Pi Hole - BT Smart Hub 2
Discussion
I currently use device level software VPNs and Adblockers however have been toying with the idea of a hardware firewall.
I've considered Cloudflare as this is the easiest solution for what I am looking to do, However as it is not possible to change DNS settings on BT SH2 this is a non-starter.
Pi Hole running on RP2 seems really good, easy to setup and feature rich.
However as I cannot configure DNS settings on SH2 I would have to disable DHCP on SH2 and run DHCP on RP2.
I have 900/100 connection, and house with quite a lot of connected devices.
Would RP2 cause any bottlenecks? Have anyone had any connection issues with smart devices such as Ring/Alexa etc. running Pi Hole with DHCP?
Or does anyone know of any other home firewall solutions?
I've considered Cloudflare as this is the easiest solution for what I am looking to do, However as it is not possible to change DNS settings on BT SH2 this is a non-starter.
Pi Hole running on RP2 seems really good, easy to setup and feature rich.
However as I cannot configure DNS settings on SH2 I would have to disable DHCP on SH2 and run DHCP on RP2.
I have 900/100 connection, and house with quite a lot of connected devices.
Would RP2 cause any bottlenecks? Have anyone had any connection issues with smart devices such as Ring/Alexa etc. running Pi Hole with DHCP?
Or does anyone know of any other home firewall solutions?
I have done something similar, albeit with a Virgin Hub instead of the BT one.
As long as you hardwire the Raspberry Pi to the Hub I have noticed absolutely no issues, to be honest it is much more stable (and often quicker) than I experienced using the Virgin Hub as a DHCP.
I've got about 30 devices connected (various smart plugs etc) and haven't noticed any sort of bottle neck.
As long as you hardwire the Raspberry Pi to the Hub I have noticed absolutely no issues, to be honest it is much more stable (and often quicker) than I experienced using the Virgin Hub as a DHCP.
I've got about 30 devices connected (various smart plugs etc) and haven't noticed any sort of bottle neck.
me too. 2 x Piholes, both hardwired into the network. No issues whatsoever. If you go multiple piholes then sync them using https://github.com/vmstan/gravity-sync
Then maybe have a look at this https://docs.pi-hole.net/guides/dns/cloudflared/ to use DNS over https then for belt and braces have a look at using your piholes with https://www.cloudflare.com/en-gb/products/zero-tru...
All good fun!
Then maybe have a look at this https://docs.pi-hole.net/guides/dns/cloudflared/ to use DNS over https then for belt and braces have a look at using your piholes with https://www.cloudflare.com/en-gb/products/zero-tru...
All good fun!
I run a Pihole. I have FTTP (not from BT). I'm in a similar position to you, in that my router belongs to the ISP and although I can alter its config, I choose not to.
It all works fine - you wouldn't know it was there, other than the missing adverts. Piholes are brilliant; go for it.
(There are only 2 clients because the Pihole is in my DMZ, so all the queries come from the firewall. I probably wouldn't do that if I were setting it up again. It also runs the DHCP in the DMZ.)
ETA; The Pihole is not a firewall. You need another box for that; I have a Mikrotik.
It all works fine - you wouldn't know it was there, other than the missing adverts. Piholes are brilliant; go for it.
(There are only 2 clients because the Pihole is in my DMZ, so all the queries come from the firewall. I probably wouldn't do that if I were setting it up again. It also runs the DHCP in the DMZ.)
ETA; The Pihole is not a firewall. You need another box for that; I have a Mikrotik.
Edited by Theraveda on Wednesday 6th April 12:28
anxious_ant said:
I currently use device level software VPNs and Adblockers however have been toying with the idea of a hardware firewall.
I've considered Cloudflare as this is the easiest solution for what I am looking to do, However as it is not possible to change DNS settings on BT SH2 this is a non-starter.
Pi Hole running on RP2 seems really good, easy to setup and feature rich.
However as I cannot configure DNS settings on SH2 I would have to disable DHCP on SH2 and run DHCP on RP2.
I have 900/100 connection, and house with quite a lot of connected devices.
Would RP2 cause any bottlenecks? Have anyone had any connection issues with smart devices such as Ring/Alexa etc. running Pi Hole with DHCP?
