William Katsak <wkatsak@gmail.com> writes:

> I was considering the possibility of using PfSense on an x86 box as my
> main router/firewall for better throughput, and hanging Cero off of
> that for wifi. Anyone doing something similar? If so, how do you
> organize the subnets?

I have a similar setup with a dual-ethernet x86 box acting as router
for my 100/100 Mbps connection. The plan was originally to stick a
minipci wifi card in there to also act as access point, but for now I've
settled on using a cerowrt box as a relatively dumb wifi box. The setup
is something like this

+------------+           +----------+           +------------+
|            |           |          |           |            |
|  Internet  +-----------+  Router  +-----------+  WNDR3800  |
|            |           |          |           |            |
+------------+           +----------+           +------------+

The router downstream ethernet port is plugged into the wan port on the
WNDR3800 and I've configured three 802.1Q VLANs on the link between the
router and the cerowrt box, which are bridged to the LAN switch, the
private wifi interfaces and the guest wifi interfaces respectively. This
allows me to run dnsmasq etc on the router, and have the cerowrt box
simply provide wifi connectivity, but without bridging the wifi directly
to the ethernet LAN. I got lazy and only did one VLAN for each type of
wifi, rather than having one per frequency as in stock cerowrt, but see
no reason why adding additional VLANs for each frequency should pose any
problems.

The only daemons running on the cerowrt box are dropbear, radsecproxy
(for 802.11i authentication on the private wifi), ntpd, netifd and
hostapd. The router box runs a stock Arch Linux installation, with
dnsmasq serving up a /27 and a /64 (from he.net) on each of the virtual
vlan interfaces, most of the network setup managed through
systemd-networkd, and a couple of scripts to set up the he.net tunnel
and an SQM-derived shaper, as well as a manual firewall setup. The
router box also runs BIND as a local resolver, a TOR node, minidlna and
various other daemons.

The VLAN setup on the cerowrt box took a couple of attempts to get
right, but now that it is running it seems to work well. I'll be happy
to share the config if you're interested. :)

-Toke