLAN, and IoT isolation. I have been able to get 5 or 6 of my fiends to move away from the cheep all-in-one router/WiFi solution once they understood how vulnerable their home networks are with a flat addressing plan.

Thanks for the time and effort.

When creating the pfsense firewall rules on each VLAN you don't need to create a rule blocking access to the firewall's web interface as all traffic is blocked by default unless there is another rule granting access (assuming the default deny configuration has not been changed in the main pfsense settings). In the example used in the video for the locked down VLANs you have a rule granting access to everything other than the private networks. As the pfsense web interface is on the private network, access will still be blocked by default with this rule.

Thank you.. the more I see you make videos on the SG-3100 the more I am considering upgrading to it from my USG. I had thought about the ER-4 but pfsense looks quite nice.

@emmettbradford6983

3 жыл бұрын

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

Great Vid specially explaining LLDP

Passed links to your videos and channel to family and friends and told them to subscribe. Thanks.

This is fantastic! Thanks

great content - thanks

Really liked this one! Big fan of pfsense and was happy to see pfsense tied in with something as nice as the ubiquiti stuff

@emmettbradford6983

3 жыл бұрын

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

Excellent video :)

Lawrence, you have a great full fan from da UP eh! Thanks for the excellent content

Thanks bro you are a great presenter

Yes please do Untangle!

Also a good reason to set the static IPs manually on each device is that if the router (DHCP server) ever goes down, they can still talk to each other. I did that with my servers at home. the rest of the devices are managed by the DHCP server.

You are awesome!

Hello , This is great for people to understand basic networking, the only thing i would change is Intra-VLAN routing on the router. For example, a VLAN want to communicate with another VLAN, The packet will need to go all the way to the router to be routed, then go back to the switch. A layer 3 managed switch with Intra-VLAN routing, route the traffic without reaching the PFsense router, but all vlan gateways should point to the switch interface IP ( Layer 3 ). if a PC on the PC network ( PC VLAN) want to open a camera ( CCTV VLAN) , the router would be involved , in a small office its fine but i recommend a layer 3 switch to handle your intra-vlan routing. Thank you, Nader

@eDoc2020

2 жыл бұрын

AFAIK most L3 switches are stateless. This makes it hard or impossible to allow TCP connections from subnet A to subnet B without also allowing subnet B to initiate connections to subnet A.

Thanks for this

This is so good.

Great video, you gave me ideas howto setup my new network, it used to be flat🤣. Your Pfsense tutorials gave my 6yo laptop a new life and provided me with new insights👍

@martintimmermans8952

4 жыл бұрын

Nice to hear you improved your lan! :D Just not sure if I understand the relation to an old laptop? Or are you now using it as your pfsense instance and routing all (including incoming/outgoing) over 1 physical port? :P If yes, are you using any IDS/IPS functions and/or VPN tunnels? What performances are you getting out of an old laptop? You could consider getting something cheap/power efficient, ie from Aliexpress (like I did).. Just search for pfsense and you'll get tons of options, anywhere from a simple j1900 to a nice i7 :)

@emmettbradford6983

3 жыл бұрын

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

best video of the year! great work!

You're good.

Stellar job again

Thanks for making this video. I tried to do this a year ago and never got it working. Your video had the missing pieces I needed to get it working. I now have a secure IoT and Camera network.

@jmcbri

4 жыл бұрын

I don't get it. If the iot crap is blocked from private networks, how do you use those devices? Wouldn't you allow the mothership ip on wan only, and allow on LAN?

@BrettMartin84

4 жыл бұрын

James McBride most iot crap wants to work inside and outside the home. To do this it needs internet access not lan access. Eg ecobee thermostat works from app -> internet -> lan > thermostat. Not directly from device to app. Therefore if you are giving an unknown device both lan and wan access it could do whatever it wants on your lan and send it over the internet. By making an iot network that can’t access the lan you secure your lan. It’s the opposite for cameras. You want them to have lan only access and no wan access.

Great vid. I manage a private school's network with pfsense, cisco switches, and unifi access points and a vpn to another campus. Separating students from teachers, restricting what students can touch is the game. We'll be adding voip phones soon, seeing how that is setup on unifi switches is nice. I'm so used to cisco's command line.

@springbok4015

5 жыл бұрын

Might want to do the same for the teachers.

@akletke1

5 жыл бұрын

@@springbok4015 Teachers have their own restrictions.