Or does anyone know of any other home firewall solutions?
We have a 900/300 connection and the thing you need to consider if you’re putting in firewalls is the speed they can handle. I've considered Cloudflare as this is the easiest solution for what I am looking to do, However as it is not possible to change DNS settings on BT SH2 this is a non-starter.
Pi Hole running on RP2 seems really good, easy to setup and feature rich.
However as I cannot configure DNS settings on SH2 I would have to disable DHCP on SH2 and run DHCP on RP2.
I have 900/100 connection, and house with quite a lot of connected devices.
Would RP2 cause any bottlenecks? Have anyone had any connection issues with smart devices such as Ring/Alexa etc. running Pi Hole with DHCP?
Or does anyone know of any other home firewall solutions?
I’ve binned them BT hub and run all unifi with a UDM Pro facing the outside world (well, to the optical modem), twin pi-holes, and then assorted other unifi kit in the background handing the rest of the switching and WiFi. Very happy with overall performance although with previous provider I was starting to think the piholes were the cause of some DNS latency (vanished when we moved to BT).
If you want to get geekier/more paranoid then you can put certain smart devices on their own VLANs.
Do not buy the unifi USG (it can’t handle the speed you have).
Thanks for the replies all. Interesting thoughts and now my Pi Hole quest might be evolving into something bigger.
2 Pi Holes
I've never thought of running 2 Pi Holes.I might do some research on that. So I can failover and a secondary DNS server I suppose.
Pi Hole is not a firewall
Fair point. At the moment I am looking at a hardware level adblocker, VPN and some DoS protection. I might look at Microtik or the more exotic USG stuff. But this is certainly creeping up in costs as I would definitely have to replace my BT Hub 2. A bit of a shame as the package I am paying includes x2 WiFi mesh discs which are brilliant (shame not PoE like Unifi stuff)
Pi Hole's interface is very user friendly, and I love the dashboard. This is why I am levitating towards it.
VLAN
I run an 8 port NetGear GS308T managed switch which does hae some basic VLAN features. I haven't looked into it yet, but might need to set something up for my NVR
CloudFlare and BT
From Googling it seems that BT internet users have problems using CloudFlare DNS. The posts are about a year old so not sure if this is still an issue? Anyone on BT using CloudFlare DNS?
Port sniffing + DoS
I was port forwarding 80 to internal NVR IP. However from the Smart Hub logs I noticed that I get a lot of port sniffing and DoS attempts.
The NVR app is pretty clever in the fact that it uses random ports which periodically changes. It's some clever uPNP stuff happening.
I have setup DDNS and I was wondering why myDDNSdomain.ddns.net:12345 suddenly stopped working
Sorry for waffling on but does anyone know if having a decent firewall and VLAN setup would stop these attacks so I can port forward to my NVR?
The sole purpose of this is so I can view it from a PC when I am away from home. The app is brilliant but I prefer larger screens and keyboard+mouse setup.
Ideal setup
This would most probably be out of budget, but would be interested to hear from experts what would be the ideal setup (balance of VFM and functionality) for home network security?
I am looking for solution that works cohesively, and I prefer that it is something I can manage centrally instead of having to do it on a device level.
2 Pi Holes
I've never thought of running 2 Pi Holes.I might do some research on that. So I can failover and a secondary DNS server I suppose.
Pi Hole is not a firewall
Fair point. At the moment I am looking at a hardware level adblocker, VPN and some DoS protection. I might look at Microtik or the more exotic USG stuff. But this is certainly creeping up in costs as I would definitely have to replace my BT Hub 2. A bit of a shame as the package I am paying includes x2 WiFi mesh discs which are brilliant (shame not PoE like Unifi stuff)
Pi Hole's interface is very user friendly, and I love the dashboard. This is why I am levitating towards it.
VLAN
I run an 8 port NetGear GS308T managed switch which does hae some basic VLAN features. I haven't looked into it yet, but might need to set something up for my NVR
CloudFlare and BT
From Googling it seems that BT internet users have problems using CloudFlare DNS. The posts are about a year old so not sure if this is still an issue? Anyone on BT using CloudFlare DNS?
