= Configuring pfSense =

All the configurations in the pfSense can be easily done using the web configurator. To access the web configurator you have to get in to your client machine. before starting the virtual machine chage the following settings.

 - Go to your '''pc.'your domain'.ws.learn.ac.lk''' on vitualbox and go to '''settings'''. Under the '''Network''' attribute go to '''Adapter1''' tab
 - Change the Attached to: '''Internal Network'''. Do not change the name '''intent'''
 - Start the vm. Now your Virtual machine is disconnected from the outside network. Only way to access web or network is through the firewall
 - At the moment you will not be able to browse the web.

== Logging Into the Web Interface and Initial setup ==

 - Open your web browser in the '''pc virtual machine''' and go to https://10.1.1.1 
 - You might get an error saying '''your connection is not private'''. That is because you do not have an valid https certificate. Therefore click '''Advanced --> Add Exception --> Confirm Security Exception''' 
 - You will get the login page to the pfSense. Give the default username and password ('''admin''','''pfsense''') 
 - You will directed to the setup wizard. click '''Next''' for the first two pages
 - Under the General Information,
   * Hostname : '''pfsense'''
   * Domain: '''Your domain''' (eg: user1.ws.learn.ac.lk)
   * Primary DNS Server : '''192.248.1.161'''
   * Secondary DNS Server: '''192.248.1.164'''
 - Click '''Next'''
 - Give time zone as '''Asia / Colombo''' and click '''Next'''
 - Next page is about Configure WAN Interface. Do not change anything. click '''Next'''
 - Next page is about Configure LAN Interface. Do not change anything. click '''Next'''
 - In the Next page You will be asked to give a password for admin web login. Type a password and confirm it. click '''Next''' ('''Please remember the given password''')
 - Set is done. Click on '''Reload'''. You will get a messege '''Wizard completed'''. Click on the link to access webConfigurator
 - You will be directed to the pfSense dashboard.

You should be able to browse the web by now.

== Configuring The Firewall ==

Click the menu button on the top right corner. You will see nine tabs. Which means there are many features in the pfSense firewall. We will only see some basic and important features.

=== Enable SSH ===

Enabling SSH is important if you need to do some configurations remotely. To enable ssh

 - Go to menu and click '''System'''
 - In the drop down list select '''advanced''' and you will directed to a configuration page 
 - Under '''Admin Access''' tab find the topic '''Secure Shell'''
 - Tick the '''Enable Secure Shell''' check box
 - Click '''Save'''

=== Firewall Rules ===
 - Go to menu and click '''Firewall'''
 - In the drop down list select '''Rules''' and you will directed to the firewall rules configuration page 
 - You will see three tabs
   * WAN : Traffic coming to WAN port
   * LAN : Traffic coming to LAN port
   * Floating : Advanced Firewall Rules which can apply in any direction and to any or multiple interfaces
 - In the WAN tab you will see two rules already configured
   * Blocking your private network leaking outside
   * Blocking IANA reserved IPv6 addresses leaking outside
 - In the WAN tab you will see three rules already configured
   * Enabling HTTPS, HTTP and SSH (If you enable SSH) to the firewall IP
   * Enable All the LAN IPv4 addresses to connect outside
   * Enable All the LAN IPv4 addresses to connect outside
Now let's create a new rule.
 - In your VM desktop go to left corner and click the icon. From the menu select '''Terminal Emulator''' and open a Terminal
 - Try to ping a known host (Your gateway, LEARN DNS or even Google) it should work
 - Now go to your firewall web interface Under the LAN tab click '''Add''' and You will be prompted to the Edit Firewall page
 - Set the parameter as follows
   * Action : '''Block'''
   * Interface : '''LAN'''
   * Address Family : '''IPv4'''
   * Protocol : '''ICMP'''
   * Source : '''Single Host or Alias'''
   * Give your vm's IP address in the text box
   * Destination : '''any'''
   * Description : '''Block ICMP from user host'''
 - Click '''save''' and Click '''Apply changes''' in the following page
 - Try ping the an IP from your VM
 - We will do more on rules later

