Office Network Design and Planning with VLANs, LLDP, Rules, IoT, Guest using UniFi & pfsense

Amazon Affiliate Store
➡️ www.amazon.com...
Gear we used on Kit (affiliate Links)
➡️ kit.co/lawrenc...
Try ITProTV free of charge and get 30% off!
➡️ go.itpro.tv/lts
Use OfferCode LTSERVICES to get 5% off your order at
➡️ lawrence.video...
Tesla Referral Program Offer
🚘 www.tesla.com/...
Lawrence Systems Shirts and Swag
👕 teespring.com/...
Digital Ocean Offer Code
➡️ m.do.co/c/85de...
HostiFi UniFi Cloud Hosting Service
➡️ hostifi.net/?v...
Protect you privacy with a VPN from Private Internet Access
➡️ www.privateint...
Google Fi Service Referral Code
📱g.co/fi/r/TA02XR
More Of Our Affiliates that help us out and can get you discounts!
➡️ www.lawrencesy...
Twitter
🐦 / tomlawrencetech
Patreon
🔗 / lawrencesystems
Our Forums
🔗 forums.lawrenc...
GitHub
🔗 github.com/law...
Discord
🔗 / discord
Our Web Site
🔗 www.lawrencesy...
PIA Internet Access Affiliates Link
www.privateint...
Office Network Design and Planning with VLANs, LLDP, Rules, IoT, Guest using UniFi & pfsense. This network was built with the following hardware
UniFi Cloudkey Gen 2
amzn.to/2Yl5skc
Ubiquiti UniFi Switch - 24 Ports Managed (US-24-250W)
amzn.to/2RBCIRr
Ubiquiti Networks Unifi Protect 4K Ubiquiti G4-Pro
amzn.to/2X3msdh
Netgate SG-3100
www.netgate.co...
Review of the SG-3100
• Netgate SG-3100 Teardo...
#pfsense #Firewalls

[@823Labs]

I've been in IT for 20 years and this was the most succinct explanation on network design I've seen... well done.

Finally, a video that explains VLANs to actual humans! I wish I had seen it earlier...

[@LAWRENCESYSTEMS]

Happy this video helped a fellow human.

[@tomferrin1148]

This "best practice" video tutorial never grows old. I've used it as the basis for several SOHO setups and have never gone wrong with it. It covers all the common types of devices one might want to connect to a SOHO network. I especially like the LLDP-MED port provisioning for connecting VoIP phones having a pass-through network jack for desktop computers. The UI on the Unifi controller may have changed some since this video was made, but the same functionality is still there and this video is still just as relevant as when it came out 4+ years ago.

[@LAWRENCESYSTEMS]

Thanks

[@jeffmeyers3837]

3:45 Interface -> Assignments -> VLANs (Creates IOTCrap VLAN & iface) 6:00 DHCP Server 8:30 Firewall Rules 15:00 Unifi switch VLAN settings 26:15 Shows physical devices and connections

[@greenmountainitsolutions4722]

Tom, you make it too easy! I can't imagine how much time I would have saved if I had this video when I was starting out. That being said I think I learned more by getting lost and finding my way back. Thank you!

[@clydebryant2665]

Tom, this is an excellent video and covers a number of configuration consideration I need to address when revamping my home/lab network. I'm a retired systems programmer/Architect for the past 12 years, networking is new to me beyond the basic home router setup. I'm able to use your videos in my education on more complex networking configuration concepts, so, thanks and keep up the great videos. Regards

[@bobhcs]

Tom, I've been watching your channel for a couple months and just wanted to say thanks for all great information, training and tips!!! I have been designing my dream home network for a new house that we are having built. I am starting to test some of the network hardware that I chose with the help and insight of all your experience in IT. I don't always get it the first time but I can't count how many times now I am working on something and think "boy did Tom have that right!" or "that's what he meant by that!". Thanks Tom!!!! And,now I finally joined your KZbin channel and I'm also going to check out your website!

[@viaujoc]

Great setup and great explanation! I like the fact that you made the LAN into an IT management zone and make the regular users connect to another zone (OFFICE). This way, the pfSense anti-lock out rule will always bring the pfSense UI to the management zone and not back into the user network. If there is IT staff on-site, they get to have ports to the LAN zone in their office. If there is no IT staff on-site, which is common in small businesses, I use a VPN to get into that zone. Of course, I always keep an available untagged port on that zone (VLAN) on the main switch just in case the VPN fails for some reason and I need a physical access to the management network to repair something.