Port sniffing + DoS
I was port forwarding 80 to internal NVR IP. However from the Smart Hub logs I noticed that I get a lot of port sniffing and DoS attempts.
The NVR app is pretty clever in the fact that it uses random ports which periodically changes. It's some clever uPNP stuff happening.
I have setup DDNS and I was wondering why myDDNSdomain.ddns.net:12345 suddenly stopped working
Sorry for waffling on but does anyone know if having a decent firewall and VLAN setup would stop these attacks so I can port forward to my NVR?
The sole purpose of this is so I can view it from a PC when I am away from home. The app is brilliant but I prefer larger screens and keyboard+mouse setup.
Ideal setup
This would most probably be out of budget, but would be interested to hear from experts what would be the ideal setup (balance of VFM and functionality) for home network security?
I am looking for solution that works cohesively, and I prefer that it is something I can manage centrally instead of having to do it on a device level.
Edited by anxious_ant on Wednesday 6th April 16:36
anxious_ant said:
2 Pi Holes
I've never thought of running 2 Pi Holes.I might do some research on that. So I can failover and a secondary DNS server I suppose.
Yep. There's plenty of doco online about how to run a redundant setup.I've never thought of running 2 Pi Holes.I might do some research on that. So I can failover and a secondary DNS server I suppose.
anxious_ant said:
Pi Hole is not a firewall
I might look at Microtik
Cheap, performant but very much not for beginners!I might look at Microtik
BTW, IIRC, the BT mesh disks can be used with any router. Don't quote me on that!
anxious_ant said:
Thanks for the replies all. Interesting thoughts and now my Pi Hole quest might be evolving into something bigger.
2 Pi Holes
I've never thought of running 2 Pi Holes.I might do some research on that. So I can failover and a secondary DNS server I suppose.
Pi Hole is not a firewall
Fair point. At the moment I am looking at a hardware level adblocker, VPN and some DoS protection. I might look at Microtik or the more exotic USG stuff. But this is certainly creeping up in costs as I would definitely have to replace my BT Hub 2. A bit of a shame as the package I am paying includes x2 WiFi mesh discs which are brilliant (shame not PoE like Unifi stuff)
Pi Hole's interface is very user friendly, and I love the dashboard. This is why I am levitating towards it.
VLAN
I run an 8 port NetGear GS308T managed switch which does hae some basic VLAN features. I haven't looked into it yet, but might need to set something up for my NVR
CloudFlare and BT
From Googling it seems that BT internet users have problems using CloudFlare DNS. The posts are about a year old so not sure if this is still an issue? Anyone on BT using CloudFlare DNS?
Port sniffing + DoS
I was port forwarding 80 to internal NVR IP. However from the Smart Hub logs I noticed that I get a lot of port sniffing and DoS attempts.
The NVR app is pretty clever in the fact that it uses random ports which periodically changes. It's some clever uPNP stuff happening.
I have setup DDNS and I was wondering why myDDNSdomain.ddns.net:12345 suddenly stopped working
Sorry for waffling on but does anyone know if having a decent firewall and VLAN setup would stop these attacks so I can port forward to my NVR?
The sole purpose of this is so I can view it from a PC when I am away from home. The app is brilliant but I prefer larger screens and keyboard+mouse setup.
Ideal setup
This would most probably be out of budget, but would be interested to hear from experts what would be the ideal setup (balance of VFM and functionality) for home network security?
I am looking for solution that works cohesively, and I prefer that it is something I can manage centrally instead of having to do it on a device level.
Based on this I suspect you might be interested in running a home brew pfsense router/fw it will do much if not all of what you want 4 port 1gb units are on Amazon around £180 or 2.5gb units on Alibaba with intel i225 nics for the same kind of cost2 Pi Holes
I've never thought of running 2 Pi Holes.I might do some research on that. So I can failover and a secondary DNS server I suppose.
Pi Hole is not a firewall
Fair point. At the moment I am looking at a hardware level adblocker, VPN and some DoS protection. I might look at Microtik or the more exotic USG stuff. But this is certainly creeping up in costs as I would definitely have to replace my BT Hub 2. A bit of a shame as the package I am paying includes x2 WiFi mesh discs which are brilliant (shame not PoE like Unifi stuff)
Pi Hole's interface is very user friendly, and I love the dashboard. This is why I am levitating towards it.
