Integrate pfsense into my OpenWrt managed network

[kuze86]

Hello and happy Holidays everyone.

I have used OpenWrt for a couple of years. Now I got my hands on a cheap pfsense-box. I want to add the firewall into my network.

This is my working network at the moment:

I have my ISP-router, then a cable into the WAN-port of my OpenWrt-router (Archer C7 V2.0). Than I have three networks, the normal LAN with a WIFI bridge, a network for IoT devices and a network for guest devices with a WIFI bridge.

Devices in the IoT network and the guest network can't reach anything but the WAN. (Blocked by firewall rule).

This was important to me, that those clients are isolated from the rest of the network

I have two ideas how to incorporate the firewall into my network.

Number 1

With a transfer network between ISP-Router and OpenWRT-router:

Number 2

With the pfsense-box in the same network as the OpenWRT-router and set the pfsense-box default gateway:

I tried number 1 and disabled masquerading on the WAN in OpenWRT. Then I connected the WAN-Port of OpenWRT-router to the LAN port of the pfsense-box and the WAN port of the pfsense-box to the LAN port my ISP-router.

But that doesn't work.

I guess I need to set static routes

I also considered number 2 because it looks a lot cleaner to me, but I do not know if I can isolate the IoT and the guest network hosts from the LAN (192.168.1.0) that way. And I want to keep them isolated.

Can some help me with the setup? Preferred in luci when possible. Thanks in advance!

[AndrewZ]

Convert your OpenWrt router to OpenWrt AP. You will need to configure your AP with VLANs, so search for 'openwrt ap vlan'.
Look for multi-VLAN recipes at pfSense forum.

[kuze86]

Thx for your answer, you mean that pfsense act as a gateway, while the openWRT-Router acts as an AP and both are in the same network?

I don’t have many experiences with VLANs dothe VLANs need same IDs on both pfsense and openWRT?

[AndrewZ]

pfSense acts as a router, OpenWrt device acts as a bridge (AP). You will need to configure the same VLANs on both devices.

[kuze86]

Hello, got it to work. Found this tutorial, it explains the PFSense part and the OpenWRT part very well:

https://forum.netgate.com/topic/104277/tutorial-pfsense-openwrt-multiple-ssids-and-vlans

To get the VLAN from PFSense working on a certain LAN-port on the router, I created an additional untagged VLAN on the OpenWRT-Router and then bridged those two VLANs.

[tmomas]

If your problem is solved, please consider marking this topic as [Solved]. See How to mark a topic as [Solved] for a short how-to.