1

I currently setting up my home network with a Dell PowerEdge R300 running pfSense as my router and a Cisco Catalyst 3560G switch. In the end I want to have two separate networks, one that is connected to the internet with a LAN, and another that consists of only LAN for pen-testing and various other things that I want to have completely cut off from the internet.

Is this achievable through VLANS or other pfSense configurations? Would the VLAN be configured in pfSense, on my switch, or both?

If this is not achievable through VLANS, what would be the best method? I would prefer not to run a second routing machine but I will if I have to.

Improve this question
3
  • Just an FYI: I think you're going to get tired of hearing the fans. You really don't need a wired network at all in your house.
    – Ronnie Smith
    Commented Sep 11, 2016 at 2:45
  • @RonRoyston It would be quite hard to learn more about enterprise grade routing, switching, and network services if I used only a typical consumer grade wireless router.
    – SuperAdmin
    Commented Mar 23, 2017 at 23:16
  • You can run all the enterprise/corporate grade networking equipment as virtual machines, hosted. Penny's per hour, literally. For example, Cisco's CSR1000v in AWS, or heck run it local on your laptop with Oracle's Virtual Box if you want...
    – Ronnie Smith
    Commented Mar 23, 2017 at 23:20

2 Answers 2

Reset to default
2

Yes this is achievable with VLANs.

Just create 2 vlans on the switch, in the first you put the inside interface of your pfSense router/firewall and all devices that need Internet access, in the other you put all devices that you want to be cut off. As long as you do not add a router to that second vlan, the devices in that vlan will only be able to communicate with each other.

Improve this answer
10
  • The setup works exactly as you said, however I neglected to think about how machines on this VLAN will obtain an IP address. Is it feasible to enable DHCP on only one VLAN on my switch or can pfSense handle the DHCP without allowing a connection to my WAN or other LANs? Alternatively I can just use the self assigned 169 addresses.
    – SuperAdmin
    Commented Sep 11, 2016 at 7:52
  • Should be no problem, you will need to configure an SVI in the pentest vlan but as long as you don't have an SVI in the other vlan that's OK.
    – hertitu
    Commented Sep 11, 2016 at 9:08
  • This is wrong. what is the point of the firewall in your topology?
    – Ronnie Smith
    Commented Sep 12, 2016 at 0:56
  • @RonRoyston please clarify why you think it is wrong instead of writing just a blanket statement. I think you did not only misread the question but also misunderstood my answer, perhaps because I used the word Router (like the OP did) to refer to the Dell; I've edited the answer to clarify that. So obviously the role of the firewall is to protect the first (inside) vlan. The second vlan doesn't need a firewall because it is completely isolated, which is what the OP asked.
    – hertitu
    Commented Sep 12, 2016 at 5:24
  • Maybe I should also add that I assume that the outside interface of the Dell is directly connected to the Internet router so there is no need for an outside VLAN. Of course one can still be created if need be (without an SVI)
    – hertitu
    Commented Sep 12, 2016 at 5:36
0

Yes this is achievable with VLANs.

I imagine you would want penetration tester to sit in the less secure / outsize zone. So, plug the Internet link, pen testing server/service, and Dell server into an 'outside' VLAN on the switch. Plug your computers and Dell into the 'inside' VLAN on the switch. Make the Dell the layer 3 gateway for both inside endpoints. No routing on the switch, the Dell is the layer 3 gateway and firewall which has 2 interfaces (whether physical or logical).

Improve this answer
4
  • 2
    I think you missed the "completely cut off from the internet" part of the question.
    – hertitu
    Commented Sep 11, 2016 at 7:13
  • No, you don't understand the answer. Post your specific question and I will answer it.
    – Ronnie Smith
    Commented Sep 12, 2016 at 1:02
  • 2
    OK, how is the pen tester completely cut off from the Internet in your solution?
    – hertitu
    Commented Sep 12, 2016 at 5:25
  • The penetration testing server/service typically needs access to everything. If it's isolated it can't work.
    – Ronnie Smith
    Commented Sep 12, 2016 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.