Transcription
Hey everybody, welcome back to Jim's Garage. This is part two of the pfSense miniseries, where we're actually going to start the configuration. Now, regardless of whether you're doing a physical setup or a virtual setup, this guide will work for you. I'm going to be doing this virtually, and there's a reason for that, or at least a reason that you adopt the method that I'm using. So, what I recommend, albeit you don't have to follow it, is that you do this behind your existing firewall or ISP modem router, whatever you want to call it.
The reason I say that is because you don't want to risk bringing down your existing internet whilst you're doing this. The way I'm going to be deploying this is I'll have this pfSense behind my existing firewall such that if anything goes wrong, I can simply start over, connect back to my original Wi-Fi, connect back to my original network, and have internet access. That's also great for the family factor and get them off your back. Throughout this video, I'll be using two virtual machines, and that will be mainly for testing things like doing VLANs and showing things like firewall rules between them. So, just like my OPNsense video, we'll be covering lots of different topics. So, go and grab a drink, this one's going to be a long one. Let's get started.
Okay, so just to bring to life what I mentioned earlier, this is how I've got it set up for this video. You don't have to do this, I just recommend that you do so that you don't break the rest of your network. Once you're comfortable, you can obviously swap this over to just be your only firewall, or you can just take the configuration file from this setup, which we'll cover in this video, and then you could redeploy it onto physical, virtual, wherever you want, at a time that suits you.
So, this is literally the computer that I'm recording this video on. It's connected to a virtual pfSense video that we deployed in the last one in the series. This then goes into my OPNsense firewall, which I've covered previously, albeit this could just go into your ISP router, doesn't really matter. And then that connects out to the internet. So, the only thing we need to bear in mind here really is that we are double-NATed. So, anything from the internet comes to here, and then comes to here. So, we'd need firewall rules between these two for port forwarding. But let's not get this too complicated, I want to keep this simple and accessible. And once we get to port forwards, I'll show you how to set those up.
If you don't feel comfortable doing it in a double-NAT, you can obviously get rid of your existing firewall, put the one we're going to set up today in place, and you would just have something, oh, that doesn't work very well. You would just have this arrow here going over to here, and you wouldn't have another firewall. So, that port forward should just work.
Also, as I mentioned, for testing purposes in this video, and you may wish to replicate this, I've spun up two virtual machines here. These are just using this cloud image, which I've covered in previous videos. This is going to be on a VLAN 20, and this one's going to be on VLAN 40. You can see that in the hardware tab, just with the tag in, tag 20, and tag 40. This will enable me to test, or at least demonstrate, some of the things I'll show in this video. So, this machine is going to be on a separate VLAN to this. I'll show you how to create the VLANs, how to get static IPs on those VLANs, do DHCP, all of that stuff. And then we'll look to enable connections through firewall rules, and then subsequently break them with the inverse firewall rule. So, hopefully that'll give you an idea of how to do these rules and what the point of firewall rules are.
So, this is the version that we installed in the last video, and as you can see on here, this one has been up for 20 days now, so nice and stable, everything seems to be working. I've had a couple of VMs plugged into this just to make sure, then I've been dialing in to monitor the behavior. But first thing we're going to do is we're obviously going to hit on this here to do an update, just to make sure we're using the latest version. Now, things are obviously going to change in pfSense over time, so I will look to update this video in the future, but hopefully the fundamentals aren't going to be too different.
Now, one thing to note is I am using here the Community Edition, and I have been researching in the background whether I want to go with their plus tiering. Now, I probably will because I'm really interested to see what features there are, and I'm really interested to see what the WireGuard speeds are, and I think behind the scenes it uses some different libraries and different kernel modules, etc., for the paid version. So, hopefully I can get some better performance. But you definitely don't need that. When I do go down that route, I will do some videos around that because I'm keen to see what it's all about. Anyway, the first thing we need to do is obviously save the retinas. My mints pies are hurting just looking at this thing. So, let's techno-tim it, let's do some dark mode.