VLAN
I run an 8 port NetGear GS308T managed switch which does hae some basic VLAN features. I haven't looked into it yet, but might need to set something up for my NVR
CloudFlare and BT
From Googling it seems that BT internet users have problems using CloudFlare DNS. The posts are about a year old so not sure if this is still an issue? Anyone on BT using CloudFlare DNS?
Port sniffing + DoS
I was port forwarding 80 to internal NVR IP. However from the Smart Hub logs I noticed that I get a lot of port sniffing and DoS attempts.
The NVR app is pretty clever in the fact that it uses random ports which periodically changes. It's some clever uPNP stuff happening.
I have setup DDNS and I was wondering why myDDNSdomain.ddns.net:12345 suddenly stopped working
Sorry for waffling on but does anyone know if having a decent firewall and VLAN setup would stop these attacks so I can port forward to my NVR?
The sole purpose of this is so I can view it from a PC when I am away from home. The app is brilliant but I prefer larger screens and keyboard+mouse setup.
Ideal setup
This would most probably be out of budget, but would be interested to hear from experts what would be the ideal setup (balance of VFM and functionality) for home network security?
I am looking for solution that works cohesively, and I prefer that it is something I can manage centrally instead of having to do it on a device level.
Edited by anxious_ant on Wednesday 6th April 16:36
anxious_ant said:
.I might look at Microtik or the more exotic USG stuff.
Don’t buy a USG! That’s the obsolete one (and won’t handle the speed you’ve got). UDM Pro would probably be best if you have the space. Watch out, the “basic” one doesn’t have PoE, but I believe there’s a version that does if you need it.
LooneyTunes said:
Don’t buy a USG! That’s the obsolete one (and won’t handle the speed you’ve got). UDM Pro would probably be best if you have the space.
Watch out, the “basic” one doesn’t have PoE, but I believe there’s a version that does if you need it.
USG has decent throughput as long as you don’t enable the IPS, which tops it out at 85Mbps. That said still don’t. I did but would probably go netgate /pfsense if starting again. Having all UniFi is nice but once you get over the fancy dashboards (most of which tell you nothing anyway) you find the UniFi routing stuff is pretty basic. Switches and APs good but go somewhere else for firewall/router. Pfsense can run pfblockerng to get ads dealt with without needing a separate pihole. Watch out, the “basic” one doesn’t have PoE, but I believe there’s a version that does if you need it.
colin79666 said:
LooneyTunes said:
Don’t buy a USG! That’s the obsolete one (and won’t handle the speed you’ve got). UDM Pro would probably be best if you have the space.
Watch out, the “basic” one doesn’t have PoE, but I believe there’s a version that does if you need it.
USG has decent throughput as long as you don’t enable the IPS, which tops it out at 85Mbps. That said still don’t. I did but would probably go netgate /pfsense if starting again. Having all UniFi is nice but once you get over the fancy dashboards (most of which tell you nothing anyway) you find the UniFi routing stuff is pretty basic. Switches and APs good but go somewhere else for firewall/router. Pfsense can run pfblockerng to get ads dealt with without needing a separate pihole. Watch out, the “basic” one doesn’t have PoE, but I believe there’s a version that does if you need it.
Pfsense may offer some advantages as a firewall but it’s heading even further into geek territory. Different solutions work for different people and it’s definitely one that the OP could consider.
Thanks so much again for the input guys, appreciate it!
I work in IT but networking is not my strong point
From the discussion it sounds like perhaps the best solution is to get a proper hardware firewall instead of RP2s and possibly new modem etc.
2 front runners:
1) UDM Pro : My previous work uses this. I do like the fancy dashboard (analytics is part of what i do) but not sure about the underlying functionality. I do not really need PoE ports at the moment. I have PoE IP cameras but my NVR conveniently has enough ports for them. Price is around £300 on 4GON. Expensive but seems to a good solution without having to change my existing setup, if it is able to block the DoS/port sniffing attacks.
