Upgrading a Home Network to a Small Business System Using pfSense
[ Send this article ]
[ Save this article ]
by Matt Williamson | September 2009 | Open SourceIn this article by Matt Williamson, we will learn how to upgrade a home network to a small business system using pfSense in a step by step manner. We will begin right from the basic concepts of networking to the actual implementation of the upgrade.
I believe the most significant leap in understanding networking comes from learning how to turn a simple home network into a full-featured small business environment. Surprisingly, I’ve never come across a plain-language tutorial on how to do just that. However, I’ve learned a great deal throughout my career so far and today, I intend to write the article I wish I had found several years ago.
- Cable/DSL/FIOS Modem—Any internet connection device that has Ethernet out will do.
- Wireless Router or Switch—Either will do. Be sure to read the next section for clarification.
- Firewall Computer —The key to a business type environment is a dedicated hardware firewall. We’ll be using pfSense, and if you check the hardware requirements you’ll see that an older machine will do nicely. Any machine to be configured as a firewall requires a minimum of two Ethernet ports.
- Client Computer—A laptop or desktop computer to be used as a client. Windows or Linux will both work, but I’ll only be referencing Windows commands in this tutorial.
- Disable All Security Software on All Client Machines—Make sure you disable Windows Firewall and any other security software you may have. This introduces an added level of software security that will only hang you up while you’re trying to establish that your hardware firewall is working correctly.
Network Device ClarificationIt’s very important to understand the similarities and differences between the core types of networking equipment. The following should shed some light on the subject, in order of simplest to most complex:
- Network Interface Card—Every type of wired networking device has at least 1 NIC, with 1 Ethernet port. A NIC can have multiple Ethernet ports. Each Ethernet port has a unique MAC address.
- Cross-Over Cable—A crossover cable is sometimes needed to connect two network devices together without a switch. This may be the case if you’re using older hardware, and you want to connect a single client computer to your firewall computer. Most of the newer hardware “autosenses” regular and crossover cables so both will work automatically, but if you’re not receiving a signal or seeing any flashing lights then try using a crossover cable.
- Switch—A switch adds more ports to your network and eliminates the need for a crossover cable. A typical 8-port switch will have 1 Ethernet cable running to the firewall, and the other 7 cables running to clients or other network devices. It’s important to remember that it doesn’t matter which cable goes in to which port, they are all the same.
- Router—A router provides an interface between two (or more) networks and will also usually act as a DHCP server. That's why on a router you have a special WAN port for that huge network we call the internet, and then a port for your internal Local Area Network (LAN). As a DHCP server, it’s responsible for automatically assigning an IP address to any device connected to the LAN and then it routes all traffic between both networks.
- Wireless Access Point—A wireless access point (WAP) is simply a wireless switch. When you connect to one, it’s the same as if you would have plugged your computer into a switch.
- "Wireless Router"—I have put this item in quotes because it’s important to understand that this type of device that most of us own is usually a combination of all the devices above. It has built-in NICs with Ethernet ports. It auto-senses crossover connections so they are never an issue. It routes traffic from that special WAN (usually labeled “Internet”) port to other ports for you to use as a LAN. Those 4 other ports are all for the same single subnet (your LAN) so that means it’s actually a 4-port switch. Additionally, those antennas provide WAP functionality.
- WAN—Wide Area Network. Also known as the internet.
- LAN—Local Area Network. Your internal network, also known as your domain or your intranet.
- DMZ—De-Militarized Zone. A fancy name for just another type of internal network just like your LAN. The difference is, using firewall rules you prevent any traffic that comes into your DMZ subnet from going to your LAN subnet, for security purposes. This is where you would host a web server or FTP server, a place where anyone on the internet can access certain things without having access to your private LAN devices.
- DHCP—A type of service that automatically hands out IP addresses. Many types of network devices are configurable as DHCP servers.
- WAP—Wireless Access Point. Essentially, a wireless switch.
- NIC—Network Interface Card.
* WAN’s, LAN’s and DMZ’s are all the same type of Ethernet network. They all use the same hardware and work in the same way. They are just given special names to differentiate how these networks are used.