So, for that, we're going to hit System, and then we're going to go to General Setup, and we want to choose a theme. So, we should just have to scroll down, and we'll see this here theme. So, let's go for dark. Let's see what that's all about. We might need to give that a refresh. Let's just hit Continue. Ah, that's much better. Now, there is a beta version, so I'm not going to show that in this video, but have a play with it, see which one you prefer. And I believe there are some more plugins as well, which we'll touch on later, where you can add additional themes.
Do note as well, and I touched on this in the last video, that if you want to change your DNS, your default DNS server settings, you can do that here in the DNS server settings. Choose either external, like I've done here for testing, or you can choose internal ones if you've got something set up like Pi-hole, AdGuard, etc. You can obviously as well do this at the network level, so for each network, you can specify the DNS servers just for that network. Think of this almost as kind of a fallback, and this is the one that pfSense will be using when it's doing things like updates, or it's checking for DNS updates on URLs that you've got specified, i.e., if you're using a firewall rule, you're not using an IP, you're using a DNS entry, that's what it will use to refresh the IP associated with that address.
Anyway, on the topic of IPs, let's get on to our first topic, which is static IPs. This is going to be really useful because having a static IP makes a lot of sense. It gives you a failsafe method of accessing one of your devices, although you can obviously go down the route of having DNS entries that give you a friendly name, like a hostname or a DNS name for that IP address, but you're obviously going to want a static IP address for that to work anyway. So, let's get on to it.
So, to do that, we're going to hit Services, and then we're going to hit DHCP Server, and then you'll see down here that we've got some options for static entries. You'll see that at the bottom here. So, what you could do is add a static mapping. You would put in the MAC address for a device and then put in an IP address for that. Now, I'm going to demonstrate that in a moment using a VLAN because I want to use those two virtual machines that I mentioned, that VLAN 20 and that VLAN 40, just to get this up and running, and it means that I know exactly what IP addresses those machines are going to pick up before they're even booted. So, I will come back to this in a minute because the first thing I want to do is to set up a VLAN.
To do that, we're going to go to the Interfaces, and then we want the Assignments. Now, what we need to do on here is to create a new interface. So, we're going to head over to this VLANs tab here, and then we're going to click Add. Now, you need to select a parent interface here. So, if you're using more than one interface, if you've got multiple LANs, multiple physical NICs, etc., you'll need to choose the one you want. You can also LAG and bond these together, so have two physical NICs joined together for increased traffic flow. No, it doesn't double the bandwidth, it just allows two machines at the same time to have full bandwidth of a single link. I'm not going to go too far down that, I can cover that if you want to.
So, for my instance, I'm just using LAN and WAN to keep this simple, and you'll see I've got WireGuard set up here, we'll come to that later. So, I'm going to click LAN, and then I'm going to give it a VLAN tag. Now, I'm going to call the first one 20. I'm going to leave the VLAN priority as zero for now, but you can change that. And what that basically does is it says what it says on the tin, it gives it a priority. So, it's a bit like traffic shaping, or exactly like traffic shaping, where it will give a certain VLAN higher priority on the network. It's the way that you hear all these ISPs going, "This is a gaming router" or whatever, it just prioritizes traffic that's gaming-based, i.e., they look at the traffic, see what it is versus a different type of traffic. So, in this case, you could say VLAN 1 is where I want the lowest latency, VLAN 7 is stuff that doesn't really matter, might be IoT for example. One would supersede seven.
Now, for this description, I'm just going to keep this one simple, I'm just going to call it VLAN 20. So, going to hit Save, and then I'm going to repeat that process for VLAN 40. So, now both of those VLANs are created, and if we go back to the interface assignments, now you'll see here that we've got these available networks. Those are the VLANs we just created, but they haven't been assigned an interface. So, we need to click Add. So, for VLAN 20, that's been added as OPT2, and I now need to click Add on this one here. So, now we've got VLAN 40 added on there, that's OPT3. We'll need that for later. So, let's hit Save. Now that's saved.