2) PfSense : I've heard about this but never experienced it. I believe this is software and I still need to get the hardware? Please correct me if I am wrong.
I work in IT but networking is not my strong point
From the discussion it sounds like perhaps the best solution is to get a proper hardware firewall instead of RP2s and possibly new modem etc.
2 front runners:
1) UDM Pro : My previous work uses this. I do like the fancy dashboard (analytics is part of what i do) but not sure about the underlying functionality. I do not really need PoE ports at the moment. I have PoE IP cameras but my NVR conveniently has enough ports for them. Price is around £300 on 4GON. Expensive but seems to a good solution without having to change my existing setup, if it is able to block the DoS/port sniffing attacks.
2) PfSense : I've heard about this but never experienced it. I believe this is software and I still need to get the hardware? Please correct me if I am wrong.
anxious_ant said:
From the discussion it sounds like perhaps the best solution is to get a proper hardware firewall instead of RP2s and possibly new modem etc.
A 'proper' firewall *as well* as the RPi running pihole. The firewall wont give you the network wide ad blocking and pihole isn't a firewall!Theraveda said:
The same as if any DHCP server goes down. No-one gets an IP address. 
Run redundant servers if this bothers you. Seems a bit OTT for a domestic setup - I don't.
It is over kill, but then again running DCHP off a RPi which could potentially kill all your devices connection if it fails seems a little risky. Run redundant servers if this bothers you. Seems a bit OTT for a domestic setup - I don't.
Pfsense the software is free and will run on x86 hardware. You can find machines on eBay with 2 or more NICs that people have designed for it.
Netgate are the company behind pfsense and do their own line of hardware. This is more expensive but you get the best support in return as the hardware is fine tuned for the task and has more official support.
On the OPs connection it would need the Netgate SG-2100 or bigger as the SG-1100 isn’t powerful enough for such a fast connection when operating as a firewall.
All this sounds like overkill if all you want is a basic firewall though. The BT hub will be doing that anyway. The UniFi or Pfsense route is really for those who want to have separate VLANs, switches, APs, lots of different firewall rules and reporting. It is great fun but once you start I can guarantee you will be wanting more bits and end up in it for a lot more than initially anticipated.
I’d start with a Raspberry Pi zero 2 w and stick pihole on it. Turn off dhcp on the hub and let pihole do it if you don’t want to manually set the dhcp server address on each device. Total cost for this including case, micro sd card, usb adaptor with NIC and power supply is under £50.
Netgate are the company behind pfsense and do their own line of hardware. This is more expensive but you get the best support in return as the hardware is fine tuned for the task and has more official support.
On the OPs connection it would need the Netgate SG-2100 or bigger as the SG-1100 isn’t powerful enough for such a fast connection when operating as a firewall.
All this sounds like overkill if all you want is a basic firewall though. The BT hub will be doing that anyway. The UniFi or Pfsense route is really for those who want to have separate VLANs, switches, APs, lots of different firewall rules and reporting. It is great fun but once you start I can guarantee you will be wanting more bits and end up in it for a lot more than initially anticipated.
I’d start with a Raspberry Pi zero 2 w and stick pihole on it. Turn off dhcp on the hub and let pihole do it if you don’t want to manually set the dhcp server address on each device. Total cost for this including case, micro sd card, usb adaptor with NIC and power supply is under £50.
colin79666 said:
Pfsense the software is free and will run on x86 hardware. You can find machines on eBay with 2 or more NICs that people have designed for it.
Netgate are the company behind pfsense and do their own line of hardware. This is more expensive but you get the best support in return as the hardware is fine tuned for the task and has more official support.
On the OPs connection it would need the Netgate SG-2100 or bigger as the SG-1100 isn’t powerful enough for such a fast connection when operating as a firewall.
All this sounds like overkill if all you want is a basic firewall though. The BT hub will be doing that anyway. The UniFi or Pfsense route is really for those who want to have separate VLANs, switches, APs, lots of different firewall rules and reporting. It is great fun but once you start I can guarantee you will be wanting more bits and end up in it for a lot more than initially anticipated.
I’d start with a Raspberry Pi zero 2 w and stick pihole on it. Turn off dhcp on the hub and let pihole do it if you don’t want to manually set the dhcp server address on each device. Total cost for this including case, micro sd card, usb adaptor with NIC and power supply is under £50.
