Messages

You would need to share your interface configuration, your DHCP server configuration, and your firewall rules in detail for any diagnose via the forum about what might have been wrong.

pfSense and OPNsense do behave almost identical in these specific aspects.

Understood.  I think it's best to get OPNsense rolled out and up and running first.  If the firewall rules are supposed to work, then that should get me to where I want to be.  If not, then I can come back with the detailed info for further investigation.

Your untrusted IoT devices go into a different network. That's what different SSIDs on your APs and a mapping of SSIDs to VLANs are for.

Ok, now I'm getting a better picture here.

Your DHCP server only sees a MAC address requesting an IP lease, it has no way of knowing if that device is connecting via an AP (in AP or "bridge" mode) or connected directly to the switch.

That I get.

And for communication across subnets including the fileserver - that's what firewall rules achieve and for autodiscovery possibly an mDNS repeater.

Ok, so THIS is the issue.  Maybe OPNsense functions differently than pfSense in this regard (but I doubt it).  I thought that I could simply make firewall rules that would allow traffic between subnets (and therefore interfaces), but this has been spotty at best.  If I connect this laptop over Wifi instead of wired through the dock, I won't be able to reach the wired subnet, despite explicit firewall rules being in place to allow this traffic.  If I reconfigure the wireless NIC to use a manually applied static address and a mask of /16 instead of having these parameters assigned through DHCP, then it works like one would expect.

Because it's really handy to know if a particular device that I don't recognize is wired or wireless....I've got various projects going on, so both wired and wireless devices might be added to the network and assigned some random DHCP address.  I might statically assign those later, or it might be something temporary where I don't care...but I still need to be able to have devices communicate across those subnets.

So, for example, I use a laptop in my office, and it's currently connected wired via the dock.  But if I decide to take it into the kitchen where it will connect wirelessly, then it won't be able to reach my file server (which of course is also wired), because it's now on a different subnet.

Then there's the issue of the security cameras and isolating them from the internet.

How does this work in organizations where lots of network segmentation occurs?  Sysadmins need access to the whole thing (or at least multiple parts of it).  Can I have separate DHCP pools based on some devices connecting through the WAP(s)?  Currently all of the cameras have statically assigned IPs (not through DHCP), and I use two physical NICs in the server that runs the software and manages the footage.

Then use just a single interface with a /16 netmask. Assign the addresses to the devices as you see fit if you just want to "sort" them in some way.

Thanks for your input, but it's not helpful.  I'm really dumbfounded that what I'm trying to accomplish is going to require me to manually assign a bunch of parameters, which defeats the purpose of DHCP, don't you think?

3 interfaces or 3 VLANs with the IP addresses exactly as you outlined and each with a /24 netmask.

But then that won't allow a desktop on 192.168.1.XXX to communicate with a wireless device on  192.168.3.XXX.....

Am I missing something?

EDIT:  Ideally I'd like the mask to be /16, but as you said, this can't happen across interfaces.

You did not state which subnet mask you intended to apply so from the .XXX I infered you were going to use /24. Of course. No firewall will let you use subnet masks that span interfaces because IP does not work that way. The networks on your interfaces must be disjunct.

And maybe that's the source of my confusion.  So what's the cleanest way to accomplish what I've set out in my original post?

And your question is? Looks like a perfectly viable network setup.

Well, since I have not yet set up OPNsense, I'm basing my experience on pfSense, and pfSense won't let me apply a subnet mask that crosses over the subnets.

I'll put my flame suit on, but please try to be gentle...I'm a hobbyist, not an IT guru.  I'm currently a pfSense user, looking to make the switch, and as such, now is as good a time as any to make the changes I probably need to make.  Current network config is as follows:

192.168.1.XXX is for wired devices
192.168.3.XXX is for wireless devices (many, if not most of which have static IPs assigned by DHCP)
10.10.10.XXX is for devices related to only security cameras and the server that runs the cam software and stores the footage.

I'm probably going to be moving to a network video recorder and ditching the software, but I would still like to keep camera access air gapped and not internet accessible.  The cameras have static IPs configured in the cameras themselves.

I would prefer to keep wireless devices and wired devices on their own subnets, but obviously able to communicate seamlessly on the network.  Each of those would still have DHCP, although most would still be statically assigned through DHCP.

So, let the suggestions (or criticisms!) fly and ask questions if you need to.