Part 1 – Understanding your Existing Home Network
- The wireless router can connect clients wirelessly using its built-in WAP.
- The wireless router can connect wired clients using its built-in 4-port switch.
- While not noticeable in the diagram, those wired clients could be connected via crossover cable (as long as the client’s NIC’s also support "autosensing").
- And again, while not noticeable, the wireless router is likely configured as a DHCP server and will automatically hand out (and keep track of) IP addresses for each client that connects to it.
- The wireless router is the central piece of the network.
- The wireless router provides a ton of functionality for a single network device. It’s a router, autosensing switch, WAP, DHCP server and most even have very limited firewall functionality (allow/block IP’s, website filtering, port-forwarding, etc).
- The wireless router is limited to two interfaces, the WAN and the LAN.
Part 2 – Creating a Small Business NetworkNow that we thoroughly understand what we’ve already got, let’s take a look at what we want to create:
Books from Packt
Choosing Dedicated Firewall/Router SoftwareWe’ll be using pfSense during this tutorial, but there are a variety of options to choose from:
Building a Dedicated Firewall BoxRegardless of which software you choose, be sure to check the minimum requirements and throughput considerations before ordering any new hardware. Chances are you’ll be in good shape using old hardware, as you’ll see by the pfSense documentation below:
Remember, you need at least 2 NICs (WAN and LAN) and then more for any additional interfaces you plan on building.
Installing pfSenseYou must first decide on what type of pfSense installation you’ll use— Embedded or LiveCD/Harddrive. The embedded version is meant to be installed on a compact flash card and the entire image is configured specially to reduce the amount of writes to the disk (since flash media expires faster the more times it’s written to). The LiveCD/Harddive version is meant for a regular old computer. You'll boot to the CD where pfSense will run live with an option to install to the hard drive on the main menu.
Many "appliance" type machines (see Soekris or Recommend Vendors) will use the embedded version and most desktop machines will use the LiveCD/Hardware. However, with the right adapters, an appliance can use a hard drive and a desktop can use a flash disk.
Once you've decided on which type of installation you'll use, refer to the detailed installation instructions here:
Assigning Network InterfacesFrom the main menu, choose the option to assign your network interfaces. Each NIC will be assigned an interface alias, something like "fxp1", which you’ll then assign to your logical interfaces (WAN, LAN, etc). You may have to scroll up through the pfSense output to find the list of your aliases. Once you’ve found them, assign your WAN, LAN and any optional interfaces.
Connecting ComponentsConnect your cable modem to the Ethernet port you think is associated with the alias you just created and assigned. Hit enter to refresh the screen and you should see some indication (a spinning star) of which interface is trying to obtain an IP. Make sure you connect your modem to the WAN interface.
Next, connect your LAN devices. If you have more than 1 client, then connect using a switch; otherwise connect directly (remember, that might require a crossover cable).
Connect any devices you have for any additional interfaces you may have created.
Connecting to the pfSense Web InterfaceOnce you’ve installed pfSense, you must connect to the web interface through your LAN gateway from a client computer. The main menu will tell you your LAN’s gateway IP (most likely 192.168.1.1). So using this, you can connect to the LAN interface Ethernet port directly from a client computer (you might need a crossover cable). You can also do the same using a switch and then browse to the gateway IP address. You should be prompted for a username and password which defaults to:
- Username: admin
- Password: pfsense
Configuring the WAN Interface
- From the Interfaces drop down menu choose WAN.
- Most ISP’s (Comcast, Optimum Online) have their customers obtain their IP via DHCP request. If that’s the case, then leave type as DHCP and you should be done. Otherwise, you may have to choose another connection type and possibly input some credentials.
- Once you’ve configured your WAN, make sure you Save/Apply all settings and then check the Status -> Interfaces-> menu to make sure you’re obtaining a public IP address. I’ve noticed this can sometimes take a few minutes, and sometimes it’s necessary to completely reboot your system.
Properly Rebooting Your NetworkWhen obtaining IP addresses for the first time, and during other substantial network reconfigurations, you may find it necessary to reset your network. The proper way to do that is as follows:
- Turn off and disconnect every device from its power source. Wait 1 minute.
