Redirect URLS BYOD Network?

[twin--turbo]

what services do you want to achieve and from where?

[FN-GM]

What do you mean. I basically want an BYOD network that will provide access to our Remote Access solution (https site) OWA and a few select internal website. When a user opens the web browser when connected to the network they are taken to a particular website.

 

I plan to use ACL to control what people on the BYOD network can get from the main LAN.

[twin--turbo]

If its the DG how can the clients route to another VLAN like get to our remote access solution hosted on another VLAN? Thanks

 

the DG has a DG of the vlan interface, the access rules only permit the captive box . This is assuming the captive box is proxying and can do ssl if you need it.

 

it may be simpler to run a transparent bridge.

 

 

 

your more or less wanting exactly what I am working through by the sound of it. I will send over my bank details via PM for the consultancy ;)

 

Rob

[CyberNerd]

you should be able to do this easily enough with squid - theres some config examples for the captive portal features here:

ConfigExamples - Squid Web Proxy Wiki

[twin--turbo]

I gave up yesterday with squid on sles..

 

Pfsense and Untangle probably both use squid as the underlying engine but built to work.

[cpjitservices]

Does PFSense captive portal need to use a username and password? I dont want to use that, i just want it to redirect.

 

Do you set PFSense as your default gateway?

 

No it doesnt you can set it not to ask for Username and Password and just redirect traffic to another location, we've had it setup like that before.

 

Untangle is good but not as good as Pf, Its a lot heavier on resources and doesnt seem as intuitive.

 

We have Pfsense on 3 different SSID's and on three different VLANS, the problem is that if you use the standard user manager in the Wb GUI then the same user can authenticate on any of the SSID's... not always desirable, but if you go to packages and install FreeRadius you can use that as the authentication for captive portal instead and can set RADIUS to listen to a certain Interface / MAC address and if you do it right If you have different VLANS tied to different SSID's you can get the authentication to work separately on each different SSID.

 

PfSense can also act as an 802.1x server so it will drop you onto the right VLAN once you authenticate making locking things down alot easier.

 

Pf also has the DG and Squid proxy for filtering (again in the packages) just click add package and configure. I have used DG and Squid on Pfsense before, the joy is you get a nice Web GUI.

 

PfSense supports SSL also. I'd urge people to build a pfsense box and have a play... you'll be pleasently surprised at how powerful it is, I was also watching a DefCon vid the other night, some guys where trying to hack into enterprise level routers and got into some of them using back doors, all of a sudden one guy said something about they have never yet gotten into a PfSense router as they are so secure!, added bonus!

 

And as I say we've got this up & running in a few hotspots around the city, with the captive portal page being fully customizable it works great! It's so easy to manage that we have non-admin staff able to manage the basic aspects of adding users to captive portal if they need to, any problems because openvpn comes with PfSense we just VPN in an solve any issues.

Edited November 13, 2012 by cpjitservices

[twin--turbo]

sounds like i should forget the untangle build and go directly to PF....

 

watch this space.

[FN-GM]

the DG has a DG of the vlan interface, the access rules only permit the captive box . This is assuming the captive box is proxying and can do ssl if you need it.

 

it may be simpler to run a transparent bridge.

 

 

 

your more or less wanting exactly what I am working through by the sound of it. I will send over my bank details via PM for the consultancy ;)

 

Rob

 

Its exactly what i want. I set the DG as the VLAN DG thats no problem. But how would PFsense get to the client. How would the clients talk to PFsense to know to get redirected automatically?

 

Thank you.

[cpjitservices]

The way pfsense works is you assign the captive portal onto an interface, so ETH0 for example so any traffic that hits ETH0 will be intercepted and hit with Captive Portal.

 

So if you set you DG to the VLAN DG and that VLAN is assigned to an interface in PF (which it will be) and you set Captive Portal to listen on that interface your then your banging - any traffic hitting that interface will need to go through Captive Portal or be re-directed.

 

@twin--turbo - if you need any help with pfsense let me know - iv'e spent many an hour working with it and it hasnt let me down so far.

 

Below is an example of someone adding captive portal onto the LAN interface, the Web GUI has been massively improved since this image (luckily)

 

http://www.fikirdenizi.com/uploads/1289829277_pfsense-portal-03.jpg

Pfsense Interface Assign

Edited November 13, 2012 by cpjitservices

[cpjitservices]

For those interested you can also use Pf as a basic UTM, although I've never done it but you can get anti-virus packages and web filtering... and more but cant remember off the top of my head but Google pfsense as UTM and you'll see some examples.

