Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Newbie questions

    General pfSense Questions
    6
    25
    3351
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      Lakz last edited by

      Hi everyone,

      I've built a home server about a year ago. It runs ESXi and I've been playing with it since then. I got to the point where I want to get rid of my crappy Linksys E1200 (and I ran out of things to do with my server  ;D). I've heard about pfsense a long time ago, and I'd need to be pointed in the right direction to start working with what I have.

      This is what I have : http://tyan.com/Motherboards_S5512_S5512GM4NR

      I want to run pfsense as a VM, and connect my other computers to it. Is it possible with the single onboard NIC?

      As in :
      Port 1 = WAN
      Port 2, 3 and 4 = Ethernet switch

      1 Reply Last reply Reply Quote 0
      • stephenw10
        stephenw10 Netgate Administrator last edited by

        That board appears to have 4 on board NICs, you want to use just one of them?

        You are running other VMs on that machine also?

        Yes you can probably do it whatever the answers are.  ;)

        Steve

        1 Reply Last reply Reply Quote 0
        • P
          Paul47 last edited by

          As in :
          Port 1 = WAN
          Port 2, 3 and 4 = Ethernet switch

          I'm interested in this too. My guess is yes, and maybe there is a set of firewall rules floating around here for emulating an ethernet switch?

          There is a section in the pfsense book called "Bridging two internal networks". Maybe that is what you need. I'm guessing having a WLAN bridged to a LAN would be treated similarly to the 3 ports you want on your ethernet switch.

          1 Reply Last reply Reply Quote 0
          • stephenw10
            stephenw10 Netgate Administrator last edited by

            Yes you can easily bridge ports to make them act as a switch. However you should only do that if you happen to have a machine with lots of spare ports because the performance will be worse than the cheapest unmanaged gigabit switch. Which is fine for most situations.
            This particular machine would still manage 1Gbps between the ports but it would use cpu cycles that could be doing other things.

            Steve

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              I run pfsense on my esxi host as vm, its pretty straight forward.

              Create at min 2 vswitches in esxi.  Connect one to interface you will use as wan and connect this physical port to your modem.  Then other vswitch is you physical lan.

              connect vm pfsense wan to your wan vswitch, and lan interface to you lan vswitch.  Really all there is too it.


              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 22.05 | Lab VMs CE 2.6, 2.7

              1 Reply Last reply Reply Quote 0
              • L
                Lakz last edited by

                Wow, thanks for all these replies. Sounds awesome!

                @stephenw10:

                That board appears to have 4 on board NICs, you want to use just one of them?

                You are running other VMs on that machine also?

                Yes you can probably do it whatever the answers are.  ;)

                My understanding was that it's 1 adapter with 4 ports. I was wondering if it was enough to work with, or if I needed a second physical ethernet adapter.

                Yes, I do run quite a few WMs on that machine!

                @stephenw10:

                Yes you can easily bridge ports to make them act as a switch. However you should only do that if you happen to have a machine with lots of spare ports because the performance will be worse than the cheapest unmanaged gigabit switch. Which is fine for most situations.
                This particular machine would still manage 1Gbps between the ports but it would use cpu cycles that could be doing other things.

                I have a solid CPU and want optimal transfer speed (I tend to move large files within the network), but I'd rather spare the processing power if a simple switch could take care of it. Are we talking about these ~$50 desktop switches?

                @stephenw10:

                I run pfsense on my esxi host as vm, its pretty straight forward.

                Create at min 2 vswitches in esxi.  Connect one to interface you will use as wan and connect this physical port to your modem.  Then other vswitch is you physical lan.

                connect vm pfsense wan to your wan vswitch, and lan interface to you lan vswitch.  Really all there is too it.

                That is EXACTLY what I had in mind, but wasn't sure if it'd work. Thanks! I'll get into it this week and probably come back with more questions  :)

                1 Reply Last reply Reply Quote 0
                • B
                  biggsy last edited by

                  My understanding was that it's 1 adapter with 4 ports

                  What shows up in the vSphere client under Configuration > Network Adapters?

                  As johnpoz says, it's pretty straight forward.

                  https://doc.pfsense.org/index.php/PfSense_2_on_VMware_ESXi_5 - might help in some way.

                  1 Reply Last reply Reply Quote 0
                  • B
                    biggsy last edited by

                    The spec sheet for your motherboard says it has 4 x Intel 82574L controllers.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10
                      stephenw10 Netgate Administrator last edited by

                      I'd never thought about this but the acronym NIC is confusing for, say, a quad port card. Four Network Interfaces, one Card.
                      Anyway in this case the board has four separate interfaces as you say.

                      A $50 desktop gigabit switch, like a Netgear GS105, will handle wirespeed traffic all day without an issue. Setting up 3 NICs as a bridge will probably perform worse (at least higher latency) and use CPU cycles that could be powering some other VM. However as you've already got the spare interfaces you can try it and see.  :)

                      Steve

                      Edit: Of course if you substitute the C for controller it makes more sense.  ::)
                      http://en.wikipedia.org/wiki/Network_interface_controller

                      1 Reply Last reply Reply Quote 0
                      • K
                        kejianshi last edited by

                        You would think so wouldn't you?  I agree.