So, now we can actually go back and start doing some things. So, let's go back now to Services, and let's go back to that DHCP Server. Now, we can choose now from here what we want to do. So, we can add a static map. Now, one thing you might have noticed earlier in the video is if you read at the top, it says "ISC DHCP has reached end of life and will be removed." So, let's do the proper way of doing this, or at least the way that's going to be supported in the future. For that, we need to go System, Advanced, Networking, or hit this handy hyperlink.
So, to get this working, we want to obviously switch over to the Kea DHCP. So, make sure that that is the one that's selected. I don't know exactly when it will be going end of life, but kind of irrelevant, let's move over so we don't get caught out. So, just in case you haven't got this selected, we want Kea DHCP. Let's scroll down, let's hit Save. You'll know that this has taken effect because if we now go back to Services, and then go to the DHCP Server, you'll see that the back end is now Kea DHCP. Excellent. So, we can follow exactly the way you used to do it.
So, down here, we want to choose obviously which interface we want. Then we're going to go through the process of creating the static IP based upon the MAC address. Now, unfortunately, we can't just add a DHCP here to our VLANs. That's because you'll notice here, just LAN on our interfaces. This is OPT2 and OPT3 for me. You've probably got OPT1 and OPT2. If you click on that, we need to enable the interfaces. So, I'm going to do this for both of the interfaces I created. So, I'm going to click Enable Interface. I'm going to go for a static IPv4, and then I'm going to go down to here. So, this one I'm calling VLAN 20. So, the way I do this is 192.168.20.1, just the way my simple mind works. And I'll do exactly the same for the second one, but with a 40.
Now, the important thing here is we change this to a /24, or to be honest, anything that isn't a /32. /32 is a single IP address inside a notation. So, change this to whatever size of network you want. /24 is probably going to be fine for most setups. If you want more, you probably going to go on 172 or 10. Anyway, setting this to anything but the 32 will enable you to set up a DHCP pool. It certainly works for the size of 24, which will give me 254 usable IP addresses. So, I want to go down and hit Save, and then hit Apply. And I'm then going to go into the second one. So, the other option here, OPT3, going to enable that interface, make sure that that's static. I've changed this one to a 40, and again, I'm going to change this to a /24.
Now, when I hit Save and Apply again, I should now be able to go onto the Services tab, and we should have DHCP options. So, Bingo. Now we've got that OPT2 and OPT3. So, I can click on OPT2, and I can now start to begin configuring my DHCP. So, as always, we need to enable this first. So, I'm going to click Enable, and then I'm going to create a DHCP range. So, this is where you need to think about what you want your range to be. It's entirely up to you, basically. Whenever a machine boots up and it's on this VLAN, and it doesn't have a static IP assigned, it will say, "Hey pfSense, I need an IP address," and it will pick something from this range in a sequential order.
So, I'm going to go for 192.168.20.100, and I'll make sure it goes to 192.168.20.110. So, I basically got from 100 to 110 for my IP pool. You could obviously make this much larger if you wanted to. I'm doing this purely for demonstration purposes. You can obviously add additional pools as well if you wanted to. And you can also here specify some of the gateways. That's pre-populated to 20.1, which, as you'll remember, is the gateway address. So, basically, what that's saying is everything on this network, you want to send your traffic to 20.1, which is where that VLAN interface is listening. This on your home network is probably 0.1 or 1.1 on your ISP router.
So, to get this up and running first, I'm going to hit Save, and then Apply. So, now this is listening for new machines, or anything that boots up, and this interface should be working. So, to actually get a static route, we want to click Add Static Mapping. Now, here we want to go and grab the MAC address. So, if I hop onto my OPNsense, if I click on the Hardware tab, you'll see that I've got this network here with the MAC address. So, I can copy this, and then I can head over to pfSense and I can paste this into here. You can also do "Copy my MAC," and that will copy the machine I'm currently recording this video on, but it's up to you, just put in your MAC address for the machine you want to register.
