Messages

POE has nothing to do with VLANs, it's merely away of passing power over the unused cores in an ethernet cable

How can I know that a PoE injector isn't really an unmanged PoE switch internally, if the specifications don't tell me?

POE is a standard, if the WAP supports POE any POE injector will work. The only difference is POE+ which is a higher power version, used usually for higher load devices, such as loads such as Loudspeakers.

All the cheap PoE injectors I found are "passive". I read elsewhere that those injectors don't really fulfill the standard, but just provide a fixed voltage on a single port, and that's it. So I would have to know the required voltage.
The PoE injectors fulfilling the standard are not much cheaper than small managed PoE switches

Look at something like the TP-Link EAP225, it comes with a POE injector too.

The PoE injector doesn't seem part of the package, but at least they specify the voltage. Might be an alternative...

Ok, more research. Trouble is, 8 ports just isn't enough.

So I can use one managed 4 port PoE switch, and one manage 8 port non-PoE switch. Still more devices to configure, but I hope this combination will do the trick.

Yes, managed switches are not that much more expensive. I guess I just hoped for one less device I had to configure...

However, the idea with the PoE injector falls apart in two places:
1) I can't find a PoE injector where the documentation mentions VLAN tags to be maintained
2) I can't find the required voltage in the documentation of the Wifi AP, so I can't use a passive PoE injector with fixed voltage

It seems that every time I feel I got the configuration right, I learn something new...
Back to the drawing table.

I'm not a fan of buying hardware today that I know I'll throw out in two or three years, even if it's the most economical thing to do. So I'd rather find a Wifi solution that I can live with for the coming 5-10 years.

I currently have one Wifi router, and I get some spotty coverage in some rooms. So I think I can either use two AP or one AP and one Repeater. Since Wifi coverage goes down in a pretty linear fashion as I increase distance to the router, I think that 1 AP + 1 Repeater should do the trick.

It turned out that APs with Wifi-5 + VLAN + WPA2 capability are almost as expensive as the next level (business APs with 10 year warranty and Wifi-5 + VLAN + WPA3). Since I intend to go for quality, that sounds good to me.

So my plan is the following:

• Deciso 3-port Firewall running OPNsense
• Wifi-AP with PoE injector connected directly to firewall ("trunk" port)
• Wifi-Repeater to improve coverage
• Unmanaged switch connected directly to firewall ("internal VLAN" port, so all devices connected to it belong to the internal VLAN)

;)  You don't have to have a power point by the AP with POE injectors, they just need to be in the line to the AP somewhere.

I don't think I fully understand this statement. What do you consider a "power point" in this context?

One other thing that needs to be remembered here, once you have one  managed switch, anywhere else on the wired network will also require managed switches, unless you can set the vlan ID on each endpoint, not all NICs support that.

Will this spell trouble in the above configuration? If I designate the whole (unmanaged) switch to a certain VLAN, won't the firewall be able to treat any incoming and outgoing traffic on that port accordingly?

Well, none of the Ubiquiti APs has WPA3. If I relax this requirement, I suddenly get lots more options.
But thank you for pointing out the possible issues with VLAN tags. Maybe a PoE injector could do the trick (I hope it just wires the network signal to the port, and adds the wires for PoE)

I have been researching possible configuration (and availability and pricing...), and although my questions stray a little from OPNsense topics in the narrow sense, I would really value your input:

Since I want to keep my Wifi AP for a while, I aim for Wifi-5 (ac) at least, and I would like to have WPA3. The only (halfway) affordable solutions I can find are Cisco access points which run on PoE. Only one Wifi router I found has both WPA3 and VLAN, and it's ridiculously expensive.

Now the OPNsense-based firewall aren't going to have PoE ports. So I found a suitable switch (unmanaged) which has some PoE ports, and enough ports in total. I would connect the Wifi AP on a PoE port, and my other devices on the remaining ports.
However, what does this mean for the VLAN configuration? It would mean that I have to configure the port on the firewall which connects to the whole switch as "trunk" (as Mks posted, although I'm not familiar with the term).

Does this have unintended consequences for the ports connected to computers and other devices where I can't do a VLAN configuration?

Does this mean that I have to assign two VLANs to the port which connects to the AP, then configure the AP to use each VLAN with the correct SSID (internal/guest)?

I would like to rebuild my network around an OPNsense-based Firewall, and I have one configuration questions. The topic has been discussed in several threads, but the answers there were mostly focused on specific configuration issues. My question is more about understanding the basic concepts.

What I need:
-) OPNsense Firewall connected to existing internet router
-) A switch connected to the firewall for cable LAN
-) An internal Wifi and a guest Wifi.
Internal Wifi has full network access, but is protected both by password and MAC address whitelisting.
Guest Wifi has internet access, and nothing else.

From what I understand so far, I can achieve this using only a single Wifi access point, provided this AP supports VLANs. Is this correct?

If so, will it work with any vendor's VLAN implementation, or are there differences to watch out for?

Do you have such a configuration running, and if so, which access point vendor do you use?