- Reconnect your modem; wait for the lights to display a proper connection. Wait 1 minute.
- Turn on your firewall. Wait for it to boot completely.
- Turn on any other network devices (WAP’s, switches, etc) and wait for them to boot completely.
- Turn on client machines.
Configuring the LAN InterfaceBy default, your LAN interface will be configured as 192.168.1.1/24. This means that your gateway (web interface) is 192.168.1.1 and your usable IP range is 192.168.1.1-192.168.1.254. This is known as a C Network Class.
If you’d like a larger range of IP’s, try a B Network Class of 172.16.0.1/16. This will give you a usable IP range of 172.16.0.1-172.16.255.254. This means your web interface IP will be 220.127.116.11!
The largest type of private network is a C Network Class. 10.0.0.1/8 gives you a usable IP range of 10.0.01-10.255.255.254. This means that your web interface IP will be 10.0.0.1!
Configuring Optional InterfacesAny additional interfaces can be configured similarly to the LAN. You choose a gateway interface (which becomes the pfSense web access IP) and then you apply a subnet mask to specify the range of allowed IPs. If you’ve been using the defaults and you are setting up an optional DMZ interface, then you’ll likely specify it to be 192.168.2.1/24. This will give you a range of 192.168.2.1-192.168.2.254.
More on Subnet MasksA handy subnet calculator is available here—subnet-calculator, but for the most part you should just remember that:
- 24 means 255.255.255.xxx
- 16 means 255.255.xxx.xxx
- 8 means 255.xxx.xxx.xxx
Part 3: An Alias, NAT, Firewall Rule WalkthroughNow that your firewall is running and you’ve gotten the major interface configuration out of the way, it’s time to create the custom rules that will define your network. I find the best way to learn is by example, so the following is a complete walkthrough on how to forward Remote Desktop traffic to your client computer so that you can access that machine from anywhere.
Create an AliasAlthough optional, it’s best to create an alias for each IP address, port, or range of ports you’ll be using in any of your firewall rules. In this case, I’ll only create an alias for our client computer’s IP address since the pfSense includes a built-in alias for the Microsoft Remote Desktop (RDP) port (as well as other common ports):
- Firewall -> Aliases -> Add new alias.
- Name: Computer01
Create a Static IP MappingUsing pfSense’s built-in DHCP server, we will assign static mappings to all of our machines. This allows our clients to remain configured as DHCP, but will guarantee they receive the same IP address each time they connect which is absolutely necessary if any of our rules are to perform correctly.
- Status -> DHCP Leases.
- Locate the Computer01 lease and click the + button to create a static mapping.
- IP Address: 192.168.1.101 (SAME AS ALIAS!) Hostname: Computer01 (for simplicity all of my computer names match my alias names, but there’s no reason they can’t differ if you want them to).
- Save and apply changes.
- Disconnect and reconnect Computer01’s network connection. From now on it will always receive the same 192.168.1.101 IP address, so now we can create rules for it.
Create a NAT (Port Forward) RuleNAT rules go hand-in-hand with firewall rules. NAT rules provide the redirection (this traffic goes where) while firewall rules provide access (allow/deny this traffic here). So what we want to do is tell our system that all RDP traffic should be forwarded to our Computer01 machine.
- Firewall -> NAT -> Port Forward Tab -> Add new mapping (+ button)
- External Port Range – MS RDP
NAT IP – Computer01
Local Port – MS RDP
Leave Auto-Add firewall rule checked!
Analyze the Firewall Rule Created AutomaticallyLet’s take a look at the firewall rule pfSense created for us automatically. Firewall -> Rules -> WAN tab. You’ll notice there are two, the first is a default and should never be changed while the second is the one we created for our NAT mapping. Reading the rule aloud should sound like:
ALLOW traffic from ANY IP on ANY PORT access to COMPUTER01 on port MSRDP.The one point of confusion may be why are we allowing traffic FROM ANY PORT? You have to remember that you’ll never know what port another computer is connecting FROM. For example, when you browse to Google you’re requesting their port 80 traffic from, let’s say, your local computer’s port 65235. Then your next request to Yahoo might be on port 51123. The point is, it’s up to your computer and you just never know what it’ll be.