[FN-GM]

that VLAN is assigned to an interface in PF (which it will be)

 

How would you go about this please? Im trying to learn more about Cisco kit so taking baby steps here Would a static route do the trick?

[cpjitservices]

Its been a while since I touched on Cisco but with Cisco Routers and VLANS you can do router on a stick and use a sub interface for example int fa0/0.1 would be a subinterface of FA 0/0.

 

or change the 1 to the VLAN number.

 

On the switches you'd go into

 

Int FA */*

switchport mode

switchport mode access VLAN10

 

I think thats correct - that will assign that VLAN to that interface - I may stand corrected as it's been a longggg time since I did VLANS on Cisco, I do have VLANS on Cisco but it was done that long ago I cant remember.

 

The switches I'm on about here are Layer 2 and not layer 3, on my Juniper EX2200 (Layer3) you just go into the port or group of ports and assign to a VLAN-ID and then just Tag out uplink port with all the VLANS for it to trunk them.

[FN-GM]

Ok yer i have that assign a vlan to a port easy. I am just confused how the BYOD client gets to pfsense, this bit i cant grasp. It wont be by the DG because you need that to be set to the VLAN DG. How does the traffic actually hit pfsense?

 

Thanks

[twin--turbo]

You either assign the PFSense as the DG and have it's DG as the vlan interface IP.

 

Or out PFSense as a transparent bridge , stick one of it's ports on your vlan and then connect the other port to a downstream switch for you BYOD, that way all traffic passes through it before hitting the cisco.

[FN-GM]

There are that many release of PFsense what do i pick? Will this do? - pfSense-2.0.1-RELEASE-amd64.iso.gz Thanks Edited November 14, 2012 by FN-GM

[twin--turbo]

yes that one or the i386 depending on your hardware.

[FN-GM]

yes that one or the i386 depending on your hardware.

 

Vmware so might as well go 64 bit. Thanks

[FN-GM]

Talking about your diagram on the other thread. I dont want a BYOD switch as such as BYOD will be located in allot of areas so i want to keep to a BYOD VLAN. I put the PFsense server in the BYOD VLAN, the clients DG will be PFsense and PFsense DG will be the vlan interface. For this setup do i need 2 nics in PF sense?

 

Thanks

[twin--turbo]

Race you........

 

Rob

[twin--turbo]

you can do it by not having a vlan interface on the BYOD vlan ( preventing it routing ) and brdiging the pf between one of the other vlans on the switch and the byod vlan.

 

Rob

[FN-GM]

you can do it by not having a vlan interface on the BYOD vlan ( preventing it routing ) and brdiging the pf between one of the other vlans on the switch and the byod vlan.

 

Rob

 

 

I know i can do that but the idea of a layer 3 switch is to let it do the routing. I don’t want to put the eggs in the basket of a product we have no support on doing the routing. PFsense will only be used as a convenience for the captive portal.

 

Will what i said on post 43 not work?

 

Thanks

[cpjitservices]

Yes, that should work. Try it.

 

Just a little tip for those of you setting up pfsense, once youv'e got it installed stay on the pfsense console screen it'll ask you to setup your interfaces - they may have strange names like rl0 or em1 - if you look on the screen though it'll show you which one is which so just select which ones you want to be your LAN,WAN or OPT interfaces, once it's done set an IP (either static or DHCP) and login to the web interfaces on a PC just like a normal router.

 

I wouldn't worry too much about getting the interfaces set-up correctly the first time as you can edit them in the web interface anyway, just aslong as you can get to the web interface via the LAN interface.

 

The username will be Admin, the password will be pfsense.

 

Below is any image similar to the screens you will see about setting up interfaces the first time.

 

http://doc.pfsense.org/index.php/Installing_pfSense

[FN-GM]

Thanks, do i use pfsense with a single nic or 2 please?

[cpjitservices]

Add as many as you like, I usually add 3, WAN LAN and OPT. You can remove / add more if need be and use the web GUI to assign interfaces.

[FN-GM]

Add as many as you like, I usually add 3, WAN LAN and OPT. You can remove / add more if need be and use the web GUI to assign interfaces.

 

For what i said in port 43 though i just need one? It wont do any routing etc. Thanks