PF Sense Setup
-
Hello everyone, I am new here to PFsense, networking/routing/and firewalls, etc. I’ve recently installed PFsense.
PFsense is installed on a 3020 PC w/2 nics. 1 for WAN, 1 for LAN, I am not too sure if I have everything set up properly and was hoping someone w/more experience than myself could verify the setup. I don't want to unintentionally set up something open to the world (open ports that shouldn't be open, incorrect setup, etc), leaving my network open somewhere and not know it. If something isn’t right please state it/how to adjust it.
Currently, no packages are installed. I wanted to make sure the setup was proper before digging into plug-ins and I am not too sure which ones to use.
I still am using my ISP-provided modem/router to hand out DHCP (I’d prefer to keep it that way until I get more familiar w/everything). I work from home so I don’t want to cause issues. I have a Pihole for DNS.
Currently my LAN IP is a static one. WAN IP is just set to grab one from DHCP. Based off the videos I’ve seen, this seems to be the proper setup.
In PF Sense in System/General Setup, under DNS Server Settings, I have my Pihole IP address and 1.1.1.1. (nothing in the DNS Hostname for either).
On the Interfaces/ WAN (re0) Tab, under reserved networks the Block private networks and loopback addresses & Block bogon networks are both checked.
Under Services/DHCP Server/LAN Enable DHCP is unchecked. (as I want to use my modem/router to hand out DHCP still)
Under Services/DNS Resolver/General Settings Enable DNS resolver is checked, All-is selected under Network Interfaces & Outgoing Network Interfaces.
Is this alright or should something be adjusted here?DNS Forwarder is not enabled.
After getting the proper setup w/what I currently have, my goal is to monitor all the devices on my network (wired and wireless) and see how much bandwidth they are pulling and by what method (browsing, gaming, streaming, etc.) The more details I can get the better. I have a data cap that we keep going over and I want to know why/from what devices, etc.
Currently, no packages are installed. What ones are recommended for device/bandwidth monitoring, etc?
I have seen a few that might work but was more curious if there is the best way or these are the best packages to use for hitting your goal.
Apologies for this being so long but I wanted to give as much detail on my setup as possible.
Thank you for taking the time to read this. Any help is appreciated.
-
@travelmore said in PF Sense Setup:
Under Services/DHCP Server/LAN Enable DHCP is unchecked. (as I want to use my modem/router to hand out DHCP still)
The above is in conflict with the goal below...assuming you have your modem/router in front of pfSense...the way to accomplish the goal is let pfSense handle all DCHP requests so you can monitor effectively.
@travelmore said in PF Sense Setup:
my goal is to monitor all the devices on my network (wired and wireless) and see how much bandwidth they are pulling and by what method (browsing, gaming, streaming, etc.)
-
@travelmore said in PF Sense Setup:
I still am using my ISP-provided modem/router to hand out DHCP
how would that even work? Unless you were bridging pfsense..
-
@nollipfsense Thank you for that information. So would I put my router in modem in bridge mode, then enable DHCP on PFsense? Or just disable DHCP on my router and enable it on PFSense. Sorry, I am new to setting these things up. I appreciate your feedback.
-
@johnpoz well, dhcp isnt enabled on pfsense but it is enabled on my router so that is how I'm guessing everything is working because I know at one point yrs ago I tried pfsense and it somehow enabled DHCP while my router/modem was handing out dhcp and it caused huge issues so I turned it off and didn't go back to pfsense (till now).
I don't believe I am briding anything in pfsense. I didn't create any rules or anything like that w/in pfsense.
-
@travelmore said in PF Sense Setup:
but it is enabled on my router so that is how I'm guessing everything is working
Doesn't work that way.. I have no idea how your actually setup.. But if you have 2 actually isolated networks.
isp device -- wan (pfsense) lan -- your device
There is no way possible for your device to get dhcp from your isp device.. Doesn't work that way.
Unless you specially setup pfsense as a bridge/transparent firewall.
-
This is why I noted in a previous thread “Bridge” is used in generally 2 different ways.
One is what you’re looking at in the modem.
The other is when you clump multiple LAN’s together and create a Bridge with PFSense.
You won’t do the LAN thing with one NIC. You are correct that you haven’t done anything “bridge” related in PFSense.
Congrats on the 3020. I have a 390. They are perfect for PFSense PC Router box.
There’s a tweak for the i915 video stuff for them. For me it kept the monitor alive and greatly improved the display. When you get past the basics and have PFSense working as you wish, then it’ll be time to tweak things like the loader.conf.local file. Now is not the time.
-
@jsmiddleton4 said in PF Sense Setup:
Bridge
thank you for the information. I searched and came across this link: https://forum.netgate.com/topic/168766/setting-up-pfsense-on-my-home-network
which is I believe the thread you are referring to. that post is helpful as well because.
so below is what my current network looks like (not everything but the important pieces)
Based on the picture and comments mentioned above, in that post, my network needs to be like this, where the modem/isp device would be connected to "wan" of pfsense, and my switch would be connected to "lan" interface of pfsense. (pic below of this hopefullying being a proper wired setup)
If the adjusted network pic (above) is correct, then would I be putting my modem/router combo in bridge mode so PFsense hands out DHCP?
or would I just leave the modem/router as is and disable DHCP in the router and enable DHCP in PFSense?Thanks for reading this and your input. Its greatly appreciated!
-
@travelmore I would never setup a network like that.. Put everything behind pfsense.. That would require port forwarding, and would nat rfc1918 traffic to 1918. And your wan rule on pfsense would have to remove the block rfc1918 networks. If you ever wanted your hardware PC and wireless stuff to ever talk to anything behind pfsense.
