PF Sense Setup
-
@johnpoz well, dhcp isnt enabled on pfsense but it is enabled on my router so that is how I'm guessing everything is working because I know at one point yrs ago I tried pfsense and it somehow enabled DHCP while my router/modem was handing out dhcp and it caused huge issues so I turned it off and didn't go back to pfsense (till now).
I don't believe I am briding anything in pfsense. I didn't create any rules or anything like that w/in pfsense.
-
@travelmore said in PF Sense Setup:
but it is enabled on my router so that is how I'm guessing everything is working
Doesn't work that way.. I have no idea how your actually setup.. But if you have 2 actually isolated networks.
isp device -- wan (pfsense) lan -- your device
There is no way possible for your device to get dhcp from your isp device.. Doesn't work that way.
Unless you specially setup pfsense as a bridge/transparent firewall.
-
This is why I noted in a previous thread “Bridge” is used in generally 2 different ways.
One is what you’re looking at in the modem.
The other is when you clump multiple LAN’s together and create a Bridge with PFSense.
You won’t do the LAN thing with one NIC. You are correct that you haven’t done anything “bridge” related in PFSense.
Congrats on the 3020. I have a 390. They are perfect for PFSense PC Router box.
There’s a tweak for the i915 video stuff for them. For me it kept the monitor alive and greatly improved the display. When you get past the basics and have PFSense working as you wish, then it’ll be time to tweak things like the loader.conf.local file. Now is not the time.
-
@jsmiddleton4 said in PF Sense Setup:
Bridge
thank you for the information. I searched and came across this link: https://forum.netgate.com/topic/168766/setting-up-pfsense-on-my-home-network
which is I believe the thread you are referring to. that post is helpful as well because.
so below is what my current network looks like (not everything but the important pieces)
Based on the picture and comments mentioned above, in that post, my network needs to be like this, where the modem/isp device would be connected to "wan" of pfsense, and my switch would be connected to "lan" interface of pfsense. (pic below of this hopefullying being a proper wired setup)
If the adjusted network pic (above) is correct, then would I be putting my modem/router combo in bridge mode so PFsense hands out DHCP?
or would I just leave the modem/router as is and disable DHCP in the router and enable DHCP in PFSense?Thanks for reading this and your input. Its greatly appreciated!
-
@travelmore I would never setup a network like that.. Put everything behind pfsense.. That would require port forwarding, and would nat rfc1918 traffic to 1918. And your wan rule on pfsense would have to remove the block rfc1918 networks. If you ever wanted your hardware PC and wireless stuff to ever talk to anything behind pfsense.
It should be like this isp device -- pfsense - the rest of your network! You can segment all you want behind pfsense, either physically if you have ports and switches on pfsense, or via vlans if your AP and switches support it.
-
@johnpoz Currently I believe PFSense isnt even physically connected properly because WAN and LAN are both going to my switch. I just wanted to get the box physically setup and started somewhat. I want to learn what I am setting up and why. The diagram helps me explain things better. Thank you for the information, its really helpful. I will put everything behind PFSense.
When I go isp device -- pfsense-- everything else, would I be putting my modem/router combo in bridge mode so PFsense hands out DHCP?
Or would I just leave the modem/router as is and disable DHCP in the router and enable DHCP in PFSense?
*As I am typing this out, I am thinking, I have most of the ports on the back of the ISP device used (hardwired to other switches)...So I am under the impression, I would have to plug those all in the switch the pfsense box would run off of instead of having them plugged into the isp device ports....which makes me think I would have to put the isp device in bridge mode before connecting it to pfsense..
Sorry, learning as I go. Thank you again for your input.
-
You don’t need PFsense in that setup.
As noted PFSense is designed to be the 2nd device, modem first, in your network. That’s why it’s THE firewall of firewalls. It controls what does or does not pass through to devices attached to it.
Would you disable DHCP…enable in PFSense?
Not if your setup remains as your diagram.
-
Here's what putting PFSense 2nd looks like. You have a switch with nothing attached to it so not sure how you're using it. PFSense is the DHCP/DNS server for everything down stream from it. PFSense is smart, modem is dumb. PFSense does the heavy lifting, modem does none.
