Installing pfsense without ISP router on Bridge-Mode
-
Hello friends.
I NEED the most professional and senior advisors here !!!!I am completely new to PFSENSE, and I have a serious dilemma about whether I can even set up PFSENSE. it goes like this ..
I have a router from the Internet provider in my building that is on the first floor and the Internet network is transferred to my apartment on the second floor via a MOCA device. And I want to connect the PFSENSE to the MOCA device that I have on the second floor. The problem is that I cannot change anything on the router on the first floor because there are other people living there who the router provides Internet, Wi-Fi, TV, and more. Will I be able to work with the PFSENSE without bridge mode on the main router? I cannot change anything on the router downstairs. The owners of the house are elderly people and do not agree to touch or change anything.Some technical information that might help - as I said, my apartment on the second floor receives internet via a MOCA device and to it will be connected a brand new i3 NUC mini computer with two ETHERNET connections, one to WAN and one to LAN, on which the firewall will be installed. From the LAN connection on the mini computer, my home network will come out, which will be connected to the switch, and to the switch will be connected the rest of the network components in my house such as computers, a Wi-Fi access point and also a smart TV.
I really hope you can help me understand whether this architecture and topology in my house can even exist with PFSENSE?
Because right now everything is working great without any problems, but of course without a firewall in the middle between the main router of the house and the rest of my private network on the second floorI need the most professional and senior advisors here.
-
@johnytb said in Installing pfsense without ISP router on Bridge-Mode:
Will I be able to work with the PFSENSE without bridge mode on the main router?
Yes, if you can leave with double NAT, there is nothing special. And double NAT is almost not a problem.
pfSense will act as any other device connected to the router, using the router as upstream gateway. The router will only see the WAN IP of pfSense then.
Any upstream traffic from the LAN devices behind pfSense will get the WAN IP. -
@johnytb Just make sure that your LAN address of the two devices are not the same subnet.
pfSense default LAN subnet is 192.168.1.0/24 therefore the WAN address cannot be within that subnet.
-
@viragomann
How do i make sure or know that im leaving with double NAT ?
And is it better to set the pfsense as a DMZ in my isp router instead of just recieving traffic from isp router ? -
@johnytb You dont have options regarding double nat (and you will barely notice it too), especially if you have to ask.
You don't need dmz either.
-
@netblues
So you're saying that using pfsense for just an extra firewall layer, and without DMZ or bridge mode on the home router, it will work just fine? -
@johnytb Yes it will.
It will be protecting you from elderly people who are known intruders too. -
@johnytb said in Installing pfsense without ISP router on Bridge-Mode:
So you're saying that using pfsense for just an extra firewall layer, and without DMZ or bridge mode on the home router, it will work just fine?
However, if you want to host some service accessible from the internet, or play some online games, you probably want to place your pfsense in DMZ.
-
@Gblenn Not without access to the main router and changing things, so... no, it won't fly
-
@netblues said in Installing pfsense without ISP router on Bridge-Mode:
Not without access to the main router and changing things, so... no, it won't fly
Well, if you are not permitted to make even such a small change, I guess you are stuck.
-
@Gblenn Hosting services isn't exactly for beginners, and as for gaming, the op would probably be better off without pf, especially if the elders utilize upnp, as is usually the default.
-
If the OP needs remote access or host services, they should be using a VPN like Tailscale, which will traverse any level of NAT, including CGNAT