It should be like this isp device -- pfsense - the rest of your network! You can segment all you want behind pfsense, either physically if you have ports and switches on pfsense, or via vlans if your AP and switches support it.
-
@johnpoz Currently I believe PFSense isnt even physically connected properly because WAN and LAN are both going to my switch. I just wanted to get the box physically setup and started somewhat. I want to learn what I am setting up and why. The diagram helps me explain things better. Thank you for the information, its really helpful. I will put everything behind PFSense.
When I go isp device -- pfsense-- everything else, would I be putting my modem/router combo in bridge mode so PFsense hands out DHCP?
Or would I just leave the modem/router as is and disable DHCP in the router and enable DHCP in PFSense?
*As I am typing this out, I am thinking, I have most of the ports on the back of the ISP device used (hardwired to other switches)...So I am under the impression, I would have to plug those all in the switch the pfsense box would run off of instead of having them plugged into the isp device ports....which makes me think I would have to put the isp device in bridge mode before connecting it to pfsense..
Sorry, learning as I go. Thank you again for your input.
-
You don’t need PFsense in that setup.
As noted PFSense is designed to be the 2nd device, modem first, in your network. That’s why it’s THE firewall of firewalls. It controls what does or does not pass through to devices attached to it.
Would you disable DHCP…enable in PFSense?
Not if your setup remains as your diagram.
-
Here's what putting PFSense 2nd looks like. You have a switch with nothing attached to it so not sure how you're using it. PFSense is the DHCP/DNS server for everything down stream from it. PFSense is smart, modem is dumb. PFSense does the heavy lifting, modem does none.
-
@travelmore said in PF Sense Setup:
which makes me think I would have to put the isp device in bridge mode before connecting it to pfsense..
No you could always double nat.. You just need to make sure the network being used by your isp device, ie this would be pfsense wan, does not overlap with the network you use on pfsense lan.
But sure in a more optimal setup, pfsense would get a public IP on its wan.
-
Here's what my network topology looks like. Funny as it sounds like I'm some IT guy. I'm only showing you this because given I can figure this out, ANYONE can figure it out. The red lines are 2.5gb. My cable based ISP rarely gets over 2. I'll take 1,5, 1.8 gbs. I feel for some of the users here on DSL. Wish I could donate bandwidth to them. Purple is 1gb. Wireless AP is Asus AX86U which has one 2.5gb port. 5 ethernet ports. Wireless clients that connect AX/Wifi6 are actually using the higher speeds for throughput. Just love these guys that brag about 2.1gbs wireless that are hanging on 300mbs ISP connection.
One wired client is 2.5gb as well. New Intel NUC with Intel 2.5gb LAN.
I took advantage of the multiple pci-e slots in the Dell and put three Intel based 2.5gb NIC's in. One goes to the modem, one to the AP, one to the back office. The two LAN NIC's are in PFSense's bridge modem. The 2 are one big happy family. I have a spare 1gb built-in LAN port, as I'm sure you do as well, I did have and could again add to the bridged family.
You could do the same even if only thinking 1gb NIC's. Some PFSense users crap on us bridged folks because it does make the PFSense box a switch of sorts. It works very well though. Could also use multiple NIC's setup in VLAN's, etc. But I am not going there. Don't want to tackle that learning curve.
Again given I can figure this out, anyone can mostly because of the community support on this forum.
-
@jsmiddleton4 said in PF Sense Setup:
one to the AP
What AP are you running that has 2.5ge interface? So wifi router your using as AP.. How many ports does it have.. Looks like 6?
-
Asus AX-86U. Great AX router. Not outrageously expensive. Can run RMerlin's firmware. In AP mode doesn't need to but can if want to.
2 laptops into which I've put Intel AX210's, their Wifi6E cards, connect 2.1gbs and don't break a sweat.
The laptop I'm on is about 70-80 feet from router.
When converting to AP you tell the 2.5gbe port its a LAN/Ethernet port. The remaining ones are live and 1gb which leaves 5 1gb. Also have a USB 3 external drive plugged into it. In testing probably not as fast as my NAS but from a user perspective, I can't tell any speed difference. Stream video off it easily.
-
Looks like about $300... Not bad for a box that has 6 ports, 2.5g and also supports lacp.. Other than it looks like a freaking monster ;) And you can run 3rd party firmware on it.. Not bad..
I wouldn't mind updating to wifi6, but none of the unifi ap have 2.5ge interfaces yet.. So really don't see the point in updating. I only have 2 devices that could do ax anyway. new phone and new desktop - but the desktop is wired, I would never put it on wireless even if was ax ;)
No offense but that thing is ugly ;) I like my AP on the ceiling out of the way and not really noticeable..
-
Is now. Chip shortage.....
Wasn't. Won't be. I got mine for 189 on sale at Best Buy.
Its rather small actually. Plus antenna's are easily changed. They're standard threaded jacks. I put a three antenna external pack on it, hung high on a wall. Can't see it either. The router itself is no taller than my Synology NAS.
Don't know about unifi's but there's ceiling mounted AP's with 2.5gb POE ports out there.
Edit: because I can attach a third party antenna set the router is unseen. Lives on a middle shelf with my cable modem and the NAS. You can put the router anywhere and string antenna's to it.
-
Back to Travelmore.....
"So really don't see the point in updating"
In my opinion its only worth doing so if you're ISP is fast enough to warrant it. Even if all clients were 1gb, if your ISP was faster than 1gbs, you'd be taking advantage for your clients. All clients would be fed through a 2.5gb pipe. If I had 2.5gb clients but still at 1gb or slower ISP, I'd not have messed with updating.
-
@jsmiddleton4 said in PF Sense Setup:
because I can attach a third party antenna set the router is unseen
quite true.. for under $200 be a nice piece of hardware to play with I am sure..