=== Static NAT ===
You can Use Static NAT if you have a special requirement Like a Web server inside your LAN. What this does is map your mentioned private IP to an additional public IP 

==== Create virtual IP ====
We need to create a Additional WAN IP for the NAT.
 - First go to '''menu''' and select '''Firewall''', From the drop down list select '''Virtual IPs'''
 - In the Virtual IP's Page click on '''Add''' Button
 - In the next page set the following
   * Type : '''IP Alias'''
   * Interface : '''WAN'''
   * Address Type : ''' Single address'''
   * Address : Give the Spare address in the [wiki:ipallocation IP table] / 24
   * Description : WAN IP for NAT
 - Click '''Save''' and '''Apply changes''' on the next page

==== Create NAT ====
Now lets map the created Public IP and Private IP
 - First go to '''menu''' and select '''Firewall''', From the drop down list select '''NAT'''
 - In the '''1:1''' Page click on '''Add''' Button
 - In the next page set the following
   * Interface : '''WAN'''
   * External subnet IP : Your spare IP address
   * Internal IP : '''Single host''' and give your VM's IP in the text box
   * Destination : '''any'''
   * Description : NAT For test
 - Click '''Save''' and '''Apply changes''' on the next page

==== Allow Access ====
 - First go to '''menu''' and select '''Firewall''', From the drop down list select '''Rules'''
 - In the '''WAN''' tab click on '''Add''' Button
 - In the next page set the following
   * Action : '''Pass'''
   * Interface : '''WAN'''
   * Address Family : '''IPv4'''
   * Protocol : '''any'''
   * Source : '''any'''
   * Destination : '''Single Host or Alias'''
   * Give your vm's IP address in the text box
   * Description : '''Allowing NAT'''
 - Click '''Save''' and '''Apply changes''' on the next page

 - Now try to ping to your VM from your PC (use the Public IP address)
 - Now try to ssh to your VM from your PC (use the Public IP address)

=== Using Alias ===
Aliases can be used to simplify your configurations. Imagine you have set of devices that needs the same privileges. To set firewall rules you have add rules for each device. With aliases you can bundle them under a name. To create aliases:
==== Create Aliases ====
Let's bundle some hosts
 - First go to '''menu''' and select '''Firewall''', From the drop down list select '''Aliases'''
 - In the '''IP''' tab click on '''Add''' Button
 - In the next page set the following
   * Name : '''Famoussites'''
   * Description : '''some most visited sites'''
   * Type : '''Hosts'''
   * IP or FQDN : google.com
   * Click '''Add Host''' You will get another box too add more hosts
   * Add yahoo.com and facebook.com and click '''Save''', In the next page click '''Apply Changes'''

Now let's bundle some ports
 - Go to '''menu''' and select '''Firewall''', From the drop down list select '''Aliases'''
 - In the '''Ports''' tab click on '''Add''' Button
 - In the next page set the following
   * Name : '''Usable ports'''
   * Description : '''some most popular ports'''
   * Type : '''Ports'''
   * Port : add port 22,53,25,80,443  then click '''Save''', In the next page click '''Apply Changes'''

Now lets use these aliases
 - Go to menu and click '''Firewall'''
 - In the drop down list select '''Rules''' go to WAN tab
 - Edit the rule you create in the NAT section by clicking the '''pencil''' icon
 - Change destination port range from '''any''' to '''other'''
 - In the Custom text box type ports (Alias name)
 - Click '''Save''' and '''Apply Changes'''
 - Try to Ping the VM from your PC
 - Try to SSH to the VM from your PC

