Basic SOHO Wireless Network

Overview

One of the most common and basic network configurations starts with a modem which connects the Internet from an Internet Service Provider (ISP). The modem can be a cable modem, fiber modem, DSL modem or other type, but it will have an Ethernet output. The Ethernet output is connected to a firewall/router, then the firewall/router is connected to a WiFi access point. The following diagram depicts a basic configuration for a Small Office/ Home Office (SOHO) network. This article is intended to serve as a general reference explaining how best to incorporate a Protectli Vault that has been configured to act as a firewall/router using any chosen firewall/routing software such as OPNsense, pfSense, etc. This assumes that the Protectli Vault has been loaded with a fresh installation of the selected OS.

 

Vault Interface Connections

• WAN to modem (ISP) Ethernet port
• LAN to PC being used for configuration, access to OS GUI
• OPT1 to wireless router

IP Assignments

• LAN interface will have a DHCP server enabled by default, and will be assigned an address of 192.168.1.1. and it will provide an IP address of 192.168.1.X to the PC used for configuration.
• Set the OPT1 IP address to 192.168.2.1, and enable DHCP Server for the interface.
• WAN interface will receive an IP address via DHCP address from the modem.

Configuration

Note: It is important with this setup to verify that the WAN IP addresses is NOT in the 192.168.1.X or 192.168.2.X range as this would create an IP address subnet conflict between the OS on the Vault and the WiFi Router.

• Verify the PC connected to the LAN port receives an IP address in the range of 192.168.1.X
• Browse from the PC to the installed OS on the Protectli Vault using default IP address of 192.168.1.1
• Verify the OS GUI is displayed
• Enable OPT1 and assign an IP address of 192.168.2.1 and enable DHCP Server for OPT1 ( Services > DHCP Server). Ensure that wireless router is not acting as a DHCP Server for OPT1

 

Firewall Rules

In order to block unknown and/or unwanted incoming traffic from the Internet and to allow access out to the Internet, the OS has some built in rules for the WAN and LAN ports.

• WAN: Default rule is to DENY any incoming traffic
• LAN: Default rule is to ALLOW any incoming or outgoing traffic

In order to allow access out to the Internet for all of the WiFi connected devices, a rule has to be created for the OPT1 interface that is the same as the default LAN interface rule.

• OPT1: No default rules. Replicate the LAN ANY to ANY rule to allow traffic through this interface

 

By following the simple network configuration above, the firewall should be able to effectively pass network traffic among all network devices and out to the Internet. Keep in mind that this is intended to document the physical topology and get the firewall up and running as quickly as possible. Refer to documentation pertaining to the specific software that is installed on the Vault in order to customize configuration settings to suit your network needs. Installation guides and more can be found in our Knowledge Base. As always, should you need additional assistance, please feel free to reach out to us using our support page.