PfSense as a Traffic Flow Monitor

amithad

Hi,

The thing that I'm going to explain might be a stupid idea; but I need some suggestions from you all.

I have an OpenBSD firewall and it cannot be changed. It is configured with another same kind of an OpenBSD firewall with our head office. Head office and branch office communicated each other through OpenBSD inbuilt IPSec VPN.

Though I try to get some bandwidth usage details from the existing firewall, it seems pretty hard. I thought of implementing a pfSense firewall in between my LAN and the existing firewall just to monitor LAN traffic.

Internet <-------> OpenBSD PF Firewall <----------> pfSense Firewall  <------> LAN

My Idea is to use keep the LAN IP addresses and the IPsec VPN intact as follows

PF Firewall Internal IP (192.168.0.7)<----> pfSense External IP(192.168.0.6) <=====> pfSense Internal IP (192.168.1.5)------> LAN

Will the above setup possible to achieve my requirement? or are their any other idea's?

Thanks :)

JuantonJohn

If I follow, you would be double natting; but that should work. If exsiting bsd box is port forwarding, that's an issue.
May have to add a route so it can find the IPsec tunnel.

Even easier and what I'm doing right now; add the pfSense box as a second edge device. I'm having to add a second static internet ip. Then just change the gateway of all devices to point to pfsense new ip. Add route to pfSense so devices know how to get to the IPsec tunnel.

Hope this helps.

Derelict

NAT can be disabled on the internal pfSense for that use case. The OpenBSD pf would have to know to NAT for 192.168.0.0/24 and 192.168.1.0/24.

You could probably do something with a transparent bridge, too, if all you want is traffic graphs.

johnpoz

Wouldn't it be easier to just export flows from that router or a switch even? Or just connect a span port to say something running ntop?

Running traffic through another firewall/router to monitor flow doesn't seem like the most efficient method.

jc2it

@johnpoz:

Wouldn't it be easier to just export flows from that router or a switch even?

Years ago I did this to track usage of the WAN bandwidth. Back when it was scarce. This netflow tracking took me a bit to wrap my head around, partly because I was green at the time, but it worked well enough to find unneeded services and turn them off, or reschedule them to different times.

Here is an OpenBSD example that might help. I have not followed this procedure, but it looks good. It does an OpenBSD equivalent to the RH version I implemented a long time ago.
https://www.pantz.org/software/flowtools/configflowtoolspfflow.html

amithad

Dear All,

It's a pleasure to get a help, from a forum like this. I have no words how to thank you all for your great suggestions and information.

Thank you again for your great help …..!!!

:)