 - Go to menu and click '''Firewall'''
 - In the drop down list select '''Rules''' go to LAN tab and click '''Add'''
 - Set the parameter as follows
   * Action : '''Block'''
   * Interface : '''LAN'''
   * Address Family : '''IPv4'''
   * Protocol : '''ICMP'''
   * Source : '''Single Host or Alias'''
   * Give your vm's IP address in the text box
   * Destination : '''Single Host or Alias'''
   * Give alias Famoussites
   * Description : '''Block ICMP from user host'''
 - Click '''Save''' and '''Apply changes''' on the next page
 - Try ping to google.com, Yahoo.com, facebook.com from your VM
 - Try ping www.ac.lk

=== Traffic Management ===

 - Open a browser from your pc and go to: http://beta.speedtest.net
you are going to test your link speed.
 - In the web page note down the testing host (eg: LIMRAS EONET/ Madurai)
 - click the '''GO''' button. It will run the link speed test. After the test note down the parameters (Better if you can run this two or three times)
 - Now go back to your pfSense web interface. Go to menu and click '''Firewall'''. Select '''traffic shaper''' from the drop down list
 - In the '''limiter''' click '''new limiter'''
 - Add these in the following webpage
   * Enable : '''tick the checkbox'''
   * Name : '''upload'''
   * Bandwidth : Bandwidth : '''1''', Bw type : '''Mbit/s''', Schedule : '''none'''
   * Description : '''Upload badwidth limiter'''
   * Click '''Save''' and click '''Apply changes'''
 - Again click '''new limiter''' and add these in the following
   * Enable : '''tick the checkbox'''
   * Name : '''download'''
   * Bandwidth : Bandwidth : '''1''', Bw type : '''Mbit/s''', Schedule : '''none'''
   * Description : '''Upload badwidth limiter'''
   * Click '''Save''' and click '''Apply changes'''
 - Go to menu and click '''Firewall''', In the drop down list select '''Rules''' go to '''LAN''' tab 
 - Edit the rule (by clicking the pencil icon) with the description '''Default allow LAN to any rule'''
 - Click '''Display Advanced''' button
 - Find the '''!In/Out pipe''' section. It has drop down boxes.
Left side  drop down box is for Inbound traffic to the LAN port, Right side  drop down box is for Outbound traffic of the LAN port
 - In the left side box select upload
 - In the right side box select download
 - '''Save''' and '''Apply changes'''
 - Go to speedtest website again. Repeat the test. Any Changes?

=== Package Management ===

 - Go to '''Menu''' and Select '''System'''. From the drop down list select '''Packet Manager'''
 - Click on '''available Packages'''
You will see lot of packages. All these packages can be easily installed with !pfSense. You can also configure them within the firewall. But If you are Using these packages, You might need more hardware requirements. For this instance you will install '''ntopng'''. You can find a description about ntopng in the '''available Packages'''.
 - Find '''ntopng''' and click the '''install''' button. and '''Confirm''' the installation
It will take some time to install. After the instantiation it will give you a message '''installation successfully completed'''
 - Now go to '''menu''' select '''Diagnostics'''. From the drop down list select '''ntopng settings'''
 -  Set the parameter as follows
   * Enable ntopng : '''tick the checkbox'''
   * Keep !Data/Settings : '''tick the checkbox'''
   * ntopng Admin Password : Give a password and Confirm it
   * Interface : '''LAN'''
   * Do not change DNS Mode
   * Local Network : '''Consider only LAN interface local'''
   * Historical Data Storage : '''Untick the chack box''' (In Actual environment You can enable this, If you have Good amount of Disk space)
   * Click '''Save'''
 - Now go to '''menu''' select '''Diagnostics'''. From the drop down list select '''ntopng'''
You will directed to the ntopng login page.
 - Give user name as '''admin''' give your password
Currently you have a single LAN device connected. There it will only show communications on that device.
 - Go to '''Flows''' tab, You will see all the flows going through the firewall.
 - Ping some known sites and see the changes
 - Browse some web site and see the changes