-
@travelmore said in PF Sense Setup:
which makes me think I would have to put the isp device in bridge mode before connecting it to pfsense..
No you could always double nat.. You just need to make sure the network being used by your isp device, ie this would be pfsense wan, does not overlap with the network you use on pfsense lan.
But sure in a more optimal setup, pfsense would get a public IP on its wan.
-
Here's what my network topology looks like. Funny as it sounds like I'm some IT guy. I'm only showing you this because given I can figure this out, ANYONE can figure it out. The red lines are 2.5gb. My cable based ISP rarely gets over 2. I'll take 1,5, 1.8 gbs. I feel for some of the users here on DSL. Wish I could donate bandwidth to them. Purple is 1gb. Wireless AP is Asus AX86U which has one 2.5gb port. 5 ethernet ports. Wireless clients that connect AX/Wifi6 are actually using the higher speeds for throughput. Just love these guys that brag about 2.1gbs wireless that are hanging on 300mbs ISP connection.
One wired client is 2.5gb as well. New Intel NUC with Intel 2.5gb LAN.
I took advantage of the multiple pci-e slots in the Dell and put three Intel based 2.5gb NIC's in. One goes to the modem, one to the AP, one to the back office. The two LAN NIC's are in PFSense's bridge modem. The 2 are one big happy family. I have a spare 1gb built-in LAN port, as I'm sure you do as well, I did have and could again add to the bridged family.
You could do the same even if only thinking 1gb NIC's. Some PFSense users crap on us bridged folks because it does make the PFSense box a switch of sorts. It works very well though. Could also use multiple NIC's setup in VLAN's, etc. But I am not going there. Don't want to tackle that learning curve.
Again given I can figure this out, anyone can mostly because of the community support on this forum.
-
@jsmiddleton4 said in PF Sense Setup:
one to the AP
What AP are you running that has 2.5ge interface? So wifi router your using as AP.. How many ports does it have.. Looks like 6?
-
Asus AX-86U. Great AX router. Not outrageously expensive. Can run RMerlin's firmware. In AP mode doesn't need to but can if want to.
2 laptops into which I've put Intel AX210's, their Wifi6E cards, connect 2.1gbs and don't break a sweat.
The laptop I'm on is about 70-80 feet from router.
When converting to AP you tell the 2.5gbe port its a LAN/Ethernet port. The remaining ones are live and 1gb which leaves 5 1gb. Also have a USB 3 external drive plugged into it. In testing probably not as fast as my NAS but from a user perspective, I can't tell any speed difference. Stream video off it easily.
-
Looks like about $300... Not bad for a box that has 6 ports, 2.5g and also supports lacp.. Other than it looks like a freaking monster ;) And you can run 3rd party firmware on it.. Not bad..
I wouldn't mind updating to wifi6, but none of the unifi ap have 2.5ge interfaces yet.. So really don't see the point in updating. I only have 2 devices that could do ax anyway. new phone and new desktop - but the desktop is wired, I would never put it on wireless even if was ax ;)
No offense but that thing is ugly ;) I like my AP on the ceiling out of the way and not really noticeable..
-
Is now. Chip shortage.....
Wasn't. Won't be. I got mine for 189 on sale at Best Buy.
Its rather small actually. Plus antenna's are easily changed. They're standard threaded jacks. I put a three antenna external pack on it, hung high on a wall. Can't see it either. The router itself is no taller than my Synology NAS.
Don't know about unifi's but there's ceiling mounted AP's with 2.5gb POE ports out there.
Edit: because I can attach a third party antenna set the router is unseen. Lives on a middle shelf with my cable modem and the NAS. You can put the router anywhere and string antenna's to it.
-
Back to Travelmore.....
"So really don't see the point in updating"
In my opinion its only worth doing so if you're ISP is fast enough to warrant it. Even if all clients were 1gb, if your ISP was faster than 1gbs, you'd be taking advantage for your clients. All clients would be fed through a 2.5gb pipe. If I had 2.5gb clients but still at 1gb or slower ISP, I'd not have messed with updating.
-
@jsmiddleton4 said in PF Sense Setup:
because I can attach a third party antenna set the router is unseen
quite true.. for under $200 be a nice piece of hardware to play with I am sure..
