pfsense and BI - multi LAN or multi NIC?

[achalmersman]

One quick example. My cameras are on their own VLAN with no internet access and I need 2 devices (a pc and tablet) on my regular data VLAN to be able to access the cameras but nobody else needs that capability. With firewall rules I can allow communication between the cameras on the 192.168.40.x subnet and the 2 specific devices on the 192.168.10.x network but ONLY those 2 devices and none others. I dont believe your $70 router would have that capability.

Sent from my SM-G965U using Tapatalk

 

[rhosch]

Nothing wrong with your KISS method and it would work fine. But he's already planning a pfSense install which means he doesnt need another router, and BI doesnt need dual NICs. He just needs a good layer 2 switch with VLAN capabilities. Everything is able to be done via VLANS and firewall rules. And he has 100x the capabilities as far as firewall rules, NAT rules, VPN, redundancies etc. Its insane what pfSense is capable of considering it's open source freeware.

Sent from my SM-G965U using Tapatalk

I definitely have a lot of reading and learning to do. But I am curious about something you said. I understand that I can accomplish what I want to do either by using a VLAN capable switch, or by making use of the multiple physical NICs in my pfsense box. Are there any significant advantages to doing it the way you describe, a trunk LAN to VLAN capable switch? I suppose it could reduce the number of switches needed, but I think I'll need more than one either way. I'll have 6-8 cameras (to start, I guess could grow over time) which will need POE, and at least 40 hardwired ports throughout the house. From a cost perspective, I'm guessing it would be cheaper to deal with an 8 port POE switch and a less intelligent 48 port switch, rather than a more full featured 48 port switch with POE (if that even exists with enough POE ports for my needs). But I don't want to overlook something just because I'm new and unaware... don't know what I don't know!

 

[rhosch]

I'm sure whatever he's building it'll be quite capable. Just curious on what I was missing out on. The ASUS router was $70 and had OpenVPN built-in, it's the only router I use. The second NIC was $7 off eBay. Maybe his implementation will have higher performance and more security than OpenVPN...don't know which is why I asked. He appeared to be concerned about power but the extra computer he has for pfSense uses more power than just an OpenVPN router.

I'm still learning so...

But OpenVPN takes a bit of compute power if you want to maintain a high bandwidth. One advantage of using pfsense is that you can adjust hardware to get the througput you desire. In my case, I went with an integrated SOC celeron based box with 8 gigabet NICs and a fiber port. Power draw is fairly low compared to a standard desktop computer but of course is higher than an ASUS router. But compute power is substantially higher and can sustain VPN throughput that won't be a limiting factor. The tradeoff in my case was cost... definitely more than an off the shelf router, and probably more than I could build a cheap desktop style computer for, but with the NIC option, 1U form factor, silent, low power draw, the ~$500 cost was worth it to me.

 

[TL1096r]

I went with dual NIC as it was too much to learn with pfsense and vlans etc. I felt if I did not fully understand how it worked and easily adjust and set it up I had no business doing it.

I created the dual NIC DIY you probably seen and people even have issues/questions with setting it up so it depends on skill level too:

Dual NIC setup on your Blue Iris Machine

In making your system more secure this is a great option to eliminate your cameras calling home / connecting to the internet This is a great place to start to setup a bit more secure network and learn more about IP/Subnets etc. before adding dual NICs: Router Security - Subnets and IP addresses...

ipcamtalk.com

I would say pro/con is ease of setup and knowledge required. I have to assume pfsense/vlans give more security and configuration options.

 

[achalmersman]

I definitely have a lot of reading and learning to do. But I am curious about something you said. I understand that I can accomplish what I want to do either by using a VLAN capable switch, or by making use of the multiple physical NICs in my pfsense box. Are there any significant advantages to doing it the way you describe, a trunk LAN to VLAN capable switch? I suppose it could reduce the number of switches needed, but I think I'll need more than one either way. I'll have 6-8 cameras (to start, I guess could grow over time) which will need POE, and at least 40 hardwired ports throughout the house. From a cost perspective, I'm guessing it would be cheaper to deal with an 8 port POE switch and a less intelligent 48 port switch, rather than a more full featured 48 port switch with POE (if that even exists with enough POE ports for my needs). But I don't want to overlook something just because I'm new and unaware... don't know what I don't know!

