Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PFsense With Single NIC

    Scheduled Pinned Locked Moved General pfSense Questions
    21 Posts 6 Posters 3.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M Offline
      MR-NT
      last edited by

      Many Thanks

      but Can you give more details , i will use VLANs , with no gateway , but still i must create 2 interfaces one for LAN & other For Wan ,
      Can Pfsense work same as TMG with Single NIC Topology Like Attached Pic

      TMG-In-Proxy-Mode-1.gif
      TMG-In-Proxy-Mode-1.gif_thumb

      1 Reply Last reply Reply Quote 0
      • SammyWooS Offline
        SammyWoo
        last edited by

        Must have switch with VLAN capability, Nick's Hardware over @ Youtube has a video.

        1 Reply Last reply Reply Quote 0
        • M Offline
          MR-NT
          last edited by

          Many thanks
          Can you support me with video link for this issue please ,I appreciate your help

          1 Reply Last reply Reply Quote 0
          • pttP Offline
            ptt Rebel Alliance
            last edited by

            ???

            https://doc.pfsense.org/index.php/Installing_pfSense#Assign_Interfaces_on_the_Console

            Only one interface (WAN) is required to setup pfSense

            NOTE: If only one NIC is assigned (WAN), This is called Appliance Mode. In this mode, pfSense will move the GUI anti-lockout rule to the WAN interface so the firewall may be accessed from there. The usual routing functions would not be active since there is no "internal" interface. This type of configuration is useful for VPN appliances, DNS servers, etc.

            1 Reply Last reply Reply Quote 0
            • ? Offline
              A Former User
              last edited by

              It's very easy
              With you switch, you'll have 3 ports.

              Port 1 will be untagged in vlan 100
              Port 2 will be untagged in vlan 200
              Port 3 will be tagged with vlans 100 and 200

              On your PfSense you have two VLAN interfaces, vlan 100 is your "WAN" interface and vlan 200 is your "LAN" interface.

              You plug your WAN into Port 1, you plug your LAN into Port 2 and your plug your PfSense into Port 3.

              If this is too complex/confusing then I would politely suggest some time spent studying the fundamentals of IP and Ethernet would be of great assistance to you that someone showing you a video that won't cover your exact use case requirements.  The PfSense book is quite good for this and is only a Gold Subscription (or even cheaper for HTML access to it)

              1 Reply Last reply Reply Quote 0
              • M Offline
                MR-NT
                last edited by

                Thanks
                I appreciate your recommendations 😀

                1 Reply Last reply Reply Quote 0
                • M Offline
                  MR-NT
                  last edited by

                  Dear sir
                  By the way port 3 (untagged) will be management port 😀
                  @muppet:

                  It's very easy
                  With you switch, you'll have 3 ports.

                  Port 1 will be untagged in vlan 100
                  Port 2 will be untagged in vlan 200
                  Port 3 will be tagged with vlans 100 and 200

                  On your PfSense you have two VLAN interfaces, vlan 100 is your "WAN" interface and vlan 200 is your "LAN" interface.

                  You plug your WAN into Port 1, you plug your LAN into Port 2 and your plug your PfSense into Port 3.

                  If this is too complex/confusing then I would politely suggest some time spent studying the fundamentals of IP and Ethernet would be of great assistance to you that someone showing you a video that won't cover your exact use case requirements.  The PfSense book is quite good for this and is only a Gold Subscription (or even cheaper for HTML access to it)

                  1 Reply Last reply Reply Quote 0
                  • M Offline
                    MR-NT
                    last edited by

                    this Solution Can Handle Traffic For 5000 User , or prefers to use 2 NICs

                    @MR-NT:

                    Dear sir
                    By the way port 3 (untagged) will be management port 😀
                    @muppet:

                    It's very easy
                    With you switch, you'll have 3 ports.

                    Port 1 will be untagged in vlan 100
                    Port 2 will be untagged in vlan 200
                    Port 3 will be tagged with vlans 100 and 200

                    On your PfSense you have two VLAN interfaces, vlan 100 is your "WAN" interface and vlan 200 is your "LAN" interface.

                    You plug your WAN into Port 1, you plug your LAN into Port 2 and your plug your PfSense into Port 3.

                    If this is too complex/confusing then I would politely suggest some time spent studying the fundamentals of IP and Ethernet would be of great assistance to you that someone showing you a video that won't cover your exact use case requirements.  The PfSense book is quite good for this and is only a Gold Subscription (or even cheaper for HTML access to it)

                    1 Reply Last reply Reply Quote 0
                    • SammyWooS Offline
                      SammyWoo
                      last edited by

                      @MR-NT:

                      this Solution Can Handle Traffic For 5000 User , or prefers to use 2 NICs

                      This start to sound like an homework assignment.

                      One physical port has a fixed limited bandwidth, the more stuff, VLAN you throw at it, it has to share that fixed bandwidth between all its VLANs. There is no magic.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Offline
                        stephenw10 Netgate Administrator
                        last edited by

                        You don't need more than one interface and hence don't need VLANs to run pfSense purely as a proxy server with Squid.

                        Just configure the WAN only and install Squid. There will be an allow all rule on the WAN but you may want to restrict that.