                        Or even one of these - They do actually work very well.  Plain fast unmanaged switch.

                        http://www.ebay.com/itm/Dynex-DX-GB8PRT-Ethernet-Switch-New-In-Box-/251343584639?pt=US_Network_Switches&hash=item3a853ebd7f

                        1 Reply Last reply Reply Quote 0
                        • L
                          Lakz last edited by

                          @stephenw10:

                          I'd never thought about this but the acronym NIC is confusing for, say, a quad port card. Four Network Interfaces, one Card.
                          Anyway in this case the board has four separate interfaces as you say.

                          Thanks for thanks clarifying, I'm no network expert as you can imagine  :)

                          I just went ahead and bought this guy.

                          I'm going to have to look into a wireless solution as well. As far as I understand, I could use my old Linksys E1200 as an access point, but the transfer rate is pathetic on that thing.

                          • Option one : buy a better wi-fi router/AP, plug it to the switch, problem solved

                          • Option two (favored ) : using a supported PCI adapter with similar specs

                          Does it sounds about right?

                          1 Reply Last reply Reply Quote 0
                          • K
                            kejianshi last edited by

                            Not interested in VLAN at all then I suppose?

                            1 Reply Last reply Reply Quote 0
                            • stephenw10
                              stephenw10 Netgate Administrator last edited by

                              Go with option one.

                              Or use your Linksys at whatever pathetic speed it can manage! ;)
                              It will be much faster than option 2 because….
                              There is no 802.11N support in pfSense currently, due to limited and very recent support in FreeBSD. Some 802.11N cards are supported but only at 'G' speeds.

                              Put DD-WRT on your Linksys for bonus points!
                              http://www.dd-wrt.com/wiki/index.php/Linksys_E1200

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • L
                                Lakz last edited by

                                @kejianshi:

                                Not interested in VLAN at all then I suppose?

                                I might be missing something, but isn't VLAN for large networks requiring some type of virtualization?

                                @stephenw10:

                                Go with option one.

                                Or use your Linksys at whatever pathetic speed it can manage! ;)
                                It will be much faster than option 2 because….
                                There is no 802.11N support in pfSense currently, due to limited and very recent support in FreeBSD. Some 802.11N cards are supported but only at 'G' speeds.

                                Put DD-WRT on your Linksys for bonus points!
                                http://www.dd-wrt.com/wiki/index.php/Linksys_E1200

                                Steve

                                I see. I'll just avoid the PCI solution altogether. It's just asking for troubles with either ESXi or pfSense, and doesn't really bring any benefit.

                                I never heard about DD-WRT. It looks awesome. Thanks for the input! I should receive the switch today, just in time to install pfSense and flash the Linksys over the weekend  :D

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kejianshi last edited by

                                  Not really - VLANs can be used to segregate networks or provide multiple interfaces on using one or two NICs.

                                  Example.

                                  On my 1 switch downstairs I have untagged VLAN 50 on several switch ports for the guys that stay down there plugged into 1 interface.
                                  So, they have a few ports for that network.

                                  Same switch, I have untagged 60 ports for my network and a bunch of stuff wired into that on another interface of my pfsense.

                                  Also separate VLAN and interfaces for the wireless networks for family and guests.

                                  Now, if I had a pfsense with 1 WAN and 1 LAN, I could use a Tagged VLAN to do pretty much the same thing.  Lots subnets and ports available.

                                  1 Reply Last reply Reply Quote 0
                                  • L
                                    Lakz last edited by

                                    @kejianshi:

                                    Not really - VLANs can be used to segregate networks or provide multiple interfaces on using one or two NICs.

                                    Example.

                                    On my 1 switch downstairs I have untagged VLAN 50 on several switch ports for the guys that stay down there plugged into 1 interface.
                                    So, they have a few ports for that network.

                                    Same switch, I have untagged 60 ports for my network and a bunch of stuff wired into that on another interface of my pfsense.

                                    Also separate VLAN and interfaces for the wireless networks for family and guests.

                                    Now, if I had a pfsense with 1 WAN and 1 LAN, I could use a Tagged VLAN to do pretty much the same thing.  Lots subnets and ports available.

                                    I had no idea VLANs could be used that way. That might be very useful indeed, and I will look into it. Thanks!

                                    I received the switch yesterday evening. Using the guide linked above, I had everything up and running 20 minutes later. Here I am with my fresh install, but as promised, I have more questions (which is why I wanted to use pfSense in the first place, to learn about networks  :) ).

                                    1. I want to install WM Tools. I look into System>Packages and find two packages

                                    • Open-VM-Tools         Stable 8.7.0.3046 (build-425873) platform: 2.0
                                    • Open-VM-Tools-8.8.1 RC         528969                                 platform: 2.0 2.1

                                    I assume Open-VM-Tools-8.8.1 is the one, but I just want to double check.

                                    2. I'd like to change my gateway from 192.168.1.1 to 10.xx.xx.1 . I actually tried yesterday (Interfaces>Lan) and changed the IPv4 address. It didn't work, and I didn't want to mess things up any further.