Depending on how much you're willing to learn you can buy enterprise level switches that do everything you need and more. A 3750x Cisco 48 port POE+ switch (30w on every single port) will cost you in the neighborhood of $300 on ebay. It will do everything you need. Need more than 48 ports? Add another and stack them. Now it's one single managed 96 port switch with power redundancy between the 2. One single UPS backs up your entire network / cameras, etc.

Let's use the KISS network diagram provided. Let's say he had a tablet on his wifi network that needed direct access to a video stream of the cameras on his segmented physical cam network (not using BI stream). He only wants that tablet to have access. He has no real way of doing that. With pfSense and VLANs I can have that by sitting in front of my PC and creating firewall rules in about 5 minutes. And I can add a device to the list of "allowed to cameras" in about 30 seconds.

I have that exact situation in my house. We use a Lenova tablet as a baby monitor display for a Dahua camera mounted on the crib.

Sent from my SM-G965U using Tapatalk

 

[Sybertiger]

Depending on how much you're willing to learn you can buy enterprise level switches that do everything you need and more. A 3750x Cisco 48 port POE+ switch (30w on every single port) will cost you in the neighborhood of $300 on ebay. It will do everything you need. Need more than 48 ports? Add another and stack them. Now it's one single managed 96 port switch with power redundancy between the 2. One single UPS backs up your entire network / cameras, etc.

Let's use the KISS network diagram provided. Let's say he had a tablet on his wifi network that needed direct access to a video stream of the cameras on his segmented physical cam network (not using BI stream). He only wants that tablet to have access. He has no real way of doing that. With pfSense and VLANs I can have that by sitting in front of my PC and creating firewall rules in about 5 minutes. And I can add a device to the list of "allowed to cameras" in about 30 seconds.

I have that exact situation in my house. We use a Lenova tablet as a baby monitor display for a Dahua camera mounted on the crib.

Sent from my SM-G965U using Tapatalk

I can certainly understand why a small office up to a large company would use pfSense. I don't get why the typical homeowner would want to become a pfSense network administrator on top of being a security camera administrator. Another computer converted to being a pfSense router/firewall is yet another computer that has to be maintained. I can also understand if someone has a larger family and those family member privileges need to be changed or revoked. It can be said that a lot of routers don't enjoy frequent security updates not long after the sale so open source software can oftentimes benefits from more frequent updates and feature enhancements. That's one reason why a lots of folks gravitate to Asus routers of which a lot of models can benefit from Asuswrt-Merlin firmware updates by a third party.

It would seem that most people going down the BI route have all their security cams tied to the BI server therefore there's no need to have direct access to a cam stream. Accessing a cam's video is easy to do from most browser enabled devices on the network including a tablet or smart TV by simply opening up a UI3 link to the BI server. If you do want direct access to a cam you simply use RDP/TeamViewer etc to connect to the BI machine and then from there you can use a web browser to access the cams settings.

I'm sure there is some "coolness" factor in having enterprise level control over a home network but my guess is that for your typical homeowner it's overkill from the standpoint of additional time/effort/money. I'm not trying to poo-poo what the OP is trying to do and perhaps one day I'll be able to justify a pfSense implementation then move in that direction. It's a good idea how he's planning things out with new home construction. Thanks for providing some insight on the capabilities of a pfSense implementation. I like to see how other's are setting up their systems regardless of if they apply to me or not. Interesting stuff.

 

[achalmersman]

You're right. It's not needed. But it's free and if he has the interest in learning why not?

As far as one of my examples, I use TinycamPro to direct stream sound and audio to a camera. I like to have the screen off but still have the audio. The features direct streaming the video via that app gives me capabilities you cannot achieve with Blue Iris at this time.