Now, we need to think of an IP address that I'm going to give this machine. Now, as you saw in the previous section, for the DHCP lease, we know that 100 to 110 is already used. So, we can't put a static map inside of the dynamic map because we could have IP conflicts. So, I'm going to go for 192.168.20, and I'll do 20, just to keep it simple. Now, we can give this things like hostnames and things if you've got a domain set up, and we can give it a description. So, I'm just going to call this one VLAN20 VM. Then we can give it some server options for WINS addresses, or we can give it some DNS addresses. Now, by default, it's going to use the DNS server of the gateway. Now, the gateway IP is basically the interface address of this virtual interface. So, basically, it's going to use the firewall, and then it's going to use whatever we saw originally in that General Settings tab. So, I think mine was 1.1.1 for Cloudflare and 8.8.8.8 for Google. So, you could either leave this as is, and it will use those servers, or you could put in here, well, you could actually delete this one here, and you could put in, you can see here, 2001:1, which is my Pi-hole. I could use that one. So, that might be useful because it means that then I can go and do all of my DNS names, so all my internal services. And remember, I'm currently double-NATed, so that might actually be pretty useful. You can put in up to four here, you can see DNS 4, but as it says here, leave blank because most will only allow you to have three DNS entries at most. So, I'm going to put that there. I'm also going to put 1.1.1, just in case anything goes wrong, but it should be superfluous because the general settings will pick that up anyway.
Scrolling down, I'm going to leave everything else as the default, and I'm going to hit Save, then I'm going to click Apply. And so, now if we scroll down on here, we should see that this MAC address, that's my virtual machine here, this one here, when I boot this machine up, it should pick up 20.20, and it's just got a description here, that's helpful.
Now, I'm going to do the same thing on OPT3. Make sure that this is enabled up here, and then I'm going to add a pool range. So, here we want 40.100 and here 40.110. Obviously, just keeping this simple, you can put whatever you want in here. Then I'm going to go down to the DNS servers, and I'm going to put 21, and I'll put 1.1. And then I should be able to hit Save. So, that should now be saved, and then we're going to go down and we're going to add another static map. So, back over into here, close this one down. I'll go to 40, I'll click on the network, I'll edit that, I'll copy this MAC address back to pfSense, paste this MAC address in, and then we'll give it an IP address. So, instead of 20.20, why don't I do 40.20? So, now that's all ready. Again, we can give it a different DNS server, it's already picked up the ones I specified, which is great. And then I'm going to click Save.
Scrolling down, we now see this one here, and we see the IP address associated with it. And I forgot to give it a description, but that doesn't matter. Now, provided you've got all of your VLANs set up on your switch, you should be ready to go. Now, I can't give you a demonstration of how to do VLANs on all of your switches, but I'll show you now me setting this up on my UniFi equipment. This is going to be a little bit more complicated just because I'm using a single switch for two different networks at the moment, and I'll be using some funky VLAN settings to get this working. I've purposefully chosen 20 and 40 because those are VLANs I'm not currently using. Now, I recommend for most people, you probably skip over this section just because you're not going to have a complicated setup like me. For this bit, but if you are, and you are using UniFi, and you're trying to do all this with one switch, this might be useful.
So, now in my UniFi setup, um, a reminder, if I go over to my Proxmox, you will see that I've got my OPNsense machine down here, this one here, and you'll see that I've also got the two VMs here. Now, these, these two VMs are on this network device here, VM1, and VM1 plugs into my aggregation switch. So, if we go over to here, and we click on the devices, and we click on the aggregation switch, and we go to the port manager, this is actually plugged into one of these. I forget exactly which one it is, I will have a look now and find out. Thankfully, I can use these MAC addresses. So, just jumping into the terminal on here, you'll see that I've got, uh, this one here, two, and you'll see it's this one here, starts with 58, ends with A6. And if we go in here, you'll say, starts with 58, ends with A6. So, we know that this machine is on this port here, number three. So, my virtual machines are connected through this node, this Abidon node, and they get plugged into here. So, we know that this port here needs to understand VLANs 20 and 40. So, good that we know that. But before we can do anything, we actually need to create these VLANs.
