PfSense is now on Azure

Coldaddy

Does anyone know when pfSense will be available for CSP subscriptions?

Since the pfSense appliance is "commerce-enabled" (meaning it is enabled for per/hr fee paid to Microsoft and passed through to the vendor) it is not showing up yet for CSP subscriptions. Commerce-enabled images should be available sometime in the 2nd half of 2016. Note that BYOL images are available under CSP…maybe Netgate could provide this option in the marketplace??

Steve

PanicAcid

Hey guys,

Glad to see this on the Azure market place, it will hopefully make my life a damn sight easier with regards to terminating mulitple site vpn's onto azure, currently our only option is to spend money on routers that support policy based routing or create an abundance of separate VPNs.

I'm trying to deploy the pfSense image however I'm having problems with the deployment failing through the new web portal. Does anybody have any instructions on what I need to do there? I've tried it on an A0 and A1 VM although reading through this somebody has speculated that it needs to be A3 or above? That's a rather costly monthly bill for a router if so?

Any guides or help on this one would be mucho appreciated. We have countless clients on Azure and I would love to get them all switched over to this if I can prove it does what we need.

PanicAcid

OK so I've managed to get pfSense deployed, it was to something to do with spending limits on my account stopping me from deploying from the market place.

However I've deployed it on an A0 VM with a single NIC, it's accessible on its Azure public IP and internally. As far as the pfSense VM is concerned it's WAN IP is 10.0.0.254.

So I'm wanting to use this in 'appliance' mode just for being an endpoint for IPSec VPNs for Site to Site VPNs to Azure.

I've setup what I believe should work as a pfSense to pfSense VPN over IPSec but it's not dialing… Could this be because my on premise pfSense router is dialing to the public IP but the Azure pfSense doesn't see that as being it's public IP?

Any input on this one would be appreciated as we have a lot of clients on Azure that we can roll this out to as it will save them a fortune in buying approved model SonicWALLs specifically for route based VPNs to Azure.

Thanks again

Panic

chedxb

I am getting "Unable to display pricing" for all VM sizes message when I try to deploy PfSense on Azure.

Any idea why I can't see price info?

janaka

Hi,

I had the same issue and I had a frankly discussion with the Microsoft Azure team. They told me the same things what is said jwt before in this thread. Also they told me to provide valuable feedback in their feedback forum.

I believe if you could vote and submit your comments there, then they will consider to provide this facility to all region.

https://feedback.azure.com/forums/34192–general-feedback/suggestions/16558378-pfsense-for-azure-allow-this-facility-in-all-reg

Thanks and Best Regards
Janaka

pfsense_az.jpg_thumb

MoTec

@lemb:

Does anyone know when pfSense will be available for CSP subscriptions?

Still not available. Such a disappointment to find this out as I was going to deploy one in production. Got it working great in my test subscription (MSDN) but am unable to deploy the appliance in the production subscription because was purchased via CSP.

10 times the cost to deploy another solution just to be able to connect multiple sites with policy based (static) VPNs.

/sigh

Capture.PNG_thumb

Nic Swart

Ok, here is the full instructions, set up a Hyper-V Generation 1 instance with VHD … NOT VHDX drive with two nics, then run this script in the VM:

#! /bin/sh

# After installation, log in and choose:
#  14) to enable sshd
#  8) to login shell

pkg upgrade

pkg install -y python27 py27-setuptools bash git sudo
ln -s /usr/local/bin/python2.7 /usr/bin/python

echo 'ifconfig_hn0="SYNCDHCP"' >> /etc/rc.conf
echo 'console="comconsole vidconsole"' >> /boot/loader.conf
#echo 'comconsole_speed="115200"' >> /boot/loader.conf
echo 'kldload udf'  >> /boot/loader.conf
echo 'vfs.mountroot.timeout=300'  >> /boot/loader.conf
curl -O https://<extract this="" file="" from="" the="" bsd="" 11.1="" image="">/udf.ko
mv udf.ko /boot/kernel/

git clone https://github.com/Azure/WALinuxAgent.git
cd WALinuxAgent
git checkout v2.2.14
python setup.py install
ln -sf /usr/local/sbin/waagent /usr/sbin/waagent
ln -sf /usr/local/sbin/waagent2.0 /usr/sbin/waagent2.0
echo '#! /bin/sh' >> /usr/local/etc/rc.d/waagent.sh
echo '/usr/local/sbin/waagent --daemon' >> /usr/local/etc/rc.d/waagent.sh
chmod +x /usr/local/etc/rc.d/waagent.sh
echo "y" |  /usr/local/sbin/waagent -deprovision+user
echo  'waagent_enable="YES"' >> /etc/rc.conf</extract>

Then provision the VM like so:


$rgName = "RESOURCEGROUP"
$localFile = "C:\Users\Public\Documents\Hyper-V\Virtual Hard Disks\pfSense.vhd"
$urlOfUploadedImageVhd = "https://RESOURCEGROUP.blob.core.windows.net/vhds/pfSense-2.4.2.vhd"
$location = "Central US"

