pfSense on VPS - Setup issue

sensori · Oct 11, 2019, 6:16 PM

Hi all,

I've installed pfSense on a VPS and partly configured it. I did this by accessing the Web GUI over the WAN port (LAN port was deactivated). Now I activated the LAN port and I cannot access the Web GUI over the WAN port anymore. I tried to ping from another VPS on the same subnet, that didn't work either. I suppose when I remove the LAN port again I'll get access to the Web GUI again over the WAN port, but that's not the point. What I would like to do, is to access the Web GUI securely i.e. not over the WAN port.

I couldn't find any "good" guide to setup pfSense on a VPS. The guides I have found were suggesting to disable the firewall for a while until the setup is finished, which I find pretty insecure.

So, can someone please a provide a link for a good guide or give some guidance how to solve this problem?

NollipfSense · Oct 11, 2019, 8:44 PM

@sensori said in pfSense on VPS - Setup issue:

I've installed pfSense on a VPS and partly configured it

I was about to ask you! This has been on my to do list but keep getting bumped. I had been looking on these sources:
https://blog.kylemanna.com/cloud/pfsense-on-google-cloud/

https://medium.com/@silasthomas/how-to-import-a-pfsense-firewall-into-google-cloud-platform-ad62257a143a

Derelict · Oct 11, 2019, 9:15 PM

Why? What do you intend to protect on a single VPS?

sensori · Oct 11, 2019, 9:44 PM

@NollipfSense : Thanks for the response!
From the first link:

Disable the firewall
Disable the firewall so that the SSH can be accessed and configured:

pfctl -d
Yes, this is a massive hole, I assume you know what you are doing. This will get re-enabled after the WebUI configuration.

I have pfSense online for only 1 day and there are dozens of unknown IPs in the firewall log.

The 2nd link doesn't deal with the configuration of pfSense at all.

@Derelict : Thanks for the response!

Why? What do you intend to protect on a single VPS?

I want to protect at least one VPS with a Web Server and one with a DB.

Meanwhile I have removed the LAN interface and gained again access to the Web GUI over WAN. I have added 2 rules in the firewall, one for HTTPS and one SSH, to have access from my Public IP only. However I still can't access pfSense from another machine in LAN. I've found somewhere that I have to change the IP of the Web GUI and put a rule in the firewall but I can't even find where I can make this change.

Derelict · Oct 11, 2019, 9:59 PM

I would just use the firewall on the VPS host itself (think iptables) or whatever the VPS provider has available in front of it.

sensori · Oct 11, 2019, 10:07 PM

@Derelict : Interesting!
My VPS provider doesn't provide a firewall.
It's clear that pfSense would increase the security. So why I shouldn't use it?

johnpoz · Oct 12, 2019, 2:02 AM

Pfsense is installed as the OS.. its not a server, its a router/firewall distro designed to do that firewall/route.. Unless you have multiple devices behind it, you wouldn't use it on a single VPS.. So as Derelict stated - just use the firewall that comes with whatever OS your VPS is running.. If its a vps running OS XYZ.. just use the host firewall that you can run on that xyz OS to protect it.

What OS is your VPS running?

NollipfSense · Oct 12, 2019, 3:58 AM

@sensori said in pfSense on VPS - Setup issue:

I want to protect at least one VPS with a Web Server and one with a DB.

So, you already have an OS with stuff and service...the link I provided assumed VPS is an empty hard drive with no OS. Are you running CentOS? It seems that to do what you want to do a virtual pfSense machine may work if you have the memory...adds complexity though.

sensori · Oct 12, 2019, 8:50 AM

I would like to use pfSense in front of a Web Server - with it come some other components like nginx (Load Balancer, Reverse Proxy), a VCS (GitLab), 2 DBMSs and some other stuff. I assume, I could put all in one big machine but I thought it is better to have several small machines instead and separate them. With the current VPS provider I can create subnets. So the idea is to have a subnet where all machines can communicate with each other easily and pfSense in front of them as firewall to protect them. Of course only the Web Server would be open to the public, access to all other machines is meant only for me. Maybe it is better to put the Web Server in front of pfSense, I'm not sure.

At the moment I'm just experimenting with pfSense to see how I can achieve what I want. I created only 2 machines, on one of them I've installed pfSense and on the other one (Ubuntu) I haven't installed nothing so far. This is only for testing purposes only. In the final architecture I would like to use CentOS on all machines if I can (I don't have any experience with CentOS).

stephenw10 · Oct 12, 2019, 2:28 PM

Just add firewall rules to allow the access you need (to the webgui, to ssh etc) on the WAN before you enable another interface. Doing that moves the default allow rule to LAN and blocks any traffic you have not explicitly allowed on WAN.#

Steve

Derelict · Oct 12, 2019, 6:38 PM

Sounds like a VPC not a VPS.

sensori · Oct 31, 2019, 10:47 AM

Sorry for the late response.

@stephenw10 : that helped. Thanks!

@Derelict : after a more thorough research I found that the VPSs are separated in the network layer, so it's not a VPC. The VPS provider recommends to encrypt the connection between VPSs.

The root of my issues is probably because of the VPS nature e.g. routing, which I haven't encountered before when using pfSense in my LAN - so it's not a pfSense issue. However, if someone has link(s) to good guides, it would be helpful.

Derelict · Oct 31, 2019, 3:44 PM

No help to offer without a better description of what you actually have. Doesn't sound like an environment where pfSense will do you any good.

Snuggly · Jun 10, 2021, 2:40 PM

This post is deleted!