Sensible advice, many thanks Netgate are the company behind pfsense and do their own line of hardware. This is more expensive but you get the best support in return as the hardware is fine tuned for the task and has more official support.
On the OPs connection it would need the Netgate SG-2100 or bigger as the SG-1100 isn’t powerful enough for such a fast connection when operating as a firewall.
All this sounds like overkill if all you want is a basic firewall though. The BT hub will be doing that anyway. The UniFi or Pfsense route is really for those who want to have separate VLANs, switches, APs, lots of different firewall rules and reporting. It is great fun but once you start I can guarantee you will be wanting more bits and end up in it for a lot more than initially anticipated.
I’d start with a Raspberry Pi zero 2 w and stick pihole on it. Turn off dhcp on the hub and let pihole do it if you don’t want to manually set the dhcp server address on each device. Total cost for this including case, micro sd card, usb adaptor with NIC and power supply is under £50.
Few features on BT Smart Hub 2 that I would like to keep though:
1) Visual view of connected devices (grouped by WiFi/Ethernet and IpV4/6) and block access (useful when I have guests over using WiFi)
2) Block access to specific device by time range
3) Assign static IPs (Smart Hub can list device names if available which is handy)
SH2 also has an Authoritative DHCP function which is really cool.
I believe if I turn off DHCP on the Smart Hub I wouldn't be able to use these features?
I am seeking to add 2 capabilities to my network:
1) Ability to create rules to monitor/block/segment DoS/Port sniffing attacks. Nice dashboard would be a bonus
2) Ability to block adverts/trackers at hardware level. VPN feature is a bonus but not must have. I crrently use NordVPN
edit: I currently have a mini PC with specification as below which I am only using as a media server. Happy to repurpose this or buy a slightly beefier mini PC. Comes with gigabyte NIC but I suspec the processor struggles with max bandwidth processing at times.
ACEPC Mini PC 6GB RAM/120GB ROM Windows 10 Pro (64 bit) Intel Celeron Processor J3455
Edited by anxious_ant on Thursday 7th April 10:28
I run a pfsense router at home and tbh its quite easy to set up and manage. Depending on how much control, fw rules and granularity you want I suspect a domestic router will not fit the bill.
Originally I went with a TP-Link Omada system, which is a broadly a Unifi equivalent, prior to this I had a NUC running a couple of vm's for VPN and PIhole but my router would not allow for the suffisent fw rules and WIFI changes to have a segregated trusted, IoT and guest segments hence the change.
After buying the Omada system I found that the rooter/fw device does ACL's rather than stateful fw rules so yes I can segregate trusted, IoT and guest segments but I could not instigate traffic from my trusted network to the IoT which is needed for control of Sonos, Hue etc.
This lead me to replacing the Omada Router with a home brew pfsense on a ~11year old core2 duo intel system with a additonal intel 4 port 1G nic.
After watching a few tutorial vids it was relatively easy to build and configure, setting up the fw rules was only slightly more difficult, creating the vlans and trunking them to the omada switches and AP's was also relatively easy.
I have replaced my linux based openvpn with one on the pfsense as has the PIhole been replaced with pfblockerNG, I haven't had to apply time based rules but I believe there a couple of options for this on the pfsense.
As for static dhcp registration it does that and also as I've doen creation of guest networks is easy.
As you work in IT I suspect this would not be outside your ability by any stretch.
Heres the first video I watched (its a couple of pfsense releases old not but is still a good grounding in the setup and its config.
https://youtu.be/fsdm5uc_LsU
Lawrence has a number of pfsense videos on his channel including updates to the fw rules and the latest 2.6 release
Your hardware might not be a great candidate as its only single nic you can buy directly from netgate but these do seem relatively expensive for the specs personally if I had a older PC I could repurpose with a nic card I use / try that first if not then something like this
These are the latest devices with 2.5Gb nics
https://www.servethehome.com/inexpensive-4x-2-5gbe...
to buy them look on Alibaba and search for I225 nics
Or these have been used but look expsnsive to the above
https://linitx.com/category/alix--apu-firewalls/17...
