PFsense With Single NIC
-
this Solution Can Handle Traffic For 5000 User , or prefers to use 2 NICs
This start to sound like an homework assignment.
One physical port has a fixed limited bandwidth, the more stuff, VLAN you throw at it, it has to share that fixed bandwidth between all its VLANs. There is no magic.
-
You don't need more than one interface and hence don't need VLANs to run pfSense purely as a proxy server with Squid.
Just configure the WAN only and install Squid. There will be an allow all rule on the WAN but you may want to restrict that.
Set your clients to use the pfSense as the proxy. Done.
Steve
-
i appreciate your recommendation , i try it, its Up & running , but i am little confused
My production scenario , that i have 9 Network subnet
172.40.1.0/24 with default gateway 172.40.1.1
.
.
172.40.9.0/24 with default gateway 172.40.9.1every subnet has its own DG as i mention above , all of them routed to my fortigate Box then Internet
i want to set My Pfsense Box just as Proxy server in front of my Fortigate
what should i do in my pfsense box configuration
should i set My default gateway in Pfsense to Fortigate IP or what ? & if you have any other recommendation i should do ,
i appreciate you recommendation
Many thanks
You don't need more than one interface and hence don't need VLANs to run pfSense purely as a proxy server with Squid.
Just configure the WAN only and install Squid. There will be an allow all rule on the WAN but you may want to restrict that.
Set your clients to use the pfSense as the proxy. Done.
Steve
-
The pfSense box will need upstream connectivity, so setting it's default gateway/route. That appears to be your Cisco gear from how I understand your network. A diagram would help here.
It will also need a route back to your other subnets to reply to clients so you will probably need to add static routes to via the Fortigate device.
Since pfSense it not in the clients route by default they will either need to be configured to use the proxy or something else will have to redirect traffic to it. pfSense usually does that itself if you run in 'transparent mode' but that is not possible with this setup.
Steve
-
The pfSense box will need upstream connectivity, so setting it's default gateway/route. That appears to be your Cisco gear from how I understand your network. A diagram would help here.
It will also need a route back to your other subnets to reply to clients so you will probably need to add static routes to via the Fortigate device.
Since pfSense it not in the clients route by default they will either need to be configured to use the proxy or something else will have to redirect traffic to it. pfSense usually does that itself if you run in 'transparent mode' but that is not possible with this setup.
Steve
Many Thanks Sir
-
First of all i want to say thank you to all especially stephenw10 SammyWoo muppet ptt
everything working good in my test lab (PFsense with Single NIC) but when i am implement to my production environment , i face
some problem
PFsense & Clients Have Same Default Gateway & DNS ( But Clients have PFsense IP as Proxy Server , same configuration that was
working in Test Lab)
1- what traffic exactly should i allow to PFsense IP in my fortigate cause PFsense give me error in package Manger
2- i will Integrate My PFsense with Active Directory ( is there anything should i worry about with integration )
i appreciate your help
-
It just needs internet access like any other client for updates and packages. So it will need DNS servers and a default gateway pointed at the fortigate. I am pretty sure all of its outbound connections are on TCP/443 for that so that plus DNS should be all that is necessary if you are filtering outbound.
You can use LDAP (or RADIUS) to query AD (AD/NPS). Lots of people do it.
-
It just needs internet access like any other client for updates and packages. So it will need DNS servers and a default gateway pointed at the fortigate. I am pretty sure all of its outbound connections are on TCP/443 for that so that plus DNS should be all that is necessary if you are filtering outbound.
You can use LDAP (or RADIUS) to query AD (AD/NPS). Lots of people do it.
Many Thanks :)
-
It just needs internet access like any other client for updates and packages. So it will need DNS servers and a default gateway pointed at the fortigate. I am pretty sure all of its outbound connections are on TCP/443 for that so that plus DNS should be all that is necessary if you are filtering outbound.
You can use LDAP (or RADIUS) to query AD (AD/NPS). Lots of people do it.
Dear Sir
Can you recommend me a good tutorial for use LDAP to query AD ?
i appreciate your help
-
If you have Gold membership or Book access then:
https://portal.pfsense.org/docs/book/usermanager/external-authentication-examples.html#active-directory-ldap-exampleOtherwise there's troubleshooting tips here: https://doc.pfsense.org/index.php/LDAP_Troubleshooting
Steve
-
If you have Gold membershiop or Book access then:
https://portal.pfsense.org/docs/book/usermanager/external-authentication-examples.html#active-directory-ldap-exampleOtherwise there's troubleshooting tips here: https://doc.pfsense.org/index.php/LDAP_Troubleshooting
Steve
Yes i Have , i found it
Many Thanks Steve