[@peterdee1900]

Hey Tom, great video. One really important step you missed in the video was creating the networks in the Unifi controller as well. It is not shown in the video and took me ages to work out. Lucky you had an older video from 2017 that should this step. Once I completed this step as well we were away and working perfectly!! Thanks for the amazing content. Keep it up!

[@crankharder123]

Think i just ran into this as well. Lots of detail there that is missing. Presumably about what the VLAN & DHCP settings should be inside the unify controller - but no clue.

[@itpugil]

I saw this last November and thought that moving the cameras to a separate VLAN and only allowing it to talk to the NVR from a separate subnet was cool. Did it with our office's hikvision cameras just last week. The unifi switch was a bit iffy when I configured each port in the port manager but managed to get it to work. My boss liked the suggestion so much as I explained that it was a great security measure in case someone outside would disconnect the camera/s and connect it to a laptop or a malicious raspberry pi, but he immediately got the gist of it. Thank you!

[@alejandrovelasquez247]

Another nice thing to do with Cameras switch ports is they should also be protected by only allowing the Mac address of the camera.

[@tpagden]

Fantastic. I made some changes to address my particular setup (pfsense as a virtual machine within truenas scale with multiple bridged vlans), but this remains a fantastic resource --- 4 years later. Thank you!

[@adrianvesnaver]

When creating the pfsense firewall rules on each VLAN you don't need to create a rule blocking access to the firewall's web interface as all traffic is blocked by default unless there is another rule granting access (assuming the default deny configuration has not been changed in the main pfsense settings). In the example used in the video for the locked down VLANs you have a rule granting access to everything other than the private networks. As the pfsense web interface is on the private network, access will still be blocked by default with this rule.

[@patricwinger5199]

This should be the first watch for all that want to tinker with home networks. Tank you Lawrence for taking the time and educating us.

[@richardcorfield9926]

One challenge (I've not tried this on the Unifi yet so it may not be challenging on better kit) - IoT things like TVs and Streaming Players and ChromeCast that want to be found by broadcast packets. I guess it means that the adults in the house need to be on the same network as these devices, but we can keep kids and guests off so they can't change what we're watching on the TV. I guess this is like your printers. Ours also likes broadcast but we can hand configure IP address in clients if needed.

[@richardcorfield9926]

Looks like I need an MDNS Repeater - yay for more standardised network protocols rather than the pick-some-port-and-code-it we had in the 90s when I was coding these things.

[@ejbully]

I appreciate ALL of your networking videos. Especially pfsense. Thank you!

[@emmettbradford6983]

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

[@Red1Wollip]

Tom, this is one of the best explanations of secure networks I have ever seen. Thank You for doing this.

[@emmettbradford6983]

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

[@naderbarakat3001]

Hello , This is great for people to understand basic networking, the only thing i would change is Intra-VLAN routing on the router. For example, a VLAN want to communicate with another VLAN, The packet will need to go all the way to the router to be routed, then go back to the switch. A layer 3 managed switch with Intra-VLAN routing, route the traffic without reaching the PFsense router, but all vlan gateways should point to the switch interface IP ( Layer 3 ). if a PC on the PC network ( PC VLAN) want to open a camera ( CCTV VLAN) , the router would be involved , in a small office its fine but i recommend a layer 3 switch to handle your intra-vlan routing. Thank you, Nader

[@eDoc2020]

AFAIK most L3 switches are stateless. This makes it hard or impossible to allow TCP connections from subnet A to subnet B without also allowing subnet B to initiate connections to subnet A.

[@mikelawson3304]

Thank you Lawrence that is exactly the same as my network. FYI, one thing that needs to be added is dhcp snooping needs to be disabled on vlans due to bug on usw Mike

[@AlbaTech]

Hi Tom, thanks for the great video. I've been trying to get my UniFi cameras on an isolated VLAN for the exact reasons you described. One of the mistakes I had been making was giving the G3 a static IP so when I set the port to the 'video' profile I lost connection to the Protect server. But having watched this I've got it all sorted. Keep up the good work.

