Pfsense is a FreeBSD-based open source firewall. It can be installed on physical hardware like the popular Netgate XG-7100 or run as a virtual machine (VM) on any modern operating system that supports VirtualBox or VMware ESXi. PFsense has an intuitive interface and offers many advanced features for power users to configure their network security policy according to their needs. This guide will take you through what PFsense does and how it works.
What Is Pfsense?
PFsense is a FreeBSD-based open source firewall. A simple way to think of it as a computer running your custom operating system that has been optimized for use as a router and firewall, which you can manage from the web interface instead of having to log in via SSH or physically access it with KVM over IP like most other routers on the market. It also offers some advanced features such as OpenVPN server support, Snort IDS/IPS engine, Squid proxy caching server, among others, depending on what packages are installed by default during the installation process.
The Pfsense Architecture: How Does it Work?
There are two types of network traffic going into and out of your pfsense machine – WAN packets coming from the Internet and LAN from your internal network to the Internet.
Incoming WAN Packets
Once a packet is received by pfsense, it is checked against the rules in the firewall policy rule sets before being allowed through or dropped. If no restrictions apply, they are routed to another machine on your local network called a gateway host, which then sends them back out into your local area network (LAN). The most common usage of this feature will be if you have an internet-connected printer that needs to be shared with other computers via USB cable.
Outgoing LAN Packets
These packets originate from machines within our local area network and contain information about services hosted on these devices, such as web servers. They travel through various subsystems of pfsense before eventually being sent out onto the Internet through a WAN interface. Here they are checked against any firewall rules and blocked by default unless allowed in your policy.
Incoming LAN Packets
These packets originate from our local area network, usually containing information about services hosted on these devices, such as web servers or file shares. The packets travel to various subsystems of pfsense where their destination is determined and then routed accordingly back into one of the local area networks depending on what service was requested.
What Is Pfsense Used For?
PFsense can be used for many different things depending on the features you install. Some of these include:
- Firewall: An open-source, stateful packet filtering firewall based on IPFW.
- OpenVPN server support: Setting up a VPN to access your home network securely is easy with pfsense’s built-in support via this package.
- Snort IDS/IPS engine: With Snorts simple configuration file (snort. conf), it only takes moments before you’re getting alerts about system intrusion attempts and other types of attacks directly into your email box!
- Squid proxy caching server: This allows devices connected to your local area networks (LAN), such as workstations or laptops, to use Windows Internet Connection Sharing (ICS) feature, which routes all web traffic through the pfsense machine. This allows you to browse faster by caching common websites for quick retrieval. You can also use it to filter web content on a per-user basis by assigning different users or groups of users their proxy server instance.
- VPN Client access via OpenVPN: This allows you to securely connect back to your home/work networks from anywhere in the world.
- IPSec VPN client for remote access: Another type of virtual private network (VPN) supported by pfsense with various configuration options, including support for certificate authentication and changing IP addresses at regular intervals, which is helpful if you’re using a laptop on different WAN connections often.
- Network Monitoring Tools: There are many tools built into pfsense that can help monitor traffic going through and as its CPU, usages such as RRD graphs and SNMP monitoring. It also supports logging all kinds of information about incoming packets, such as their source, etc., so they may be analyzed and monitored later.
- Packet Capture: Packet capture is supported via the pfSense package called Wireshark, which can be used to collect data from interfaces on your machine such as those that are connected to an ethernet network cable as well as any wireless adapters, etc. This makes it helpful in diagnosing problems with specific devices or applications which may not work correctly over the internet but only locally within your home/work networks.
Tips For Managing Pfsense
- Your pfsense machine should have a static LAN IP address accessible from within your home/work network. This will then allow you to access its web interface and change configuration settings which can be time-consuming if done via the console port on the back of it.
- By default, incoming packets are blocked by pfsense, so don’t forget to enable some type of traffic rules that allow certain services such as SSH, SNMP, or use UPnP support to open up ports when required automatically. Without having to do this manually! Otherwise, any attempts at connecting could fail with a “Connection Timed Out” error message.
- Some other valuable packages built into pfsense include:
- Syslogd: A remote logging daemon that can be configured to send log data from the pfsense machine to a remote server such as one running Splunk or Graylog.
- NTP: Network Time Protocol for accurate time synchronization across different machines.
- UFW: Uncomplicated Firewall is a front-end for managing iptables rules. It simplifies opening up access via port forwarding, etc., by allowing you to create groups of ports that are related in some way, rather than entering all individual TCP/UDP ports manually when configuring it.
In addition, if your device supports ” Traffic shaping,” UFw allows you to set its speed limit under the advanced options tab with an easy interface. This means that if you’re downloading a large file and your ISP’s connection speed is limited, it will allow the transfer to complete as quickly as possible without any interruptions.
- Cron: This allows jobs or tasks to be scheduled at particular times, such as creating local log files of certain types so they can then be monitored later. It also supports more advanced features like allowing scripts/commands to run with root permissions but only when logged in via SSH, which makes it safer than using su or sudo.
Conclusion
It may not have all the bells and whistles that some commercial firewalls do. However, pfsense provides many useful tools built into its web interface, along with support for numerous plugins (packages) written by third parties that can be used to extend its functionality in various ways. This makes it one of the best firewall software packages out there for any type of user, beginner or advanced alike.
