Download Extension Packages separately / on a different PC

bananenmann

Hello,
I have a quick question. I am an IT Specialist trainee specializing in System Integration, and we are currently working with Hyper-V on a virtual scenario that includes an integrated pfSense instance. The goal is to set up a WireGuard Site-to-Client tunnel using pfSense; however, the pfSense instance is not permitted to access the Internet—meaning it cannot be assigned an external virtual switch. Now, WireGuard is not a standard component of pfSense, though it can typically be installed via the package manager. However, this is not possible in our specific scenario because pfSense is NOT allowed to connect to the Internet. Is it therefore possible to download the necessary WireGuard extensions from an external source onto the host machine and then install them locally within pfSense?

tinfoilmatt

Lol.

luckman212

@bananenmann This is not supported, and not sure why your instructor would set up the lab with these essentially impossible restrictions. Still, I'm always up for a challenge so for kicks, I just tried this on a fresh VM and appeared to succeed.

If you want to try: manually fetch the pkg from another machine, copy it to your air gapped VM, and install it from the console.

From machine with internet access:

curl -o wg.pkg "https://pkg00-atx.netgate.com/pfSense_v2_8_1_amd64-pfSense_v2_8_1/All/pfSense-pkg-WireGuard-0.2.9_6.pkg"

Copy that file over to your pfSense CE 2.8.1 VM and enter at the console:

pkg add -f /path/to/wherever/you/put/wg.pkg

"It works"...

tinfoilmatt

Why would one need WireGuard in an airgapped environment? To tunnel an airgapped connection through/behind pfSense?

Hm...

luckman212

@tinfoilmatt I guess to practice configuring the S2S tunnels, subnets, etc? Used to do things like this with Cisco Packet Tracer IIRC.

tinfoilmatt

Sure, open-Netgate forum IT Specialist trainee in System Integration exam and all that. Could be.

luckman212

@tinfoilmatt System Banana Micro Claw Specialist in VM analysis and micro management Cyber Harness certification CCNABNNA ?

tinfoilmatt

...and IPVE, intellectual property violator extraordinaire.

bananenmann

@luckman212
Thanks for the help. I had tried this before but used the wrong link, which is why the package download failed. (Did I mention that I hate A.I. ? )

In our test scenario we want to implement DirectAccess. We are aware that this technology is considered obsolete, but it is more complex and therefore well-suited for training purposes. The "Router-Main" runs on pfSense. One Router called "NAT1" uses Ubuntu 24.04.2 and all the other servers run Windows Server 2012 R2, while the clients use Windows 8.1.

(At first I posted a Picture of our szenario here, but I'm not shure it's allowed by our Instructors, so I deleted it)

After starting this thread, I became unsure whether we are strictly forbidden from using an external switch for the main router—or if it might be allowed initially for performing updates and downloading packages before removing it again. I will check with the instructor tomorrow.

Best regards