@jcnash02

5 жыл бұрын

I hate Cisco’s command line, but their GUI is improving on the SG switches.

Hey Tom, thanks for all of the help! I am setting up a SOHO network now with a Netgate SG-3100 and unifi ap and have had trouble finding the right guides for getting it setup (I am fairly new to all of this). Is there anyway you'd be able to organize a playlist from the videos you have for getting pfsense setup in a manner that would be useful for a home office/small business?

I just started researching youtube for training, and maybe I will eventually find a video that has the Office network & planning not just in the Firewall software (i assume pfsense dashboard for assignment only). I REALLY NEED A DIAGRAM, OR DRAWING OF SOME SORT... I will keep looking though. Thanks for the info

Nice one Lawrence 👍

One challenge (I've not tried this on the Unifi yet so it may not be challenging on better kit) - IoT things like TVs and Streaming Players and ChromeCast that want to be found by broadcast packets. I guess it means that the adults in the house need to be on the same network as these devices, but we can keep kids and guests off so they can't change what we're watching on the TV. I guess this is like your printers. Ours also likes broadcast but we can hand configure IP address in clients if needed.

@richardcorfield9926

3 жыл бұрын

Looks like I need an MDNS Repeater - yay for more standardised network protocols rather than the pick-some-port-and-code-it we had in the 90s when I was coding these things.

Thanks! Wondering what I would miss if I try the same setup using omada firewall.

Excellent video, I really appreciate the hint on using lldp-med to inform the phones what vlan to use.

@viaujoc

4 жыл бұрын

Another way of doing that, if you don't like adding broadcast or multicast traffic to your network, such as LLDP, is to supply option 132 (named "VLAN ID") in the DHCP leases on the OFFICE interface pointing to the PHONE VLAN ID (300 in this video). This way, when an IP phone boots up, it will first get an IP address in the OFFICE (untagged) network. When the IP phone sees that an option 132 is supplied, it will immediately release that IP address, start tagging its traffic on the VLAN ID received in option 132 and make a new DHCP request on that VLAN. The nice thing about this is that the traffic that passes through the PC port at the back of the phone will remain untagged in the OFFICE network. Most IP phones on the market support VLAN configuration with DHCP option 132, it is really easy to set up. Of course, you still need to create a port profile on the switch to supply the tagged PHONE VLAN.

@basiliodiaz1411

4 жыл бұрын

@@viaujoc Is this entered in the Additional BOOTP/DHCP Options section? Should it be entered as a String or Text? Is the Value format (vlanid=300)? Thanks, in advance.

@viaujoc

4 жыл бұрын

@@basiliodiaz1411 It is indeed entered in the Additional BOOTP/Options section in the pfSense DHCP Server for the OFFICE interface (the interface on the untagged VLAN). It is not clearly documented how the option should be entered: as a string or an integer, with or without quotes. I guess it depends on how the phone firmware was programed to handle that setting. In my case, I am using Yealink T4 phones and I have configured option Number 132, Type String and Value "300" (with the quotes in the field). You should check your IP phone documentation about how it handles the VLAN ID option in case this method does not work for you, many phone will support more than one format. In my case "VID=300" (still including the quotes) would probably work too. If you have many brands of phones on your network with different VLAN ID option requirements, you may need to configure each brand to expect a different DHCP VLAN ID option number in the phone configuration: Yealink on option 132, Cisco on option 133, Fanvil on option 130, ... This way, you may avoid struggling to produce a single format that will satisfy every brand at the same time. Don't forget to also tag the switch port with the Voice VLAN. This is a personal experience: I cursed during an hour trying to find a working DHCP option that would allow my phone to boot and all that time I had forgotten to add the switch port as a tagged member on the voice VLAN.

@basiliodiaz1411

4 жыл бұрын

@@viaujoc I failed to mention that the phones are Mitel 5320's. I found some information indicating to try Option 43 but failing that, to use an Option between 128-132. I'll give that a try and see what works. Thank you for your reply.

@viaujoc

4 жыл бұрын

@@basiliodiaz1411 Mitel phone seems to use a single "Magic" configuration string for VLAN ID, TFTP server address and other basic settings on option 43 or 156. Some guy seems to have figured it out: unixwiz.net/techtips/mitel-ipphone-networking.html. pfSense does accept to push option 43 in the Additional option, maybe you should try it out. In this case, because the DHCP option supplies more than the VLAN ID, you have to push it both on the OFFICE (untagged) VLAN and on the VOICE VLAN.