-
Current speed test. For 2.5gb hard wire I'm using a QNAP 2.5gb switch. Gave an Amazon refurb a shot. Works great. Half price.
-
Really didn't intend to take over helping Travelmore.
Hope he'll get back in the thread......
-
@jsmiddleton4 No worries! Thank you for your help and info you provided. As you stated I have a switch w/nothing attached in one of my diagrams. I realized that was a mistake on my part. There are many things coming to that switch, the diagram was wrong and it should look like this. I altered it a little more because if I put PF Sense 2nd and then a switch, everything else needs to be coming off of that switch as well (shown in adjusted diagram) and added a few more devices from my network.
So, please correct me if Im wrong on the below:
-
In order to have PFSense monitor bandwidth/devices, whatever else, it has to be THE firewall and has to hand out DHCP and this is why it has to be 2nd in line (correct?).
-
Router/Modem combo- If PF sense is going to hand out DHCP to be able to monitor bandwidth, then I would HAVE TO put my router into bridge mode correct?....
.....OR would I just leave it as is and Disable DHCP on my router/modem and enable DHCP on PFSense? -
If, 2 is correct and I am enabling DHCP on PF Sense and NOT enabling it on my router, can I mirror my routers current settings (such as the IP address and gateway etc, or how should I set that up?) This part has always been tricky and one of the reasons why I am hesitant because I don't fully understand all of it really well yet and I don't want to break everything when I have to work from home.
-
FYI, I DO plan on adding a home lab area off of my existing setup down the road so I can mess w/PFsense and other things w/out bricking my home network. The best thing that describes that is this link I found here (not my post but exactly what I am looking for):
https://community.spiceworks.com/topic/1012232-best-way-to-set-up-home-test-lab-network
This is later down the road.
I can give more details or even current settings of things rn if needed. I just don't want to start something and then come Monday find out something isn't right and be in a mess when I need to work. (Luckily if I get in a super bad jam I could turn on a hotspot to make it but id prefer to not be dead in water during the work week). This is one reason why I don't want to rush this but have a clear understanding of what needs to be done and why.
All, thank you again for your input and feedback I really appreciate it and thank you for being kind.
-
-
-
Short answer is yes. That’s the point of the PFSense router. There are longer answers in which it isn’t 2nd. Defeats the purpose of the firewall though.
-
Again short answer is yes. Longer answer is the double NAT setup. I know nothing about doing double NAT. In terms of the options for the modem usually its transparent bridge. Its only job is to connect to your ISP and pass it along to the PFSense router. Disabling DHCP/DNS might work though. I’m not sure about that.
I think the main issue is not the LAN DHCP/DNS. You turn it off, PFSense provides it. No biggy. I think the main issue is passing the WAN information through the modem to the WAN port on the PFSense box. That has to be working otherwise its double NAT, I think…… Get the WAN information to the WAN port on the PFSense box. Everything after that is easy.
-
I’m not sure what your asking. PFSense will hand out DHCP/DNS information to all clients down stream. If you have reserved IP’s in PFSense or static IP’s in clients its a little different. DHCP still involved unless statically assigned in the client. For those type mine are still in the same subnet, etc., just outside the DHCP range. My DHCP range is 192.168.2.9-50. Static IP’s are either .1-.7 or .51-up.
-
If you want to play with PFSense and not impact your live network, my opinion is pick up another Dell for nothing or next to nothing and use it for playground. Around me, Fort Wayne, Indiana, there’s a handful right now on Facebook Market Place. One for free. The others for less than 100.
I’ve had Harmony Logitech remotes for quite some time. Took a bit to get past the mindset of individual remotes, devices, and think like a Harmony remote and activities. Once I shifted my mind set, programming and using the Harmony was a piece of cake.
I went through the same thing with PFSense. Its NOT a premade router like Asus, TPLink, Netgear, etc. It took me a bit to change my mindset to the PFSense frame of mind. Once I did, boom, was easier than I imagined. At first it was like, “How am I going to figure this out…?” Now I wouldn’t go back to any other router setup.
And I’m just touching the surface of its capability. Some of the guys on this forum setups while complicated beyond my ability to comprehend are at the same time amazing.
-
