1

I have an Unifi AP which is capable of making multiple wlans. The AP is connected to a tplink smartswitch from which it gets internet access and sees everything in the network. The switch is connected to the gateway server, the AP gets it's ip from there. I'd like to make 2 wlans, one of them has to have access to the current network and the other one would be a "guest" wlan which would have only internet access and would not see the internal network with all the other servers on it. Is it be possible to have one of the guest wlan in a vlan so it wouldn't see the internal network (only internet access), and the leave the other one as it is without setting any vlan for it?

Thanks in advance!

Improve this question
5
  • What are the models of your network equipment?
    – Ron Maupin ♦
    Jul 12, 2016 at 13:21
  • Unifi AP AC LR and TP-Link T1600G-28TS or there's another switch which I can connect it to, which is a TL-SG2424
    – goshin
    Jul 12, 2016 at 13:33
  • What about your router(s)? Where are you doing NAT?
    – Ron Maupin ♦
    Jul 12, 2016 at 13:39
  • There's a server with pfSense installed on it. That's where the routing and the nat happens.
    – goshin
    Jul 12, 2016 at 13:50
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14, 2017 at 21:17

1 Answer 1

Reset to default
2

Just create a second VLAN for your guest and make sure the uplink ports have the VLAN tagged all the way to your server that is performing the routing/NAT. So tag the new VLAN on the edge port the server is connecting to as well.

You have to make sure that your server NIC does understand VLAN tags. If it does not, you will need to get one that does or install a second NIC that will be dealing with the additional VLAN/Subnet.

On the edge port where your access point is connecting, make sure that the guest VLAN is tagged and your main VLAN is either tagged or untagged, depending on the configuration on the access point.

When creating your WLAN, make sure that you specify which VLAN each WLAN has to use.

So for Main SSID you can say VLAN1, and your Guest SSID, VLAN2. This will make sure that the connection is placed on the correct VLAN once a client connects to the AP.

For the guest subnet, you need to assign a range of IP addresses, with your server being the gateway. You will also need to deal with DHCP on this VLAN so you need some kind of DHCP relay-agent on the server but I am not 100% sure how this would be configured on your setup, not knowing all the details. Normally you will confiure this on your switch that has the vlan interface configured, which in this case I believe would be your server. If this server is also a DHCP server, then I think as long as the new DHCP scope has been created, you should be all good.

Get pfsense to do the routing from your guest VLAN to your WAN interface but do not allow it route to the main VLAN and obviously configure NAT to allow this new subnet to get out to the Internet.

Hope this helps you on your quest.

SleepyMan

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.