Solved

Redesigning network for lab and gaming, cisco switch, pfsense router

Posted on 2016-10-02
9
130 Views
Last Modified: 2016-10-30
So this is a bit of a mixed question so I will try to explain the best I can.  I am planning a redesign of my home network using pfSense, Untangle, and a Cisco switch.  The objective is to have 3 separate networks - gaming, WiFi, and lab.

I previously set this up successfully using a Cisco 1841 router, but due to its age and limitations, I am replacing it with pfSense, mainly due to the uPnP capability for the gaming network.  So most of the work is already done.

The pfSense hardware has 4 NICs - WAN, LAN, OPT1, and OPT2.  The focus would be OPT2 for the gaming network.  First, I would set OPT2 to support uPnP.

Next, the switch is Cisco SG300-20 running in layer 3 mode.  I created a VLAN30 for it for the lab network for my servers and workstation, and it routes to the LAN port on the router.

So part 1 of the question is, can the SG300-20 have a separate gateway for the gaming network which would route to OPT2, such as VLAN 40?  I want to keep the gaming and lab networks completely isolated from each other for security reasons.  The switch has a feature called private VLAN settings, is this where the gaming VLAN should be created?

Part 2 is, since the switch is in layer 3 and VLAN 40 routing to 10.0.0.1 first before out to the Internet, will my Xbox One still get an Open NAT and will the WII U have all 65535 UDP ports open with the OPT2 interface set to uPnP in pfSense?

I have attached a diagram to help illustrate the goal.
redesign.pdf
0
Comment
Question by:bigeven2002
  • 6
  • 3
9 Comments
 
LVL 45

Expert Comment

by:Craig Beck
ID: 41825932
Don't use the switch to route your traffic. I'd use the pfSense for that so you can firewall each VLAN.

It doesn't matter how many hops you make; NAT will be detected.  uPnP will open as many ports as needed as long as they're not in use.

What is Untangle doing?
0
 
LVL 17

Author Comment

by:bigeven2002
ID: 41826296
Thanks for the reply.  Untangle is the UTM that is in bridge mode between the router and the lab network to add protection to the servers and workstation.
0
 
LVL 17

Author Comment

by:bigeven2002
ID: 41826304
More specifically it is doing IDS, 2 antiviruses, ssl inspect, and web filtering.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 17

Author Comment

by:bigeven2002
ID: 41826922
If it helps, the reason for layer 3 mode on switch was to minimize broadcast traffic to the utm and router.
0
 
LVL 45

Accepted Solution

by:
Craig Beck earned 500 total points
ID: 41828095
Have you thought about using the firewall as the gateway for the gaming network and using the switch as the gateway for everything else?
0
 
LVL 17

Author Comment

by:bigeven2002
ID: 41828502
Yes, that was going to be my backup plan if I could not get this proposal to work.  I wanted to visit this idea in the question first since I had the available ports on the layer 3 switch and could theoretically use vlans and multiple gateways from it.

The backup plan would require me getting a quad port nic for the router or an additional switch.  The Xbox and Wii U are just two of the consoles I would connect.
0
 
LVL 45

Expert Comment

by:Craig Beck
ID: 41829406
Ok, well I suppose it depends if you want to be able to do any of the UTM stuff to your gaming traffic before it gets a chance to get to the other VLANs.  If you're not bothered, simply use ACLs at the L3 switch.

Does your Untangle and pfSense hardware not support 802.1Q?  If it does you can use a single interface and pass multiple VLANs over a single link.
0
 
LVL 17

Author Comment

by:bigeven2002
ID: 41831124
Nah, I just want Untangle filtering traffic to the lab network so it won't scan anything from the game network.  Both appliances are custom builds so not sure how I would identify this 802.1Q feature.

pfSense router is using a MITAC PD11BI CC Mini-ITX motherboard with J1900 Celeron CPU and 8 GB Ram.  Also added a 2-port gbit nic to the PCI-e x1 slot.  All 4 nic ports are the realtek 8111G chipset.

Untangle is running on an old ASUS P5BV-M motherboard (not to be mistaken with P5B-VM) with a X3220 Xeon CPU and 8 GB ram.  The two nics in it are broadcom BCM5721 chipset.

If they do support this then how would this be setup via single interface?  Sorry, I'm a bit new to this.
0
 
LVL 17

Author Closing Comment

by:bigeven2002
ID: 41865675
I went with the backup plan.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question