PfSense as a Traffic Flow Monitor
amithad last edited by
The thing that I'm going to explain might be a stupid idea; but I need some suggestions from you all.
I have an OpenBSD firewall and it cannot be changed. It is configured with another same kind of an OpenBSD firewall with our head office. Head office and branch office communicated each other through OpenBSD inbuilt IPSec VPN.
Though I try to get some bandwidth usage details from the existing firewall, it seems pretty hard. I thought of implementing a pfSense firewall in between my LAN and the existing firewall just to monitor LAN traffic.
Internet <-------> OpenBSD PF Firewall <----------> pfSense Firewall <------> LAN
My Idea is to use keep the LAN IP addresses and the IPsec VPN intact as follows
PF Firewall Internal IP (192.168.0.7)<----> pfSense External IP(192.168.0.6) <=====> pfSense Internal IP (192.168.1.5)------> LAN
Will the above setup possible to achieve my requirement? or are their any other idea's?
JuantonJohn last edited by
If I follow, you would be double natting; but that should work. If exsiting bsd box is port forwarding, that's an issue.
May have to add a route so it can find the IPsec tunnel.
Even easier and what I'm doing right now; add the pfSense box as a second edge device. I'm having to add a second static internet ip. Then just change the gateway of all devices to point to pfsense new ip. Add route to pfSense so devices know how to get to the IPsec tunnel.
Hope this helps.
NAT can be disabled on the internal pfSense for that use case. The OpenBSD pf would have to know to NAT for 192.168.0.0/24 and 192.168.1.0/24.
You could probably do something with a transparent bridge, too, if all you want is traffic graphs.
Wouldn't it be easier to just export flows from that router or a switch even? Or just connect a span port to say something running ntop?
Running traffic through another firewall/router to monitor flow doesn't seem like the most efficient method.
jc2it last edited by
Wouldn't it be easier to just export flows from that router or a switch even?
Years ago I did this to track usage of the WAN bandwidth. Back when it was scarce. This netflow tracking took me a bit to wrap my head around, partly because I was green at the time, but it worked well enough to find unneeded services and turn them off, or reschedule them to different times.
Here is an OpenBSD example that might help. I have not followed this procedure, but it looks good. It does an OpenBSD equivalent to the RH version I implemented a long time ago.
amithad last edited by
It's a pleasure to get a help, from a forum like this. I have no words how to thank you all for your great suggestions and information.
Thank you again for your great help …..!!!