[@peterfrenchsa]

Great video - thank-you! I sat through the whole one to just revisit pfsense tinkering as I haven’t tinkered in a few years. Such great tutorials though and so clearly explained and demonstrated!

[@BrettMartin84]

Thanks for making this video. I tried to do this a year ago and never got it working. Your video had the missing pieces I needed to get it working. I now have a secure IoT and Camera network.

[@jmcbri]

I don't get it. If the iot crap is blocked from private networks, how do you use those devices? Wouldn't you allow the mothership ip on wan only, and allow on LAN?

[@BrettMartin84]

James McBride most iot crap wants to work inside and outside the home. To do this it needs internet access not lan access. Eg ecobee thermostat works from app -> internet -> lan > thermostat. Not directly from device to app. Therefore if you are giving an unknown device both lan and wan access it could do whatever it wants on your lan and send it over the internet. By making an iot network that can’t access the lan you secure your lan. It’s the opposite for cameras. You want them to have lan only access and no wan access.

[@DonGerico]

Thank you.. the more I see you make videos on the SG-3100 the more I am considering upgrading to it from my USG. I had thought about the ER-4 but pfsense looks quite nice.

[@emmettbradford6983]

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

[@MajesticBlueFalcon]

You have made a fan out of me with these type of videos. Keep em coming bud!

[@emmettbradford6983]

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

[@jbb6372]

Really loved the video! great explanations, nice and easy to follow! something easy to get people thinking!

[@rudypieplenbosch6752]

Great video, you gave me ideas howto setup my new network, it used to be flat🤣. Your Pfsense tutorials gave my 6yo laptop a new life and provided me with new insights👍

[@martintimmermans8952]

Nice to hear you improved your lan! :D Just not sure if I understand the relation to an old laptop? Or are you now using it as your pfsense instance and routing all (including incoming/outgoing) over 1 physical port? :P If yes, are you using any IDS/IPS functions and/or VPN tunnels? What performances are you getting out of an old laptop? You could consider getting something cheap/power efficient, ie from Aliexpress (like I did).. Just search for pfsense and you'll get tons of options, anywhere from a simple j1900 to a nice i7 :)

[@emmettbradford6983]

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

[@ronaldvargo4113]

Great video, can't wait for the same with a Untangle router, I would like to compare what you have done vs. what i have done with home/small business networks for VLAN, and IoT isolation. I have been able to get 5 or 6 of my fiends to move away from the cheep all-in-one router/WiFi solution once they understood how vulnerable their home networks are with a flat addressing plan.

[@mx2ce782]

Lawrence, you have a great full fan from da UP eh! Thanks for the excellent content

[@Jamesaepp]

Tip: The problem you discuss at 3:00 can be mitigated with IPv6 addressing. :)

[@akletke1]

Great vid. I manage a private school's network with pfsense, cisco switches, and unifi access points and a vpn to another campus. Separating students from teachers, restricting what students can touch is the game. We'll be adding voip phones soon, seeing how that is setup on unifi switches is nice. I'm so used to cisco's command line.

[@springbok4015]

Might want to do the same for the teachers.

[@akletke1]

@@springbok4015 Teachers have their own restrictions.

[@jcnash02]

I hate Cisco’s command line, but their GUI is improving on the SG switches.

[@RM-hy4so]

I can’t tell you how much this video has help me. Thanks! And keep it going

[@Crazy--Clown]

Great Vid specially explaining LLDP

[@asdf51501]

I suppose another way to do it would be to have a LAN, a WAN, outside access rules, and then point to a Layer 3 switch on the internal LAN which can route, create vlans, ACL's and so forth.

[@CrankyCoder]

Really liked this one! Big fan of pfsense and was happy to see pfsense tied in with something as nice as the ubiquiti stuff

[@emmettbradford6983]

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

[@RM-hy4so]

Passed links to your videos and channel to family and friends and told them to subscribe. Thanks.

[@nvelopd]

Yes please do Untangle!

[@vadim282]

Exactly what i’m doing for my customers ))) Good job bro!

