Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my network pfsense is the firewall and router for my entire network. It is the only machine with direct WAN access. All other machines are behind it (and connected through a switch). I am trying to decide what would be the most secure option for wireless access distribution:

  1. Run pfsense on a box with wireless capabilities, and have wireless clients connect directly to the pfsense router/firewall.
  2. Run pfsense on a box that has wired connections only, and connect a WAP (wireless access point) to the switch on my lan, which distributes the connections from the pfsense box to my lan.

So to rephrase my question: are there there security risks in running pfsense on a box with a wireless radio, and could they potentially be resolved by moving the wireless access point to another location on the network (behind the pfsense box)?

share|improve this question
What kind of users are you planning to have on your wifi? Trusted users and/or external people? – Mxx Oct 18 '12 at 13:55
@Mxx I think 99% trusted users. – user120729 Oct 19 '12 at 12:12
up vote 1 down vote accepted

The difference in the scenario you described is as follows:

  • If your pfsense has a dedicated wireless interface, you can tune your firewall-rules in a way which suits you.
  • If you hook up an accesspoint to a switch, and someone were to crack into your wireless network, then he would gain full access to that VLAN.

Let me describe what we did when we set up our new headquarter last year.

  1. Created two new VLANs on the switches, one for guest access, one for internal access
  2. Our accesspoints where able to use this "multiple SSID"-feature (I think this is a Cisco brand term) - so we have a "guest" SSID which is shoved over to the guest-VLAN, and an "internal" SSID, which is put through to the "internal" VLAN. Both SSIDs/VLANs got their own dedicated IP-network.
  3. No other machine was allowed to be on these VLANs.
  4. The networks terminate on the VLAN-interface of an internal pfsense, which deals with routing and firewalls.
  5. The guest LAN was only allowed to use the internet, where the internal LAN was allowed to get access to some servers in our DMZ (Exchange and the such).

So, giving your pfsense a wireless adpater wouldn't be too bad, but if you want to run more than just one SSID you need to find an adapter which actually supports it (I don't know one right now).

To answer your final question: If you hook up the accesspoints to your cabled network, put it in a dedicated security zone (means: VLAN and IP-network) and let your pfsense deal with the routing and firewalling.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.