Nice one Tom

Awesome video

Where do you put the printers (and stuff like that)?? I use to put them on a seperat VLAN and only allow access to the printserver/smtp for scan.

Interesting detail I hadn't observed before this walk-through is pfSense firewall rules are created/applied per interface. My experience is with Checkpoint and it's not the case there (at least it wasn't the case 10 years ago).

Tip: The problem you discuss at 3:00 can be mitigated with IPv6 addressing. :)

great video; how would you handle EPOS?

Love ya work very informative indeed thanks chap. And yes could you do Untangle equivalent, please?

I suppose another way to do it would be to have a LAN, a WAN, outside access rules, and then point to a Layer 3 switch on the internal LAN which can route, create vlans, ACL's and so forth.

I have been looking for an example that I can use in my home lab. My goal is to replicate a similar network topology for professional development. Thanks!

Would it be beneficial to get a Ubiquiti Edge Switch (ES-16-150W) instead of a Ubiquiti UniFi Switch? What are the pros and cons?

7:40 Yes! And that's why I hate UDM Pro :-) Anything like this config would be too complicated there.

Howdy. I appreciate your videos. I'm late to the party. I have a Protectli with Pfsense on it. And a tplink tl-sg1024DE behind it. At this point I think I want/need 5 or 6 VLANS. Would you recommend having pfsense to control the vlans and trunk to the tp link switch OR have the switch to handle the vlans?

So I followed this guide, as I am new to UI but not pf/opn but I cant connect to a IoT SSID now.

Tom for President #2020

While I do get why some people often pick up on blocking addresses normally associated with internal LAN addresses, there's another thing to bear in mind; ISPs now are starting to use CGNAT, so you're going to see "internal" IPs in some WAN connections.

you mentioned that the usg doesnt have all the features needed in the firewall rules could you use the usg pro?

Hi Tom. Thanks for another great video. Not sure if you said it in this video, but I know I've heard you comment/remind us that when you setup VLANs this way, it's all on one physical cable/port. Meaning, bandwidth can be a factor. So when you have a Netgate 4100 for example, I would ask why not utilize the four ports and spread those networks/VLANs across them? Maybe LAN and OFFICE on one port, CAMERAS on one port, and the rest PHONES/GUEST/IOT and a third? Maybe keep one port open for future needs. Again, looking for the Pros/Cons on this design. Thanks in advance.

@LAWRENCESYSTEMS

Жыл бұрын

Using vlan instead of individual ports is for convenience

Similar Untangle Video would be great!

@emmettbradford6983

3 жыл бұрын

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

Add the raspberry pi on using a Ubiquiti Nanoswitch or similar and the camera won't even be offline to attract attention beyond the time it takes to plug that in.

Weird seeing a cameras link state at 1gbps.. Good work!

@sitte24

5 жыл бұрын

It sure is weird because it is not needed, even with the 4k resolution. But hey it looks nice

How do the phones and devices know what vlan network to connect to? Is that with the dhcp reservation? I’m just confused because you didn’t show reserving the phone ?

Liked the video. Would have liked to see what the UniFi dashboard looked like with the pfsense appliance matched up with the UniFi switch and AP.

@EciOwnsYou

5 жыл бұрын

It doesn’t show anything. Only shows UniFi hardware. Otherwise blank.

Hi! Thanks for the video. I noticed that you put an explicit block rule in the firewall configs for "This firewall" over all interfaces... I thought it was block by default? In my personal setup I have an alias called "PrivateNetworks" consisting of "192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8", all of my interfaces are in the 192.168 range, and my allow rules all say "Destination !PrivateNetworks"... Above these allow rules i configure any rules that hit nodes on the private network / across subnets.... Is this sufficient??? I'm pretty new to writing my own firewall rules

With all these vlans. Cross talk packets must go back to the router right? If i am moving a large file from device A to Device B will that go back to router to change vlans? How often would One need to worry about saturating the GB link?

Hey Tom, great video. I see that the LAN network (192.168.5.0/24) is more like a management network for the devices - firewall, switch, camera, etc. I believe the VLAN for this network is the default VLAN 1 right? So, I'd like to ask, what if I want to change that VLAN ID to something else? Is it possible?

