How to configure a PFSense Firewall

[logbuilder]

[I][B]
There is really no maintainance once configured to your liking.

Yea sure.. just like events. Get it working and then never touch it again. Not in my world!

These days I spend as much time tuning the network (pfSense) as I do with HS3 management. Hey, I'm not complaining. I like the control that pfSense gives. I use the 3 router strategy and the rules between the three have become robust. I currently have open ports and the rules to protect those has been a recent focus and I'm to a place I feel comfortable. I need to implement openVPN to take it to the next level.

Pete, you were my mentor in getting pfSense installed. I'm very appreciative of your direction and help. It has been a great addition to my toolbox however it is likely overkill for my basic needs. But the product is a joy to use. Once you get over the learning curve (it is steep at first), it makes sense.

Thanks Pete!

[Pete]

My main issue was how to change the default IP address of PFSense.

Very easy. Note that the devices of your network get access to the internet using the default gateway or IP address of the router (PFSense).

With a VGA monitor and keyboard the default console looks like this:

 0) Logout (SSH only)                  9) pfTop
 1) Assign Interfaces                 10) Filter Logs
 2) Set interface(s) IP address       11) Restart webConfigurator
 3) Reset webConfigurator password    12) PHP shell + pfSense tools
 4) Reset to factory defaults         13) Update from console
 5) Reboot system                     14) Disable Secure Shell (sshd)
 6) Halt system                       15) Restore recent configuration
 7) Ping host                         16) Restart PHP-FPM
 8) Shell

For the LAN side you would utilize
Option #2 set interface(s) IP address.

Not this is the same IP utilize for the WebGUI except that if you change it on the WebGUI you may lose access via the web gui.

Really easier to reconfigure your home network on a piece of paper.

Here is an example.

Decide on the maximum number of devices you think will exist on your home network.

Note this is the same for any sort of SOHO router or router combo.

Say your max will be 50 devices.

Utilize this IP subnet calculator located here: hxxp://www.subnet-calculator.com/

It is just bean counting. Note that this relates only to IP4.

So here I pick 62 devices max (to round off the number) with a subnet of 255.255.255.192 or a mask bit of 26.

The IPs in this subnet could be (an example) ==> 192.168.0.1 - 192.168.0.62

Here you could set the IP address of your PFSense box to be 192.168.0.1. This is also known as the gateway address.

Relating to DHCP you set up a DHCP scope. The scope if the range of IPs you want to utilize for DHCP

So for above you could set IPs 192.168.0.50 to 192.168.0.62 for the scope providing DHCP IPs in that range.

For DHCP reservation in PFSense you configure a device you see in the status of DHCP to a static IP below the DHCP scope. By default PFSense will utilize the MAC address of the device.

I am old school here and arrange my subnet according to type of device. IE: managed switches use IPs xx to xx, servers use IPs xx to xx, desktops xx to xx, et al. I also utilize a spreadsheet here with device description, DNS name, IP, et al.

[Pete]

Robert Brown

In the 1990's a router configuration was mostly a manual effort with router tables in text files manually edited. The firewall rules were also just text files.

Today with the Linux UFW (Uncomplicated Fire Wall) configuration it is still mostly just text files edited via the command line interface.

PFSense takes it an easy on the eyes web gui and installation of plugins is just running scripts in BSD (via GUI).

[Richel]

My main issue was how to change the default IP address of PFSense.

Very easy. ...

I am old school here and arrange my subnet according to type of device. IE: managed switches use IPs xx to xx, servers use IPs xx to xx, desktops xx to xx, et al. I also utilize a spreadsheet here with device description, DNS name, IP, et al.

Pete:
Thank you!
Elliott

[Richel]

So, I tried to get the answer to this problem on the FreeBSD forum, but was told I was using unsupported version of FreeBSD, which was a variant for pfSense. I'm trying here, because this forum is friendlier.
I am using FreeBSD 11.3-STABLE for pfSense (V. 2.4.5). In the process of restoring from an old backup for pfSense, everything got trashed on the computer. So, now, when I boot up the computer, I get "no boot loader (see attached photo)." I put in the default and nothing happens. I tried to reinstall from a USB drive, but that doesn't work, because the USB drive does not get recognized and I can't set the BIOS to boot from it. Being a novice at this, how can I get out of this part, where it asks for the boot drive, to a prompt to get other information to boot from the USB drive to reinstall? Thanks.

[Alex_W]

You could try resetting the BIOS.

Then try booting from the USB again.

[Richel]

You could try resetting the BIOS.

Then try booting from the USB again.

Thank you. I finally was able to change the boot sequence in the BIOS and I am now in process of re-installing pfSense.

[Alex_W]

You're welcome. I'm glad I could help.

[Pete]

Good news Elliott!!!

Thinking you are using a BeeLink BT3 pro eh?

You could shrink down the Windows 10 partition on the eMMC drive and install PFSense on the leftover partition space or just install PFSense on the eMMC drive wiping out the Windows 10 partition.

Just upgraded here to PFSense V2.5 release. It broke my IP6 stuff. Just a suggestion to wait on the update

[Richel]

Good news Elliott!!!

Thinking you are using a BeeLink BT3 pro eh?

You could shrink down the Windows 10 partition on the eMMC drive and install PFSense on the leftover partition space or just install PFSense on the eMMC drive wiping out the Windows 10 partition.

Just upgraded here to PFSense V2.5 release. It broke my IP6 stuff. Just a suggestion to wait on the update

Pete:
Thanks. I migrated a while ago from the BeeLink to a box I bought off eBay last year: Dual NIC Intel 82574L GbE Atom D2550 1.86 GHz Mini-ITX Motherboard. I wanted dual NIC, which turns out to be faster on the LAN than the USB ethernet one. I do have a second computer for my pfSense backup: an old Tangent computer (Pentium(R) Dual-Core CPU T4500 @ 2.30GHz), which has only one NIC. Both setups got trashed with the restore from backup of pfSense (not sure why it happened with both). However, I had no issues with the ITX to re-install pfSense. The Tangent was the problem to re-install. I have not dared yet to restore from backup to pfSense on the ITX, so I am just reconfiguring it.

I have been reading about issues with the upgrade of pfSense and have decided to wait.

[Pete]

Sometimes it is better to install new then reinstall your apps afterwards. That doesn't help though with configuration.

[Richel]

Sometimes it is better to install new then reinstall your apps afterwards. That doesn't help though with configuration.

Well, I thought I could go with a fresh pfSense 2.4.5 install and then add in the various services that I had. However, it is not possible to add packages with the older version. You have to upgrade in order add packages.

[Pete]

I read some place on the PFSense forum that the folks there are going to open up the repositories once again for the 2.4.5 addons. They closed it all with the release of 2.5.

[Richel]

I read some place on the PFSense forum that the folks there are going to open up the repositories once again for the 2.4.5 addons. They closed it all with the release of 2.5.

Well, so far everything is good with 2.5.0. Also, CPU usage is noticeably less than with the previous version and, possibly, it is using a bit less memory, too. So, for me, no need at this point to go back to the older version.

[Pete]

Good news Elliot. Here still showing pending on the IP6 connectivity even though it is working.

I read that it is an issue with the DPinger service and I do see errors in the logs relating to DPinger.

I posted my sort of working fix over here ==>

IPv6 No Gateway after 2.5 upgrade

Might order another 32Gb SSD today and build it from scratch. Should be OK to do.