[@joefunk462]

Hi Tom. Thanks for another great video. Not sure if you said it in this video, but I know I've heard you comment/remind us that when you setup VLANs this way, it's all on one physical cable/port. Meaning, bandwidth can be a factor. So when you have a Netgate 4100 for example, I would ask why not utilize the four ports and spread those networks/VLANs across them? Maybe LAN and OFFICE on one port, CAMERAS on one port, and the rest PHONES/GUEST/IOT and a third? Maybe keep one port open for future needs. Again, looking for the Pros/Cons on this design. Thanks in advance.

[@LAWRENCESYSTEMS]

Using vlan instead of individual ports is for convenience

[@NinoM4sterChannel]

Also a good reason to set the static IPs manually on each device is that if the router (DHCP server) ever goes down, they can still talk to each other. I did that with my servers at home. the rest of the devices are managed by the DHCP server.

[@rgtechnologies2746]

GREAT VIDEO!!! Very informative...keep up the good work Tom

[@VredesbyrdNoir]

Great video! I've only just discovered your channel and you cover this stuff very well. I would be interested to hear more about designing subnets for route aggregation and stuff like VLAN tagging.

[@m.m.m.c.a.k.e]

Thanks bro you are a great presenter

[@MarvinFroeder]

Thanks! Wondering what I would miss if I try the same setup using omada firewall.

[@ifscale3]

Excellent video, I really appreciate the hint on using lldp-med to inform the phones what vlan to use.

[@viaujoc]

Another way of doing that, if you don't like adding broadcast or multicast traffic to your network, such as LLDP, is to supply option 132 (named "VLAN ID") in the DHCP leases on the OFFICE interface pointing to the PHONE VLAN ID (300 in this video). This way, when an IP phone boots up, it will first get an IP address in the OFFICE (untagged) network. When the IP phone sees that an option 132 is supplied, it will immediately release that IP address, start tagging its traffic on the VLAN ID received in option 132 and make a new DHCP request on that VLAN. The nice thing about this is that the traffic that passes through the PC port at the back of the phone will remain untagged in the OFFICE network. Most IP phones on the market support VLAN configuration with DHCP option 132, it is really easy to set up. Of course, you still need to create a port profile on the switch to supply the tagged PHONE VLAN.

[@basiliodiaz1411]

@@viaujoc Is this entered in the Additional BOOTP/DHCP Options section? Should it be entered as a String or Text? Is the Value format (vlanid=300)? Thanks, in advance.

[@viaujoc]

@@basiliodiaz1411 It is indeed entered in the Additional BOOTP/Options section in the pfSense DHCP Server for the OFFICE interface (the interface on the untagged VLAN). It is not clearly documented how the option should be entered: as a string or an integer, with or without quotes. I guess it depends on how the phone firmware was programed to handle that setting. In my case, I am using Yealink T4 phones and I have configured option Number 132, Type String and Value "300" (with the quotes in the field). You should check your IP phone documentation about how it handles the VLAN ID option in case this method does not work for you, many phone will support more than one format. In my case "VID=300" (still including the quotes) would probably work too. If you have many brands of phones on your network with different VLAN ID option requirements, you may need to configure each brand to expect a different DHCP VLAN ID option number in the phone configuration: Yealink on option 132, Cisco on option 133, Fanvil on option 130, ... This way, you may avoid struggling to produce a single format that will satisfy every brand at the same time. Don't forget to also tag the switch port with the Voice VLAN. This is a personal experience: I cursed during an hour trying to find a working DHCP option that would allow my phone to boot and all that time I had forgotten to add the switch port as a tagged member on the voice VLAN.

[@basiliodiaz1411]

@@viaujoc I failed to mention that the phones are Mitel 5320's. I found some information indicating to try Option 43 but failing that, to use an Option between 128-132. I'll give that a try and see what works. Thank you for your reply.

[@viaujoc]

@@basiliodiaz1411 Mitel phone seems to use a single "Magic" configuration string for VLAN ID, TFTP server address and other basic settings on option 43 or 156. Some guy seems to have figured it out: unixwiz.net/techtips/mitel-ipphone-networking.html. pfSense does accept to push option 43 in the Additional option, maybe you should try it out. In this case, because the DHCP option supplies more than the VLAN ID, you have to push it both on the OFFICE (untagged) VLAN and on the VOICE VLAN.

[@3waver]

Similar Untangle Video would be great!

[@emmettbradford6983]

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

[@davidbarnett1826]

I just started researching youtube for training, and maybe I will eventually find a video that has the Office network & planning not just in the Firewall software (i assume pfsense dashboard for assignment only). I REALLY NEED A DIAGRAM, OR DRAWING OF SOME SORT... I will keep looking though. Thanks for the info

[@QuickQuips]

Ooh. Just got my sg1100 and erx combo working. It's quite a solid setup for home use. Thanks for the useful reviews. Definitely will use this so my cameras are not flat with my other devices.

[@woxit6107]

Thanks for the time and effort.

[@martincerveny2284]

7:40 Yes! And that's why I hate UDM Pro :-) Anything like this config would be too complicated there.

[@Deoverse]

thankyou. i learned a lot in this video

[@Setola]

best video of the year! great work!

[@lanceeilers5061]

Cool thanks a bunch Tom , yes there are additional features one can add in pfsense like pfblocker , snort , VPN , adding to Zabbix server for monitoring , running virtualized etc , but great for home use as is .… keep smiling and have a great one :-)

[@ianbird6997]

Nice one Lawrence 👍

[@stevenmishos]

Interesting detail I hadn't observed before this walk-through is pfSense firewall rules are created/applied per interface. My experience is with Checkpoint and it's not the case there (at least it wasn't the case 10 years ago).

[@SimpleFlyTech]

Weird seeing a cameras link state at 1gbps.. Good work!

[@sitte24]

It sure is weird because it is not needed, even with the 4k resolution. But hey it looks nice

[@zxcvb_bvcxz]

I've found the Cloud key extremely limited - on the first one at least, mongodb will break if you turn up the logging.

[@peterpain6625]

Same here. Went to a vm which is working flawlessly.

[@thespecialist75]

So I followed this guide, as I am new to UI but not pf/opn but I cant connect to a IoT SSID now.

[@pfsmith007]

You're good.

[@Wilksey37]

Hi Tom, apologies for questioning an old video, but I thought it pertinent. Could you please do a video explaining how you would set up an office / home environment with a network that has over 253 devices, so keeping .1 as the gateway and .255 as a broadcast, if you had 300 devices how would you configure PFSense securely to segment and talk across the networks? Thanks.

[@LAWRENCESYSTEMS]

If you want them all on the same network just use a /22 instead of a /24.

[@rider275]

I have been looking for an example that I can use in my home lab. My goal is to replicate a similar network topology for professional development. Thanks!

[@johnmcquay82]

While I do get why some people often pick up on blocking addresses normally associated with internal LAN addresses, there's another thing to bear in mind; ISPs now are starting to use CGNAT, so you're going to see "internal" IPs in some WAN connections.

[@vdarkobar]

Tom for President #2020

[@lightingman117]

14:50 I'm confused. Why wouldn't an allow only to WAN interface rule not work? Or not be easier/better?

[@generalregistry]

Thanks for this

[@NasirMxd]

Thank you for doing this Lawrence

[@zyghom]

super nice setup however IoT crap (and home) usually needs a bit more thinking: 1- IoT in separate network, i.e. x.x.10.0 and not allowed to go to any other subnet or internet but 2- Home Assistant in which network? also x.x.10.0? this way all IoT are connecting easily to HA. But HA needs access to internet (updates) - so maybe not the same subnet as IoT crap. But if HA is in other i.e. 20.0 then IoT requires rules to allow 10.0 to go to Home Assistant IP on all possible ports (Because different IoT devices talk to HA on different ports) 3- then home devices (laptops, desktops, mobiles) - another network i.e. 30.0? but then 30.0 needs access to HA so to 20.0 4- cameras - they need not only NVR access but also 10.0 (HA) - of course if cameras have no access to internet, then mobile apps don't work from the phones - they only route through cloud 5- other servers i.e. plex, samba etc - separate network or the same with Home Assistant? It is easy to spit everything to 5 VLANs using VLAN and switch but it is more difficult to match everything together and proper routing I.e. samba shares don't announce their availability to other subnets so mounting inter subnets shares require manual intervention - it is not having high "wife acceptance factor" ;-) One more thing makes me crazy recently: random MAC assignments by devices i.e. phones or computers - this way it is difficult to apply any rule on firewall. How can you identify the device if the only ID it was supposed to be fixed - MAC - is now variable?