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kejianshi last edited by

                                      "I'd like to change my gateway from 198.168.1.1"

                                      OK - I'm going to assume for a minute that your WAN is OK and that you aren't double NATed or anything.

                                      On the LAN, you can change IP to 10.56.34.1 / 24 (for example) by going to:

                                      Interfaces > LAN and changing it there.  But the gateway should probably be "none".

                                      Then you will also need to change your DHCP settings for LAN to match by going to:

                                      Services > DHCP server

                                      and change the DHCP range to something like 10.56.34.100 - 10.56.34.200  (or whatever range you want)

                                      1 Reply Last reply Reply Quote 0
                                      • L
                                        Lakz last edited by

                                        @kejianshi:

                                        "I'd like to change my gateway from 198.168.1.1"

                                        OK - I'm going to assume for a minute that your WAN is OK and that you aren't double NATed or anything

                                        It was a typo. 192.168.1.1  ::)

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          kejianshi last edited by

                                          My recommendation stands…  If you do as I suggested, you probably won't have any problems.

                                          This can also be done from the console, and if you only have 1 LAN type connection, it might even be easier.

                                          10.56.34.1 is just a example - Make it anything you like, but I would make it something equally odd as 10.56.34.1

                                          The reason I do that is to minimize the chances of overlap of subnet IPs when using VPNs.

                                          10.0.0.1 for instance, is little better than 192.168.1.1

                                          1 Reply Last reply Reply Quote 0
                                          • johnpoz
                                            johnpoz LAYER 8 Global Moderator last edited by

                                            Lets make sure to mention the mask here or he will end up with his lan being 10.56.34.1/8

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 22.05 | Lab VMs CE 2.6, 2.7

                                            1 Reply Last reply Reply Quote 0
                                            • K
                                              kejianshi last edited by

                                              On the LAN, you can change IP to 10.56.34.1 / 24 or whatever…

                                              Mentioned earlier.  But yeah.  /24 is good unless you a subnet calculating pro.

                                              1 Reply Last reply Reply Quote 0
                                              • L
                                                Lakz last edited by

                                                The DHCP of course… What was  I thinking. Everything works smoothly now. Thanks.

                                                @kejianshi:

                                                My recommendation stands…  If you do as I suggested, you probably won't have any problems.

                                                This can also be done from the console, and if you only have 1 LAN type connection, it might even be easier.

                                                10.56.34.1 is just a example - Make it anything you like, but I would make it something equally odd as 10.56.34.1

                                                The reason I do that is to minimize the chances of overlap of subnet IPs when using VPNs.

                                                10.0.0.1 for instance, is little better than 192.168.1.1

                                                That is precisely the reason why I wanted to change the subnet. I'm a pilot (not often home) and plan on using VPNs extensively.

                                                So I did a fair bit of research over the weekend (remember, I'm completely new to networking, bare with me :) ). I'd love to isolate some virtual machines and a guest wireless access from the rest of the network, mostly for security reasons. I'm not sure whether VLANs or DMZs (or both) are the best way to go about it.

                                                For the sake of curiosity and expandability, I seriously consider returning my newly bought switch while I can to get a managed one with more ports.

                                                I know that Cisco is supposed to be the best manufacturer out there. Sadly the only Cisco switch I found within my budget (~$200) only has 10 ports, which I find to be too few. I've been looking around, and I came up with with these :

                                                • Cisco SG300-10 / Cisco SG300-20  ::)
                                                • TP-LINK JetStream TL-SG3216
                                                • HP JE006A#ABA
                                                • TRENDnet TL2-G244
                                                1 Reply Last reply Reply Quote 0
                                                • K
                                                  kejianshi last edited by

                                                  I've always made pretty good use of 5 seperate NIC ports, but if you need more subnets than you have NIC ports, consider VLANs.  Or if you need several subnets carried on one set of switches all over a spread out area, VLANs work great.

                                                  I didn't actually need VLANs at all in any of my applications, but if I didn't have tons of free NIC ports, I would.

                                                  1 Reply Last reply Reply Quote 0
                                                  • B
                                                    biggsy last edited by

                                                    @Lakz:

                                                    I assume Open-VM-Tools-8.8.1 is the one, but I just want to double check.

                                                    Definitely use:

                                                    • Open-VM-Tools            Stable  8.7.0.3046 (build-425873)  platform: 2.0

                                                    You may well find that 8.8.1 won't start.

                                                    1 Reply Last reply Reply Quote 0
                                                    • stephenw10
                                                      stephenw10 Netgate Administrator last edited by

                                                      I would say that you don't need VLANs. You already have several spare ports that you bridged together so the only other reason you might want them is to segregate sections of your network that span switches, you haven't mentioned anything like that.
                                                      If you need (or want  ;)) a managed switch then define what features you need on it. The low end HP switches always get a good write up here as do the Netgear managed switches, the GS108T for example.

                                                      Steve

                                                      1 Reply Last reply Reply Quote 0
                                                      • First post
                                                        Last post