Or have a look on Amazon.
Captain_Morgan said:
I run a pfsense router at home and tbh its quite easy to set up and manage. Depending on how much control, fw rules and granularity you want I suspect a domestic router will not fit the bill.
Originally I went with a TP-Link Omada system, which is a broadly a Unifi equivalent, prior to this I had a NUC running a couple of vm's for VPN and PIhole but my router would not allow for the suffisent fw rules and WIFI changes to have a segregated trusted, IoT and guest segments hence the change.
After buying the Omada system I found that the rooter/fw device does ACL's rather than stateful fw rules so yes I can segregate trusted, IoT and guest segments but I could not instigate traffic from my trusted network to the IoT which is needed for control of Sonos, Hue etc.
This lead me to replacing the Omada Router with a home brew pfsense on a ~11year old core2 duo intel system with a additonal intel 4 port 1G nic.
After watching a few tutorial vids it was relatively easy to build and configure, setting up the fw rules was only slightly more difficult, creating the vlans and trunking them to the omada switches and AP's was also relatively easy.
I have replaced my linux based openvpn with one on the pfsense as has the PIhole been replaced with pfblockerNG, I haven't had to apply time based rules but I believe there a couple of options for this on the pfsense.
As for static dhcp registration it does that and also as I've doen creation of guest networks is easy.
As you work in IT I suspect this would not be outside your ability by any stretch.
Heres the first video I watched (its a couple of pfsense releases old not but is still a good grounding in the setup and its config.
https://youtu.be/fsdm5uc_LsU
Lawrence has a number of pfsense videos on his channel including updates to the fw rules and the latest 2.6 release
Your hardware might not be a great candidate as its only single nic you can buy directly from netgate but these do seem relatively expensive for the specs personally if I had a older PC I could repurpose with a nic card I use / try that first if not then something like this
These are the latest devices with 2.5Gb nics
https://www.servethehome.com/inexpensive-4x-2-5gbe...
to buy them look on Alibaba and search for I225 nics
Or these have been used but look expsnsive to the above
https://linitx.com/category/alix--apu-firewalls/17...
Or have a look on Amazon.
Cheers for the information. I will watch the video and decide if pfsense + custom SFF firewall is the right solution for me.Originally I went with a TP-Link Omada system, which is a broadly a Unifi equivalent, prior to this I had a NUC running a couple of vm's for VPN and PIhole but my router would not allow for the suffisent fw rules and WIFI changes to have a segregated trusted, IoT and guest segments hence the change.
After buying the Omada system I found that the rooter/fw device does ACL's rather than stateful fw rules so yes I can segregate trusted, IoT and guest segments but I could not instigate traffic from my trusted network to the IoT which is needed for control of Sonos, Hue etc.
This lead me to replacing the Omada Router with a home brew pfsense on a ~11year old core2 duo intel system with a additonal intel 4 port 1G nic.
After watching a few tutorial vids it was relatively easy to build and configure, setting up the fw rules was only slightly more difficult, creating the vlans and trunking them to the omada switches and AP's was also relatively easy.
I have replaced my linux based openvpn with one on the pfsense as has the PIhole been replaced with pfblockerNG, I haven't had to apply time based rules but I believe there a couple of options for this on the pfsense.
As for static dhcp registration it does that and also as I've doen creation of guest networks is easy.
As you work in IT I suspect this would not be outside your ability by any stretch.
Heres the first video I watched (its a couple of pfsense releases old not but is still a good grounding in the setup and its config.
https://youtu.be/fsdm5uc_LsU
Lawrence has a number of pfsense videos on his channel including updates to the fw rules and the latest 2.6 release
Your hardware might not be a great candidate as its only single nic you can buy directly from netgate but these do seem relatively expensive for the specs personally if I had a older PC I could repurpose with a nic card I use / try that first if not then something like this
These are the latest devices with 2.5Gb nics
https://www.servethehome.com/inexpensive-4x-2-5gbe...
to buy them look on Alibaba and search for I225 nics
Or these have been used but look expsnsive to the above
https://linitx.com/category/alix--apu-firewalls/17...
Or have a look on Amazon.
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff