How to Connect an Access Point to pfSense

PfSense is an open source firewall solution that can be used at home, at school or in a company (see our install guide with hardware recommendations). In most cases you don’t want to connect clients exclusively via network cable, but also wirelessly. The easiest way is to connect a WLAN access point to the firewall that takes care of the wireless devices (e.g. smartphones).

Setup

It is well known that a picture says more than 1000 words:

The pfSense LAN interface is connected to a switch to which the access point and other wired clients can be connected.

Setting up an Access Point

After the access point is connected (in our example an access point from tp-link) (like this one), it still has to be set up. Each access point usually also comes with a web interface that you can use to make settings. The IP address of the access point can be found in pfSense under Status → DHCP-Leases.

Now you can access the web interface of the access point.

After login (tp-link’s default username and password is admin) you can configure all important settings under Quick Setup:

• Change the login account → Yes (set new username and password)
• Please select the proper operation mode according to your needs → Access Point
• Access AP Mode Settings
  • Wireless Network Name(SSID) → WLAN network name
  • Channel → Auto
  • Wireless Security Mode → WPA2-PSK
  • Wireless Password → WLAN Password
  • Type → Static IP
  • IP Address → select an IP address from the LAN, e.g. 10.10.10.253
  • DHCP Server → Disable (Since pfSense takes care of the IP addresses).

Conclusion

Although there are also mini computers and routers for pfSense that come with a WLAN chip, very few of them can be operated in access point mode. In most cases, they only support client mode so that you can connect to a WLAN network, but you can’t create one yourself. PfSense only supports a few cards in access point mode. An overview can be found here. Finally, IMHO it is much easier to connect an access point to pfSense instead of finding the right WLAN chip.