Can you install pfsense on box connected to internal network?
-
By this I mean, I acquired a multi NIC box as a backup for the pfSense box I already have. I would like to connect this new box to my internal network and configure it and be able to switch between my old pfSense box and the new one to match the config.
I dont think this is possible due to subnet confliction as I won't be able to set up my interfaces but wanted to ask. -
It is possible.
I set up my laptop to share it's wifi internet connection (macOS) and connected a second cold spare appliance’s WAN port to the physical port on the laptop. On macOS, it will run its own NAT and DHCP on a different subnet.
I connected a monitor and KB to the cold spare appliance. I downloaded the most recent Netgate installer, created the install media, placed a backup of the config.xml on the install media, and successfully installed 2.9.0 CE. It was able to fetch all the packages, updates, and restore my config.xml.
I am stress testing 2.9.0 CE to make sure everything works before deploying. To remote access the Web GUI via the spare WAN port, you simply have to turn off the firewall momentarily or connect your laptop behind the spare appliance. Depending on what setting you change, the firewall may automatically restart on it's own.
pfctl -d # disable firewall pfctl -e # enable firewallI assume you could do something similar with a spare port on your current pfSense appliance or laptop/desktop.
-
@amrogers3 and what are you using for your internet, a different internet connection - the same one with single IP, multiple public IPs available. Behind an isp device doing nat already?
You could for sure setup multiple pfsenses that share the same networks.. Just need to not have any IP conflicts.
Not exactly sure what your wanting to do with this spare pfsense? You just want it to test with, you want to use it for?
I have 2 different pfsense vms, their wans are in my dmz segment (192.168.3.0/24) that is just a segment off my main pfsense.
The lan networks of these vms are both 192.168.9.0/24, ie my normal lan network. If I want to test something on one of these vms - I just point my client in my lan to their lan IPs to use it as my gateway. They do not provide dhcp to my lan, and their lan IPs are different then my main pfsense lan IP and do not conflict with any other IP on my lan.
-
@amrogers3 Depends, but if I understand the intent it is easy.
1st part, plug the WAN from the new system into a LAN port, the new pfSense system will pickup an address and the install should work fine.
2nd part, restore old config to new. This is where it gets slightly weird, the network that is the WAN on the new system will conflict with the matching LAN network on the new system. If you can avoid using that 1 conflicting network on the new one you will be fine.
Then you can in theory manually swap between the 2 systems. I have done this a few times.
If I missed the intent then others will have better answers.
-
Mmm, if you use a DHCP WAN then you just need to connect it in some way to avoid a conflict after the config restore. So create a temporary interface on the existing firewall perhaps or insert something with NAT in between as suggested.
-
I appreciate the feedback and suggestions from you guys, thank you.
This sounds a bit messy no matter which way I go.
I want to create an identical pfSense box for backup purposes so IP conflicts will be a problem since I will be using the same IPs
I wanted to attach the new box to the old network and switch between to copy configs but that was a problem.
What I may do is take an old wireless router I am not using, plug the new box into that and join the wifi to connect to it and configure it. Not the easiest solution, but at least I wouldnt have any IP conflicts -
@amrogers3 so you want a HA setup? What is in front of the current pfsense, if your behind a nat pretty easy to setup a HA since you have multiple wan IPs to work with.
How complicated is your network.. My backup plan if my main pfsense died would be to just flip on one of my VMs. While I have multiple segments - it wouldn't take long to just load in the latest backup into that and correct a few things, etc. Getting what I would need up would really only be a matter of a few minutes to get internet working again. Ok sure my plex server wouldn't be available to my users.. It would be for me, etc. But I would have internet and could bring up the rest of the network pretty quickly.
It would more switch config changes to run all the vlans through the vm than anything else - the actual config of the interfaces on the vm and rules would be pretty easy.
-
@amrogers3 said in Can you install pfsense on box connected to internal network?:
I want to create an identical pfSense box for backup purposes so IP conflicts will be a problem since I will be using the same IPs
To be able to do that I added one VLAN that is different on each router. In my case I use a CGNAT (because I never use that for anything else) IP range. So every router got a CGNAT VLAN but with a different subnet, everything else is the same (a few VLANs and the normal LAN). The CGNAT VLAN is isolated and simulates an upstream provider that uses DHCP to deliver the IP.
That was the best I could come up with. With that I can add whatever router OS I want in my normal network, configure it the way I want, including a CGNAT VLAN uniq to that router. And then replace the in-use router with the new one.
I haven't implemented the IPv6 part yes but could be done by NAT66 so that I could simulate the /48 prefix I get.
Privacy Policy · Cookie Policy