Yes. If you put everything behind a virtual firewall the only MAC they see is the firewall's.

You could still use VirtualBox for that, though why would you want to? There isn't much benefit to running nanobsd inside of a VM.

It doesn't output to VGA, so there is no console output beyond where you saw it "hang"

You can setup a virtual serial port in VirtualBox using a named pipe, and then connect to that pipe with PuTTY. I do that with my development NanoBSD VMs in VMware.

Couldn't you create yourself a backdoor? Like a private VPN just in case you do and make sure you make the rule to access the vpn one of the first rules. Or modify the kernel of the xen server to give you a backdoor on boot similar to this article. http://www.debian-administration.org/articles/579

It must vary from config to config because when I run pfSense under Hyper-V, I do see a bit of a performance hit, but not like what others are reporting.  I also have never had to do any of the interface down/up hacks that some seem to need.

I guess it's very much ymmv.  :-)

@Kharcoff:

Quick update to others, I've played with the same Hyper-V machine, and the only thing that it was not working is the automatic start of the interfaces (both Wan and Lan). So everytime I boot pfSense I have to go to option 8 Shell and run the down and up on both interfaces:

ifconfig de0 down
ifconfig de0 up
ifconfig de1 down
ifconfig de1 up

Is easier to do this:

http://forum.pfsense.org/index.php/topic,30760.msg163707.html#msg163707

You probably don't need the dhclient de0 line, but I do as my cable modem give my public IP to the WAN interface via DHCP

@Supermule:

Its the difficult way to do it….Just DL the ISO file and install normally via VM console....

that is what I did…easy as 123.

1. create VM on ESX
2. create 2 virtual switches on ESX, one for pfsense WAN, one for pfsense LAN
3.  assign one physical nic to each switch created  in step 2.
4.  copy pfsense iso image to ESX datastore
5.  configure VM created in step 1 to boot from this iso image
6.  power on VM and follow prompts to load and configure pfsense.
7.  assign nics during pfsense install as appropriate
8. set up pfsense for your network topology

that is it in a nutshell

Concidering virtual network cards and virtual switches, this will be no problem, however, why not run both services on the same installation ?

Hi nitro

This is a post I wrote on my blog. This is one working solution.

http://blog.magiksys.net/node/1

Regards.

Alain

New record… uptime is 2 days, 09:51 and no crash still...
Using 2.0-BETA5 (amd64)
built on Wed Jan 5 22:32:02 EST 2011
Firewall works better than first image i tried (using less cpu and less states, but memory occupied is higher).

Im diggin this up again.

Manage to get a decent performance with vmware server this time. Tho with another quadcore setup..

However, since im not that familiar with freebsd at all, is there any tool or "command" to test the cpu performance? Like, SuperPI for windows (measure PI calculations in seconds, lower = faster cpu). Would be awsome, since im testing alot of virtualization solutions this could help me finding the fastest one.

Anyone?

@salida:

@PistolPete:

Other than the weird issue of having to bring the 2 interfaces down and up with a startup script, it all seems to be running fine…...

Hey there.. i am having the same problem could you please help me with the script ?
If i don't bring the interface de1 down and then up it is imposseble to use the wan interface.

I drop and bring up both de0 and de1 and then run the dhcp client on de0 to get my public IP from my cable modem:

ifconfig de1 down
ifconfig de0 down
ifconfig de0 up
ifconfig de1 up
dhclient de0

….and I saved this as /usr/local/etc/rc.d/startup.sh

update:

I am using now 64bit beta4. Basic stuff works I am trying now advanced stuff. Dyndns is working now in new firmware.
1st compare to pf 32bit v1.x it needs more memory for my setup (256MB vs 160MB; no problem every system now has 2GB :) )

ps: v1.2.3 is working width new BIOS. VBox 4 also works fine ;)

Actually, I think I was having a different issue.  kvm shutdown command totally ignored.  This seems to be freebsd-related, not specifically pfsense.  More specifically, freebsd is the victim - the bug is in the seabios used by kvm.

http://git.linuxtogo.org/?p=kevin/seabios.git;a=commit;h=50ecfa88d6a27abb873174903c9e09f989f46f1a

So, I guess I live with it until an update/fix.  Sorry for the wasted bandwidth.

The past few days I've been running my pfSense 2.0 in VirtualBox on a Windows 2008 R2 server housing 6 TB of important data.  Now this is all personal stuff in my home, and I would never do this in production for any company at this point.  But I wanted to point out that by not associating any protocols with my dedicated WAN network adapter that isolates my host OS (Windows 2008 R2) from the internet very effectively.  I virtualized in order to save on electricity.  For anyone wanting to do the same and has a windows based server or htpc and is also hurting on the electric bill…you may have had the same thought as me.  That's why I wanted to put this out there.  I've been working with computers a long time and this strikes me as a quick and simple enough solution for home use.

Hi spiegeljb,

I think you may need to ask around in the citrix forums. If your hardware can support IOMMU either in AMD forgot what the name of it is or Intel VT-d, you can directly pass pci to the HVM. Then the HVM will install the proper drivers rather than using pv-drivers or emulated IO drivers. Remember if you don't have IOMMU in your BIOS you will not be able to do pci pass thru to HVM. Below is an example of my pfsense config file :-

import os, re
arch = os.uname()[4]

kernel = "/usr/lib64/xen-4.0/boot/hvmloader"
builder='hvm'

memory = 1024
shadow_memory = 8
name = "pfsense"
vif = [ 'type=ioemu, mac=00:16:3e:xx:xx:xx, bridge=eth0, model=e1000',
        'type=ioemu, mac=00:16:3e:xx:xx:xx, bridge=eth1, model=e1000',
        'type=ioemu, mac=00:16:3e:xx:xx:xx, bridge=dummy0, model=e1000',
      ]

disk = [ 'phy:/dev/vgvolume/pfsense,xvda,w' ]

, 'file:/home/pfSense-1.2.3-RELEASE-LiveCD-Installer.iso,xvdc:cdrom,r' ]

device_model = '/usr/lib64/xen-4.0/bin/qemu-dm'

boot on floppy (a), hard disk © or CD-ROM (d) default: hard disk, cd-rom, floppy

boot="dc"

vcpus=2
cpus=["1", "2"]
pae=0
acpi=1
apic=1
sdl=0
vnc=1
vnclisten="0.0.0.0"
vncconsole=1
vncpasswd=''
stdvga=0
serial='pty'
usb=1
usbdevice='mouse'

on_poweroff = 'destroy'
on_reboot  = 'restart'
on_crash    = 'restart'

Hope this helps
Eric

ESXi 3.5 +
20Mbs WAN traffic and 80Mbs LAN with 60% CPU

My LAN switch is a Gigabit, but i dont think that I can max it out trough pfSense. So, keep your WAN, LAN, DMZ, and MgmtNet infrastructure physical and isolated. Use pfSense with dedicated NICs only for routing between.

Cheers
H

Thanks Helix - I will try what you suggest. I managed to stop pfsense crashing the host - i'm rock solid now - a BIOS update to my mobo made all my issues go away, but I like what you are suggesting also

Jon