Configuring pfSense

All the configurations in the pfSense can be easily done using the web configurator. To access the web configurator you have to get in to your client machine. before starting the virtual machine chage the following settings.

• Go to your pc.'your domain'.ws.learn.ac.lk on vitualbox and go to settings. Under the Network attribute go to Adapter1 tab
• Change the Attached to: Internal Network. Do not change the name intent
• Start the vm. Now your Virtual machine is disconnected from the outside network. Only way to access web or network is through the firewall
• At the moment you will not be able to browse the web.

Logging Into the Web Interface and Initial setup

• Open your web browser in the client virtual machine and go to ​https://10.1.1.1
• You might get an error saying your connection is not private. That is because you do not have an valid https certificate. Ignore the error and Proceed to the web page.
• You will get the login page to the pfSense. Give the default username and password (admin,pfsense)
• You will directed to the setup wizard. click Next for the first two pages
• Under the General Information,
  • Hostname : pfsense
  • Domain: Your domain (eg: user1.ws.learn.ac.lk)
  • Primary DNS Server : 192.248.1.161
  • Secondary DNS Server: 192.248.1.164
• Click Next
• Give time zone as Asia / Colombo and click Next
• Next page is about Configure WAN Interface. Do not change anything. click Next
• Next page is about Configure LAN Interface. Do not change anything. click Next
• In the Next page You will be asked to give a password for admin web login. Type a password and confirm it. click Next (Please remember the given password)
• Set is done. Click on Reload. You will get a messege Wizard completed. Click on the link to access webConfigurator
• You will be directed to the pfSense dashboard.

You should be able to browse the web by now.

Configuring The Firewall

Click the menu button on the top right corner. You will see nine tabs. Which means there are many features in the pfSense firewall. We will only see some basic and important features.

Enable SSH

Enabling SSH is important if you need to do some configurations remotely. To enable ssh

• Go to menu and click System
• In the drop down list select advanced and you will directed to a configuration page
• Under Admin Access tab find the topic Secure Shell
• Tick the Enable Secure Shell check box
• Click Save

Firewall Rules

• Go to menu and click Firewall
• In the drop down list select Rules and you will directed to the firewall rules configuration page
• You will see three tabs
  • WAN : Traffic coming to WAN port
  • LAN : Traffic coming to LAN port
  • Floating : Advanced Firewall Rules which can apply in any direction and to any or multiple interfaces
• In the WAN tab you will see two rules already configured
  • Blocking your private network leaking outside
  • Blocking IANA reserved IPv6 addresses leaking outside
• In the WAN tab you will see three rules already configured
  • Enabling HTTPS, HTTP and SSH (If you enable SSH) to the firewall IP
  • Enable All the LAN IPv4 addresses to connect outside
  • Enable All the LAN IPv4 addresses to connect outside

Now let's create a new rule.

• In your VM desktop go to left corner and click the icon. From the menu select Terminal Emulator and open a Terminal
• Try to ping a known host (Your gateway, LEARN DNS or even Google) it should work
• Now go to your firewall web interface Under the LAN tab click Add and You will be prompted to the Edit Firewall page
• Set the parameter as follows
  • Action : Block
  • Interface : LAN
  • Address Family : IPv4
  • Protocol : ICMP
  • Source : Single Host or Alias
  • Give your vm's IP address in the text box
  • Destination : any
  • Description : Block ICMP from user host
• Click save and Click Apply changes in the following page
• Try ping the an IP from your VM
• We will do more on rules later

Static NAT

You can Use Static NAT if you have a special requirement Like a Web server inside your LAN. What this does is map your mentioned private IP to an additional public IP

Create virtual IP

We need to create a Additional WAN IP for the NAT.

• First go to menu and select Firewall, From the drop down list select Virtual IPs
• In the Virtual IP's Page click on Add Button
• In the next page set the following
  • Type : IP Alias
  • Interface : WAN
  • Address Type : Single address
  • Address : Give the Spare address in the IP table / 24
  • Description : WAN IP for NAT
• Click Save and Apply changes on the next page

Create NAT

Now lets map the created Public IP and Private IP

• First go to menu and select Firewall, From the drop down list select NAT
• In the 1:1 Page click on Add Button
• In the next page set the following
  • Interface : WAN
  • External subnet IP : Your spare IP address
  • Internal IP : Single host and give your VM's IP in the text box
  • Destination : any
  • Description : NAT For test
• Click Save and Apply changes on the next page

Allow Access

• First go to menu and select Firewall, From the drop down list select Rules
• In the WAN tab click on Add Button
• In the next page set the following
  • Action : Pass
  • Interface : WAN
  • Address Family : IPv4
  • Protocol : any
  • Source : any
  • Destination : Single Host or Alias
  • Give your vm's IP address in the text box
  • Description : Allowing NAT
• Click Save and Apply changes on the next page

• Now try to ping to your VM from your PC (use the Public IP address)
• Now try to ssh to your VM from your PC (use the Public IP address)

Using Alias

Aliases can be used to simplify your configurations. Imagine you have set of devices that needs the same privileges. To set firewall rules you have add rules for each device. With aliases you can bundle them under a name. To create aliases:

Create Aliases

Let's bundle some hosts

• First go to menu and select Firewall, From the drop down list select Aliases
• In the IP tab click on Add Button
• In the next page set the following
  • Name : Famoussites
  • Description : some most visited sites
  • Type : Hosts
  • IP or FQDN : google.com
  • Click Add Host You will get another box too add more hosts
  • Add yahoo.com and facebook.com and click Save, In the next page click Apply Changes

Now let's bundle some ports

• Go to menu and select Firewall, From the drop down list select Aliases
• In the Ports tab click on Add Button
• In the next page set the following
  • Name : Usable ports
  • Description : some most popular ports
  • Type : Ports
  • Port : add port 22,53,25,80,443 then click Save, In the next page click Apply Changes

Now lets use these aliases

• Go to menu and click Firewall
• In the drop down list select Rules go to WAN tab
• Edit the rule you create in the NAT section by clicking the pencil icon
• Change destination port range from any to other
• In the Custom text box type ports (Alias name)
• Click Save and Apply Changes
• Try to Ping the VM from your PC
• Try to SSH to the VM from your PC

• Go to menu and click Firewall
• In the drop down list select Rules go to LAN tab and click Add
• Set the parameter as follows
  • Action : Block
  • Interface : LAN
  • Address Family : IPv4
  • Protocol : ICMP
  • Source : Single Host or Alias
  • Give your vm's IP address in the text box
  • Destination : Single Host or Alias
  • Give alias Famoussites
  • Description : Block ICMP from user host
• Click Save and Apply changes on the next page
• Try ping to google.com, Yahoo.com, facebook.com from your VM
• Try ping www.ac.lk

Traffic Management

Package Management