How to use pfSense: Use cases and initial configurations

PfSense use cases

Some of pfSense's success is tied to its long list of capabilities. PfSense devices are in small and large business networks, as well as some home environments. Its flexibility makes it a compelling addition to any network.

PfSense's primary features include the following:

• Routing.
• Network address translation.
• Firewall.
• Load balancing.
• VPN support.
• Dynamic Host Configuration Protocol (DHCP) server.
• DNS name resolution.
• Wireless access point management.

In addition to its core capabilities for security and network practitioners, pfSense is a great learning tool for those entering the network management career path. When combined with open source Linux VMs, you can create and manage a comprehensive network environment with virtualization apps, such as Microsoft Hyper-V or Oracle VirtualBox.

Deployment requirements

PfSense can be deployed in a variety of ways. Provision it on modern bare-metal devices, legacy hardware or VMs. PfSense also offers dedicated hardware.

Bare metal

PfSense requires only modest hardware requirements. Provide the following minimum hardware specifications on a dedicated physical machine or VM:

• AMD64 64-bit CPU -- works with Intel CPUs.
• 1 GB of RAM.
• 8 GB of storage space.
• One or more network interface cards.
• Bootable USB or DVD drive for installation.

You might need to allocate additional memory or storage space to support some features. Make sure the network components do not become a bottleneck.

Dedicated appliance

The pfSense project offers a suite of Netgate appliances that are fully compatible with the distribution.

VMs

Virtualizing your pfSense installation is similar to other OSes. Download the installer, configure networking and create the VM. Finally, install the OS, and configure its features. Here are the steps:

1. Download the ISO.
2. Launch VMware vSphere/ESXi, Microsoft Hyper-V or another virtualization platform.
3. Create virtual switches to provide connectivity between the guest OS (pfSense) and the host OS.
4. Create a VM with the minimum specifications defined above.
5. Indicate you will install the OS from the ISO in the virtualization software.
6. Before starting the VM, turn off "enable Secure Boot."
7. Start the VM from the ISO, and follow the installation prompts.

Deployments on other virtualization platforms, such as VirtualBox, are typically successful.

When learning how to use pfSense, check the community's extensions and plugins if the core functionality doesn't meet your needs. You might find additional capabilities there. Browse the available packages using the built-in package manager found in the standard pfSense web interface.

Initial configurations

PfSense includes two management interfaces. The most basic is a CLI menu of common basic settings. The screen also displays the current interface IP address information. Be careful to secure this menu. It offers users the ability to reset the admin password for the webConfigurator configuration tool.

The webConfigurator tool enables users to administer pfSense. It offers extensive menus, configuration interfaces, monitoring, documentation and more. Begin by authenticating.

You have many options from here. One of the first administrative tasks is to set up pfSense's interfaces to support its routing and firewall functionality. Define IP address and security settings for each interface.

You're also likely to configure any custom inbound and outbound firewall rules for services found on either side of the router.

PfSense offers many network services, including DHCP management and DNS forwarding. It can even act as a Network Time Protocol device, and it supports basic DHCP pool options, client reservations and address relays.

Configure your pfSense device as a VPN endpoint to support remote clients or router-to-router encryption between remote offices.

Monitoring is a critical aspect of security and device management. PfSense's built-in monitoring and diagnostic tools identify bottlenecks, failing services, misconfigurations and more.

PfSense also offers pfTop -- its version of Linux's top utility, which highlights processor and memory workloads on a per-process basis. It's a staple of Linux administrators everywhere, so it's nice to see it included in this distribution.

PfSense has far too many features to cover them all here, but suffice it to say that nearly any network security capability you might need is available. PfSense's extensive plugin library adds even more functionality.

Documentation

PfSense's active community has generated a comprehensive documentation library that lets you quickly find the steps necessary to support almost any deployment. The official documentation is well organized and searchable. It also offers Netgate support plans for organizations that need responsive vendor support and answers to complex issues or configurations. Support, via subscription, is available 24/7 worldwide.

PfSense best practices

PfSense's best practices mirror those for any deployment. When learning how to use pfSense, keep the software patched, disable services you don't need, use monitoring to watch for security events and enforce strong authentication for administrators.

The following are a few specifics to keep in mind:

• Disable SSH connectivity for external connections.
• Implement key-based authentication for SSH administrative connections.
• Enable two-factor authentication.
• Keep pfSense current and patched.
• Carefully manage DHCP configurations.
• Consider using reserved IP addresses for some devices.
• Configure logging and monitoring.
• Configure VPN connectivity to manage remote users.

Carefully secure your pfSense devices, whether physical or virtual, to maintain their integrity.

PfSense is a compelling choice for routing, firewall and other network management functions. It can be installed on bare-metal and virtualized platforms, and its active community- and enterprise-level support options make it attractive to organizations of any size.

Begin working with pfSense today to learn how this feature-rich open source distribution can improve your organization's network security.

Damon Garn owns Cogspinner Coaction and provides freelance IT writing and editing services. He has written multiple CompTIA study guides, including the Linux+, Cloud Essentials+ and Server+ guides, and contributes extensively to Informa TechTarget Editorial, The New Stack and CompTIA Blogs.