1

In my network pfsense is the firewall and router for my entire network. It is the only machine with direct WAN access. All other machines are behind it (and connected through a switch). I am trying to decide what would be the most secure option for wireless access distribution:

  1. Run pfsense on a box with wireless capabilities, and have wireless clients connect directly to the pfsense router/firewall.
  2. Run pfsense on a box that has wired connections only, and connect a WAP (wireless access point) to the switch on my lan, which distributes the connections from the pfsense box to my lan.

So to rephrase my question: are there there security risks in running pfsense on a box with a wireless radio, and could they potentially be resolved by moving the wireless access point to another location on the network (behind the pfsense box)?

Improve this question
2
  • What kind of users are you planning to have on your wifi? Trusted users and/or external people?
    – Mxx
    Oct 18, 2012 at 13:55
  • @Mxx I think 99% trusted users.
    – user120729
    Oct 19, 2012 at 12:12

1 Answer 1

Reset to default
1

The difference in the scenario you described is as follows:

  • If your pfsense has a dedicated wireless interface, you can tune your firewall-rules in a way which suits you.
  • If you hook up an accesspoint to a switch, and someone were to crack into your wireless network, then he would gain full access to that VLAN.

Let me describe what we did when we set up our new headquarter last year.

  1. Created two new VLANs on the switches, one for guest access, one for internal access
  2. Our accesspoints where able to use this "multiple SSID"-feature (I think this is a Cisco brand term) - so we have a "guest" SSID which is shoved over to the guest-VLAN, and an "internal" SSID, which is put through to the "internal" VLAN. Both SSIDs/VLANs got their own dedicated IP-network.
  3. No other machine was allowed to be on these VLANs.
  4. The networks terminate on the VLAN-interface of an internal pfsense, which deals with routing and firewalls.
  5. The guest LAN was only allowed to use the internet, where the internal LAN was allowed to get access to some servers in our DMZ (Exchange and the such).

So, giving your pfsense a wireless adpater wouldn't be too bad, but if you want to run more than just one SSID you need to find an adapter which actually supports it (I don't know one right now).

To answer your final question: If you hook up the accesspoints to your cabled network, put it in a dedicated security zone (means: VLAN and IP-network) and let your pfsense deal with the routing and firewalling.

Improve this answer

You must log in to answer this question.