# Create the Source Image
Add-AzureRmVhd -Destination $urlOfUploadedImageVhd -LocalFilePath $localFile -ResourceGroupName $rgName
$imageConfig = New-AzureRmImageConfig -Location $location
$imageConfig = Set-AzureRmImageOsDisk -Image $imageConfig -OsType 'Linux' -OsState 'Generalized' -BlobUri $urlOfUploadedImageVhd
$imageName = "pfSense-2.4.2"
$sourceimage = New-AzureRmImage -ImageName $imageName -ResourceGroupName $rgName -Image $imageConfig

# Create the VM
$rgName = "RESOURCEGROUP"
$location = "Central US"
$imageName = "pfSense-2.4.2"
$VMName = "pfSense"
$ComputerName = "pfSense"
$OSDiskName = "pfSense-OSDisk"
$VMSize = "Standard_D2S_V3"
$userName = "pfsense"
$publicIPName = "pfSense-PublicIP"
$publicNICNmame = "pfSense-PublicNIC"
$privateNICNmame = "pfSense-PrivateNIC"
$vnetName = "privateVnet"
$sshPublicKey = "PUBIC_KEY"

$sourceimage = Get-AzureRmImage -ResourceGroupName $rgName -ImageName $imageName

# Definer user name and blank password
$securePassword = ConvertTo-SecureString ' ' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential ($userName, $securePassword)

# Create a public IP address and specify a DNS name
$pip = New-AzureRmPublicIpAddress -ResourceGroupName $rgName -Location $location -Name $publicIPName -AllocationMethod Static -IdleTimeoutInMinutes 4

$vnet = Get-AzureRmVirtualNetwork -Name $vnetName -ResourceGroupName $rgName
# Create a virtual network cards and associate with public IP address

$subnet_dmz = "/subscriptions/SUBSCRIPTIONID/resourceGroups/RESOURCEGROUP/providers/Microsoft.Network/virtualNetworks/privateVnet/subnets/dmzSubnet"
$IPconfig1 = New-AzureRmNetworkInterfaceIpConfig -Name "IPConfig1" -PrivateIpAddressVersion IPv4 -PrivateIpAddress "10.1.1.50" -Primary -SubnetId $subnet_dmz -PublicIpAddressId $pip.Id
$nic1 = New-AzureRmNetworkInterface -Name $publicNICNmame -ResourceGroupName $rgName -Location $location -IpConfiguration $IPconfig1 -EnableIPForwarding

$subnet_priv = "/subscriptions/SUBSCRIPTIONID/resourceGroups/RESOURCEGROUP/providers/Microsoft.Network/virtualNetworks/privateVnet/subnets/privateSubnet"
$IPconfig2 = New-AzureRmNetworkInterfaceIpConfig -Name "IPConfig2" -PrivateIpAddressVersion IPv4 -PrivateIpAddress "10.1.0.50" -SubnetId $subnet_priv
$nic2 = New-AzureRmNetworkInterface -Name $privateNICNmame -ResourceGroupName $rgName -Location $location -IpConfiguration $IPconfig2 -EnableIPForwarding

# Create the virtual machine configuration
$vmConfig = New-AzureRmVMConfig -VMName $vmName -VMSize $VMSize |
            Set-AzureRmVMOperatingSystem -Linux -ComputerName $ComputerName -Credential $cred -DisablePasswordAuthentication |
            Set-AzureRmVMSourceImage -Id $sourceimage.Id |
            Set-AzureRmVMOSDisk -Name $OSDiskName -StorageAccountType StandardLRS -DiskSizeInGB 256 -CreateOption FromImage -Caching ReadWrite |
            Add-AzureRmVMSshPublicKey -KeyData $sshPublicKey -Path "/home/$($userName)/.ssh/authorized_keys" |
            Add-AzureRmVMNetworkInterface -Id $nic1.Id -Primary | `
            Add-AzureRmVMNetworkInterface -Id $nic2.Id

# Create the virtual machine
New-AzureRmVM -ResourceGroupName $rgName -Location $location -VM $vmConfig

Change the IP addresses to match what you specified when you initially created the VM and the (pre-created) vNet/Subnets…. not for the script kiddies, but if you go through these scripts and fill in the missing info you will get a functional instance on Azure ... ;-)

AlBrough

@Nic:


curl -O https://<extract this="" file="" from="" the="" bsd="" 11.1="" image="">/udf.ko</extract>

Worked this one out. went to the bsd site, downloaded the boot only iso, found the udf.ko file, added it to my local web server and was able to curl it down… make sure it is lowercase, the file name was all upper and had us troubleshooting

tengtengvn

@nic-swart Is Azure VM Linux Agent working properly for you? I'm experiencing multiple issues with Azure Linux Agent.

mouidri

You will have issues if you introduce login/passwords in your VM creations
https://azure.microsoft.com/fr-fr/blog/running-freebsd-in-azure/