As far as maintenance? Mine is a little 1u dell server racked on my network rack in my basement. In 3 years I've done literally nothing to it other than updates and reboots. About the only drawback is it uses a little more electricity than a simple homeowner router.

Sent from my SM-G965U using Tapatalk

 

[achalmersman]

I apologize we've gotten sidetracked. I was under the impression the OP already has a pfSense box which means there is zero reason to debate whether or not he should be using it.

Sounds like hes asking does BI need a dual NIC or not.

It certainly can, but there's no need to. Hooking the cameras to a stand alone network to the BI server will do nothing for you other than add simplicity at the expense of reduced capabilities and control. Why have pfSense in this case?

Sent from my SM-G965U using Tapatalk

 

[Sybertiger]

I'm guessing that if you're big in IOT or you have a big family, extended family, a lot of people and coming/going to your house, running web servers, home office with VPN to work or vice-versa access from others at work to home server then it could be very useful for pfSense. I'm not in that situation but just to avoid newbs getting flustered with all this "newness" I was asking the question.

The dual NIC in the server is good because it prevents cameras from accessing the rest of your home network (in the case of spyware cams). Also, it takes the camera traffic off of the rest of your home network. Just a couple examples of how it might be useful.

 

[achalmersman]

I'm guessing that if you're big in IOT or you have a big family, extended family, a lot of people and coming/going to your house, running web servers, home office with VPN to work or vice-versa access from others at work to home server then it could be very useful for pfSense. I'm not in that situation but just to avoid newbs getting flustered with all this "newness" I was asking the question.

The dual NIC in the server is good because it prevents cameras from accessing the rest of your home network (in the case of spyware cams). Also, it takes the camera traffic off of the rest of your home network. Just a couple examples of how it might be useful.

Again, it sounds like he already has pfSense. If he configures it properly the traffic isn't going to be on the home LAN. As long as the BI server and cameras are on the same vlan the traffic between the BI server and Cameras is layer 2 and will handled by the switch. Only traffic needing to go to other subnets would hit the pfSense interface. Blocking internet access is done via firewall rules.

Sent from my SM-G965U using Tapatalk

 

[crw030]

@Sybertiger I support the KISS network layout like you have, recommend it all the time here, it’s the best for someone that wants things to work and doesn’t want a bunch of security problems! I don’t recommend pfSense for any newbie in networking (recommend against it in fact), the ASUS routers have all the basics covered and continue to get regular updates which addresses the main issue (security).

For me I like to tinker, and 3 years ago I was getting a 1Gbps fiberlink to the house and wanted to make the most of it, and the “recommended” hardware was the ASUS ROG AC5300 (> $300). I needed a device that could be both an OpenVPN server and OpenVPN client (to establish a remote connection to a house in another state that had cameras) simultaneously. I wanted to experiment with security cameras but (at the time didn’t think of how dual-NIC would address those concerns). I wanted to learn about deep packet inspection. PfSense seemed like the perfect opportunity to tinker and get all those things (and built an SFX PC for about $450, but should have just bought a used one tbh). The learning curve for with only basic networking is a little steep, but I’m in IT and had an interest so that wasn’t really a downside.

Fast forward, and now I have multiple wireless SSIDs (IOT, Guest, Primary) so I can have all the devices separated (IOT-untrusted no internet, Guest-untrusted w/Internet capped, Primary-trusted+internet uncapped) - but can allow firewall connections when necessary (like for IOT devices to talk to devices elsewhere on the network). When a new guest moves In (think rental/AirBnB), I can provide/change that password without changing any of the 30 other primary network devices (Chromecast, SmartTV etc). I don’t really trust security of Smart TVs and definitely not the DirecTV receivers but they all need internet access, so segregating them was possible this way. In the near future, with VLANs & in-wall AP+2 ports I can put all the Guest network ports and the Guest wireless on the same VLAN so the wired and wireless devices can interact and still be segregated from my stuff.

It’s full fledged overkill, but it’s also enterprise capable so literally anything I would want to experiment with, the pfSense box would let me try it out.....possibly to my own demise. My only wish is that it integrated with the Unifi equipment I’ve started to install.