Can you do a video like this, but address VLANs by MAC address and or port and MAC VLANs on the same network?

I wouldn’t have thought routing HD Cameras through the FW would be a good idea. Maybe it’s quite common I don’t deal a lot with CCTV side of things.

14:50 I'm confused. Why wouldn't an allow only to WAN interface rule not work? Or not be easier/better?

I've found the Cloud key extremely limited - on the first one at least, mongodb will break if you turn up the logging.

@peterpain6625

5 жыл бұрын

Same here. Went to a vm which is working flawlessly.

How would one handle single PFSense with multiple NICs aggregated to multiple Unifi Switches (where cross LACP is not possible)

Hi Tom! Thank you so much for the video. I would like to know how you were able to put 2500baseT Speed duplex for the LAN Network? Etherchannel? Thanks again

@danielknight4575

4 жыл бұрын

His environment runs on virtualization. It's likely sitting on a server with SFP+ ports. If you have a spare PCIex4/8 slot in your PFSense server, you could add an SFP+ card and link it to a compatible switch. It will downclock to 2500BaseT for none 10Gb switches.

@viaujoc

4 жыл бұрын

The SG-3100 is connected internally to the switch at the back at 2.5GBase-T Here is the description from Netgate web site: 2x 1GbE, configured as dual WAN or one WAN one LAN four-port 1 gbps Marvell 88E6141 switch, uplinked at 2.5 gbps to the third port on the SoC for LAN. So, in reality, the pfSense "PC" inside the SG-3100 box has only 3 physical ports: two at 1Gbps that are exposed as RJ45 connectors at the back (WAN and OPT1) and one 2.5Gbps connected by the circuit board to a Marvell switch which is exposing four 1Gbps RJ45 ports (LAN1 to LAN4).

What would you propose for multiple cameras? A POE switch on your port you set up for the camera in your example (like a dumb poe switch extending that 1 port) or map more ports to the smart switch?

@LAWRENCESYSTEMS

5 жыл бұрын

ideally mapping more ports to the smart switch.

Hi, I have a Microsoft Exchange server 2016 sitting behind my pfsense firewall and I am not receiving or sending any external emails, I have set NAT for all the ports that the exchange server will use allow but it still doesn't send nor receive external emails. is there another way to allow my exchange server to still send and receive external emails behind my pfsense firewall. thank you

Hi Tom! Hoping that you can make a tutorial about running PFSense with Windows Active Directory. Where AD has the DHCP and DNS instead in PFSense :D

@LAWRENCESYSTEMS

3 жыл бұрын

Just turn off DHCP in pfsense and turn on DHCP in Windows.

Everything looks great. Had a few questions. Once you setup the VLans in pFsense, do they automatically show up in the Unifi switch? Regarding the Unifi Protect network, wouldn't blocking the cameras from accessing the internet block firmware updates when they become available or would it try and pull the update from Unifi Protect? Worse case scenario, someone disconnects the switch from the pFsense box and plug it in to their pc or Raspberry Pi, would they have access to all VLans if it they make it appear they are a switch?

@LAWRENCESYSTEMS

5 жыл бұрын

As I said in the video, you need to create them both on the pfsense and UniFi, the NVR is pushing the firmware updates so as long as it has internet access it will push them to the camera, if someone has physical access they can move what ever port they want.

Hi Tom, apologies for questioning an old video, but I thought it pertinent. Could you please do a video explaining how you would set up an office / home environment with a network that has over 253 devices, so keeping .1 as the gateway and .255 as a broadcast, if you had 300 devices how would you configure PFSense securely to segment and talk across the networks? Thanks.

@LAWRENCESYSTEMS

Жыл бұрын

If you want them all on the same network just use a /22 instead of a /24.

Why have the source as IOTcrap net on the (Block Firewall Web Access) rule and as (any) on the other networks?

Isn’t there a limit to 4 or 8 SSIDs per AP? And doesn’t the throughput drop dramatically the more SSIDs you create, due to all the beaconing? How smart is it to create a ton of SSIDs, one per VLAN, and is there a way around it?

Excellent presentation for a very powerful tool ready to be used by a SOHO user/admin. I would alos like to ask a question if anyone knows. Can I setup any LAN port on a netgate 2100 or 4100 as WAN for VPN failover? Thank you in advance to anyone that knows.

@LAWRENCESYSTEMS

Жыл бұрын

The ports can be assigned to different purposes.