[@bennettgould5546]

Can you do a video like this, but address VLANs by MAC address and or port and MAC VLANs on the same network?

[@UnkyjoesPlayhouse]

Excellent video :)

[@FSCMV6]

This is an awesome tutorial. One thing I am uncertain of though - I have a UCG-Ultra with defined networks / VLANS. If I put a USW-PRO-MAX behind it and have clients connected at 2.5 (but on different vlans) - connectivity between those devices would be limited to the routing speed of the UCG correct? Or am I way off base?

[@jeffluongo7103]

Liked the video. Would have liked to see what the UniFi dashboard looked like with the pfsense appliance matched up with the UniFi switch and AP.

[@EciOwnsYou]

It doesn’t show anything. Only shows UniFi hardware. Otherwise blank.

[@kristopherleslie8343]

Hopefully we can get a 2023 version ❤

[@LAWRENCESYSTEMS]

Soon

[@TheWrathRE]

Fantastic run through, thank you!

[@Fisher1374]

Hey Tom, thanks for all of the help! I am setting up a SOHO network now with a Netgate SG-3100 and unifi ap and have had trouble finding the right guides for getting it setup (I am fairly new to all of this). Is there anyway you'd be able to organize a playlist from the videos you have for getting pfsense setup in a manner that would be useful for a home office/small business?

[@pepeshopping]

Printers do not go discover devices on the network. They provide mDNS (bonjour) so the DEVICES can find the printer through multicast. Trivial to get them to work over subnets (Avahi).

[@LAWRENCESYSTEMS]

The ones that do work that way are easy, but that is not true of all printers.

[@nemisis010]

@@LAWRENCESYSTEMS Especially the usual cheapo bubblejets that most households use.

[@viaujoc]

Old networked Lexmark printers used to be very chatty with broadcast traffic and dislike being in a different subnet than the PC sending the print job. I even saw network printers that did not even have the ability to configure a default gateway, so everything had to be in the same subnet... or you would have to create very odd NAT rules in the firewall in order to make the printer believe that the print job was coming from its own subnet.

[@peters8858]

Hi Tom - Thanks for doing all the great content you create and sharing it with the community. I’d like to ask / request if you’d be willing to do a video for your followers on how to get Sonos setup on a separate VLAN to your controllers and get the connectivity working between them using tools on PFSense like Avahi or PIMD? I’m transitioning a home network away from a basic configuration to a more secure network design ahead of a 1GbE Fibre being installed later in the year and would like to get all these elements created. I’m using a Netgate 4100 Base with a Ubiquiti Unifi 24 PoE switch, two Ubiquiti Unifi U6 Pro’s, Several Ubiquiti USW Mini Flex’s and several G4 Bullet Cameras communicating to a Cloud Key Gen 2 Plus. I’ve got most of what I want in place but the Sonos VLAN to Controller VLAN connectivity is the last part Id like to get working. Any advice would be very helpful. Best wishes from Perthshire in Scotland!

[@LAWRENCESYSTEMS]

Newer SONOS systems do not work properly across VLAN like the older ones do.

[@peters8858]

@@LAWRENCESYSTEMS I appreciate you reaching out and replying. In this circumstance, what would you recommend as a viable alternative? Perhaps setting up a dedicated tablet on the same VLAN thus negating the need to have the controller / devices trying to traverse the VLANs?

[@LAWRENCESYSTEMS]

@@peters8858 I have a video on building pfsense home firewall rules kzbin.info/www/bejne/mJvVYaWjbpiojKM and your phone is an IOT device.

[@anyheck]

Add the raspberry pi on using a Ubiquiti Nanoswitch or similar and the camera won't even be offline to attract attention beyond the time it takes to plug that in.

[@sorbanbela]

It was very informative. Thank you for the video and the work on it.

[@TechUniversity1]

How do the phones and devices know what vlan network to connect to? Is that with the dhcp reservation? I’m just confused because you didn’t show reserving the phone ?