                        Set your clients to use the pfSense as the proxy. Done.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • M Offline
                          MR-NT
                          last edited by

                          i appreciate your recommendation , i try it, its Up & running , but i am little confused

                          My production scenario , that i have 9 Network subnet

                          172.40.1.0/24 with default gateway 172.40.1.1
                          .
                          .
                          172.40.9.0/24 with  default gateway 172.40.9.1

                          every subnet has its own DG as i mention above , all of them routed to my fortigate Box then Internet

                          i want to set My Pfsense Box just as Proxy server in front of my Fortigate

                          what should i do in my pfsense box configuration

                          should i set My default gateway in Pfsense to Fortigate IP or what ? & if you have any other recommendation i should do ,

                          i appreciate you recommendation

                          Many thanks

                          @stephenw10:

                          You don't need more than one interface and hence don't need VLANs to run pfSense purely as a proxy server with Squid.

                          Just configure the WAN only and install Squid. There will be an allow all rule on the WAN but you may want to restrict that.

                          Set your clients to use the pfSense as the proxy. Done.

                          Steve

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S Offline
                            stephenw10 Netgate Administrator
                            last edited by

                            The pfSense box will need upstream connectivity, so setting it's default gateway/route. That appears to be your Cisco gear from how I understand your network. A diagram would help here.

                            It will also need a route back to your other subnets to reply to clients so you will probably need to add static routes to via the Fortigate device.

                            Since pfSense it not in the clients route by default they will either need to be configured to use the proxy or something else will have to redirect traffic to it. pfSense usually does that itself if you run in 'transparent mode' but that is not possible with this setup.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • M Offline
                              MR-NT
                              last edited by

                              @stephenw10:

                              The pfSense box will need upstream connectivity, so setting it's default gateway/route. That appears to be your Cisco gear from how I understand your network. A diagram would help here.

                              It will also need a route back to your other subnets to reply to clients so you will probably need to add static routes to via the Fortigate device.

                              Since pfSense it not in the clients route by default they will either need to be configured to use the proxy or something else will have to redirect traffic to it. pfSense usually does that itself if you run in 'transparent mode' but that is not possible with this setup.

                              Steve

                              Many Thanks Sir

                              1 Reply Last reply Reply Quote 0
                              • M Offline
                                MR-NT
                                last edited by

                                First of all i want to say thank you to all especially  stephenw10 SammyWoo muppet ptt

                                everything working good in my test lab (PFsense with Single NIC)  but when i am implement to my production environment , i face

                                some problem

                                PFsense & Clients Have Same Default Gateway & DNS ( But Clients have PFsense IP as Proxy Server , same configuration that was

                                working in Test Lab)

                                1- what traffic exactly should i allow to PFsense IP in my fortigate cause PFsense give me error in package Manger

                                2- i will Integrate My PFsense with Active Directory ( is there anything should i worry about with integration )

                                i appreciate your help

                                New.png
                                New.png_thumb

                                1 Reply Last reply Reply Quote 0
                                • DerelictD Offline
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  It just needs internet access like any other client for updates and packages. So it will need DNS servers and a default gateway pointed at the fortigate. I am pretty sure all of its outbound connections are on TCP/443 for that so that plus DNS should be all that is necessary if you are filtering outbound.

                                  You can use LDAP (or RADIUS) to query AD (AD/NPS). Lots of people do it.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • M Offline
                                    MR-NT
                                    last edited by

                                    @Derelict:

                                    It just needs internet access like any other client for updates and packages. So it will need DNS servers and a default gateway pointed at the fortigate. I am pretty sure all of its outbound connections are on TCP/443 for that so that plus DNS should be all that is necessary if you are filtering outbound.

                                    You can use LDAP (or RADIUS) to query AD (AD/NPS). Lots of people do it.

                                    Many Thanks  :)

                                    1 Reply Last reply Reply Quote 0
                                    • M Offline
                                      MR-NT
                                      last edited by

                                      @Derelict:

                                      It just needs internet access like any other client for updates and packages. So it will need DNS servers and a default gateway pointed at the fortigate. I am pretty sure all of its outbound connections are on TCP/443 for that so that plus DNS should be all that is necessary if you are filtering outbound.

                                      You can use LDAP (or RADIUS) to query AD (AD/NPS). Lots of people do it.

                                      Dear Sir

                                      Can you recommend me a good tutorial for use LDAP to query AD ?

                                      i appreciate your help

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S Offline
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        If you have Gold membership or Book access then:
                                        https://portal.pfsense.org/docs/book/usermanager/external-authentication-examples.html#active-directory-ldap-example

                                        Otherwise there's troubleshooting tips here: https://doc.pfsense.org/index.php/LDAP_Troubleshooting

                                        Steve

                                        1 Reply Last reply Reply Quote 0
                                        • M Offline
                                          MR-NT
                                          last edited by

                                          @stephenw10:

                                          If you have Gold membershiop or Book access then:
                                          https://portal.pfsense.org/docs/book/usermanager/external-authentication-examples.html#active-directory-ldap-example

                                          Otherwise there's troubleshooting tips here: https://doc.pfsense.org/index.php/LDAP_Troubleshooting

                                          Steve

                                          Yes i Have , i found it

                                          Many Thanks Steve

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.