 

[eeeeesh]

I am in the KISS camp and went with network cards. (to me it was easier than vlans)

I started out with a Home Server to run PLEX, store files, etc. Then moved up to something that would run ESXI and started using virtual machines - including one that runs Blue Iris. One of my best moves was to start using pfSense (again in a virtual machine) and recently bought an Orbi system that is used just for WiFi and couldn't be happier. I started adding network cards to the server and my pfSense VM now has access seven. Everything is on it's own network. Cams, VOIP, WiFi, LAN, etc

ps - CRW030, I didn't think there were any DirecTV customers left! We 'cut the cord' several years ago

 

[crw030]

@eeeeesh yeah our DirecTV subscription will end next month when it goes from $73 up to $150/month. Turns out we could get nearly every streaming service for a lot less per month. So cutting the cord we’ll be dropping from $200/month to like $125 while adding tons more content channels than we were getting from DirecTV at that price.

For the wife it just took time to think through “why do we have monthly TV bill”, and the answer was “we always had either Comcast or DirecTV so we could watch sports, news, and network series....” but they are getting absolutely KILLED by the streaming services now.

 

[eeeeesh]

LOL been there done that -only I paid the early termination fee (about $240) to get out of my Dish contract. I had switched to them because I was fed up with DTV. Broke even on the fee in about 5 months and have been saving money ever since. We were sad to see Playstation Vue go out of business, but YouTube TV appears to be an excellent replacement so far

 

[rhosch]

I do have the pfsense hardware already and just got it installed and running today.

I also buttoned up the BI box last night and got BI installed.

Now to start the learning process.

 

[eeeeesh]

I do have the pfsense hardware already and just got it installed and running today.

I also buttoned up the BI box last night and got BI installed.

Now to start the learning process.

I would suggest you watch some of Tom's YouTube Video's on pfsense

Lawrence Systems

Lawrence Systems YouTube channel offers a look at how we run our company, the products we use and solutions we provide for our clients. We discuss and create...

www.youtube.com

 

[crw030]

Yeah I've probably watched the Lawrence Technology videos at least 5 hours, can recommend, he also sometimes covers Ubiquity and pfSense which is particularly useful for me.

 

[davej]

I'm sure whatever he's building it'll be quite capable. Just curious on what I was missing out on.

The main thing I do with pfSense is isolate different LANs with different levels of security.

 

[JustInTime2020]

If you dont need it you don't need it. But pfSense is literally an enterprise level routing / firewall / VPN, etc. It can build IPsec tunnels, anything you can think of. You can build aliases for firewall rules so that when you're building rules you use the alias (game_consoles) so that any new "game comsole" can just be added to that alias group and then all your firewall rules are updated without going into them 1 by 1. It's definitely a case of "not needed" for the network you drew. But considering its freeware and for people like me that have hardware laying around....its a no brainer. 100x the capabilities and it cost me nothing. I actually sold my Asus router for $100 after building my free pfSense server.

Sent from my SM-G965U using Tapatalk

I don't mean to hijack the thread from OP. I am trying to get into Blue Iris/pfSense/OpenVPN and got so confused. This flow chart clears up a lot of confusion but with pfSense, where it will be in this flow chart or which component it will replace? Thank you for you help and sorry OP for sidetracking , this is what I have been searching and trying to learn.

 

[achalmersman]

I don't mean to hijack the thread from OP. I am trying to get into Blue Iris/pfSense/OpenVPN and got so confused. This flow chart clears up a lot of confusion but with pfSense, where it will be in this flow chart or which component it will replace? Thank you for you help and sorry OP for sidetracking , this is what I have been searching and trying to learn.
View attachment 57631

Excuse my hasty handwriting

Could be configured a ton of different ways. I subscribe to the first model. All vlans trunk to a Cisco 3750x stack. Otherwise if your pfsense had plenty of physical ports you could do a "dumb" switch for your camera network but I think it's pointless. Depending on design you need a manageable switch for other stuff anyway if you want APs with multiple vlans for guest segregation etc.



Sent from my SM-G965U using Tapatalk