[@zachfenton608]

Awesome video

[@mattviverette]

Wouldn't you want to block SSH to the firewall from the VLANs, instead of just 10443. I assume SSH would be preferable to HTTPS for trying to access the firewall from a compromised device in the VLAN. (Maybe you don't have SSH enabled on the firewall.)

[@ccie.master]

You are awesome!

[@Trevor_Green]

What would you propose for multiple cameras? A POE switch on your port you set up for the camera in your example (like a dumb poe switch extending that 1 port) or map more ports to the smart switch?

[@LAWRENCESYSTEMS]

ideally mapping more ports to the smart switch.

[@silentmajor3594]

This is fantastic! Thanks

[@MadMike78]

I'm new at this and had a question about the Office vlan for computers and the phones. How does the switch know which device to issue out an IP address to? I see you have it plugged into one port but the phone and the computer get two different IP addresses. I understand you have vlan setup but I don't know how the switch knows which device is asking for an IP.

[@luckbeforeleap]

Ethernet frames sent by the phone to the switch will include a VLAN tag, but frames sent from the laptop to the switch will not.

[@IamDoQtorNo]

Howdy. I appreciate your videos. I'm late to the party. I have a Protectli with Pfsense on it. And a tplink tl-sg1024DE behind it. At this point I think I want/need 5 or 6 VLANS. Would you recommend having pfsense to control the vlans and trunk to the tp link switch OR have the switch to handle the vlans?

[@JB-tz9pi]

Hey Tom. I'm not quite tracking what you're saying about the port 443 that you changed to 10443. Where is it assigned by default in the settings? There's so much to learn. It's overwhelming but I'm getting there. Thanks for your videos. Hopefully I get a nice segmented network going on at home.

[@LAWRENCESYSTEMS]

you do that here docs.netgate.com/pfsense/en/latest/recipes/remote-firewall-administration.html

[@AMATeLL1]

Hi Tom! Hoping that you can make a tutorial about running PFSense with Windows Active Directory. Where AD has the DHCP and DNS instead in PFSense :D

[@LAWRENCESYSTEMS]

Just turn off DHCP in pfsense and turn on DHCP in Windows.

[@msofronidis]

Excellent presentation for a very powerful tool ready to be used by a SOHO user/admin. I would alos like to ask a question if anyone knows. Can I setup any LAN port on a netgate 2100 or 4100 as WAN for VPN failover? Thank you in advance to anyone that knows.

[@LAWRENCESYSTEMS]

The ports can be assigned to different purposes.

[@wdahoi3153]

This is a nice PFS VLAN+FW demo. Under FW Rules 》IoTcrap: Why is there a GREEN CHECKMARK PASS allowing PrivateNewworks alias??? Shouldn't it be a RED X for block? Is this a doozy mistake or what am I missing?

[@NikumbaUK]

Really great video gives me some ideas for my own home network

[@KentSapp]

Please Tom for the love of all that is my eyes, DARK MODE ALL THE THINGS. Including the UniFi controller dashboard, great video though very informative!

[@serratedwarstep]

Nord theme everything possible lol www.nordtheme.com

[@LordHog]

Would it be beneficial to get a Ubiquiti Edge Switch (ES-16-150W) instead of a Ubiquiti UniFi Switch? What are the pros and cons?

[@brandonbolla9937]

With all these vlans. Cross talk packets must go back to the router right? If i am moving a large file from device A to Device B will that go back to router to change vlans? How often would One need to worry about saturating the GB link?

[@ozmosyd]

Love ya work very informative indeed thanks chap. And yes could you do Untangle equivalent, please?

[@TRD_2zz]

Why have the source as IOTcrap net on the (Block Firewall Web Access) rule and as (any) on the other networks?

[@dominiquerichardson]

you mentioned that the usg doesnt have all the features needed in the firewall rules could you use the usg pro?

[@verdedenim662]

just curious if you could 'consult' on the creation of a SOHO network setup?

[@LAWRENCESYSTEMS]

Yes

[@bof0079]

any chance you could do this but with untangle ?

[@emmettbradford6983]

Google BRADFORD TECHNOLOGY 🌎🖥️🖨️🖱️⌨️ great nationwide internet reseller company helping a lot of people save money 💰 on internet service

[@Saywhatohno]

Is there a course we can take to learn how to set-up small business network?

[@EdwardHanley]

great content - thanks