So, if we go to Networks, we want to create a new virtual network. I'm just going to call this one VLAN 20. I'm going to call it 20, and I'm going to click Add. And then I'm also going to add VLAN 40 and give it a VLAN ID, and click Add. So, now both of those are added. So, now I've created those two VLANs, we can actually go back to the device, we can click on the aggregation switch, go back to the port manager, and we can click on three. Now, I've already got "Allow All" here. I don't necessarily recommend you do "Allow All," um, especially for security reasons, you would want to restrict this just to the VLANs you need. But for this testing purpose, I want the fewest roadblocks possible. So, "Allow All" that means it's going to understand what a 20 and a 40 VLAN tag is, and it will respond to that.
Now, because I've got this set up as a virtual machine behind a virtual firewall, I actually need to take, so where is it? The pfSense machine that's down here. So, this machine here also needs to understand what VLAN 20 and 40 is. So, in this case, I know that VM1, this is my LAN, no, this is my WAN connection, and vmbr0, this is my LAN connection. So, what I need to do here is to make sure that vmbr0 understands 20 and 40. I then need to take the cable that's plugged into here, and I need to plug it into one of the ports on my RJ45 switch. So, on here, I will tag, say I stick it into 19, I will tag this now as to be, uh, understanding of 20 and 40. And then I'll also tag this one here, probably make that 20 and 40. Then I can plug this machine I'm working on into 21. The firewall will also be on 20 and 21, sorry, 20 and 20, 20 and 40. Nothing else will be. And then that can connect back up to my firewall, and hopefully everything's working. Right, I told you it's a little bit complicated, especially if you're coming into this. Um, do know you can do this, but I recommend you skip over this stuff and come back to it when you need it. So, well done if you made it through that ramble. Um, I've now configured everything so that it understands VLANs, and I've got now two networks basically running on the same switch. So, hopefully now we're in a position where I can spin up these two virtual machines here. This one's going to pick up that IP address of 20.20, and this one here should pick up 40.40. Let's see what happens.
So, a quick edit, and nothing more than moving the VLAN 20 machine down to this one here, other than just to split these up on different hosts. So, now with all the VLANs configured, let's see what goes on. So, I'm going to click the start for this VM, and then I'll hit up the console button. This should hopefully boot. This looks promising. We'll know if it's working if it doesn't get stuck on the "waiting for network." Great, that one went through. So, let me log in quickly, and what do we get? Yes, 40.20. Excellent. So, we know that's working. Now, if we do the same thing for this one, let's start it up, let's hit the console. Hope hopefully we get the 20.20. And yeah, you can see here, 20.20. Brilliant. So, now we have both of those machines on different VLANs, on different interfaces within pfSense. Brilliant. This gives us basically everything we need now to start segmenting our network. So, you can spin up as many VLANs as you want, and pop any number of machines on those VLANs, and then you can start to do things, um, with firewall rules, which we'll move on to in a moment.
So, just to test that out, let's put this one over here, and let's get the other one up as well. So, here you can see on the left, we've got VLAN 40, and here on the right, we've got VLAN 20. So, why don't we do a ping, and then we'll do 192.168.40.2. Uhoh, nothing's working. Let's try the other one. So, this one, we want 20.20. Oh dear, it's unreachable. Well, fear not, that's because in pfSense, like most firewalls, the rules are default deny. And in fact, we actually don't have any rules by default in pfSense. Let's take a look at what I mean.
So, if we go into pfSense, and we now go to Firewall, and we go to Rules, so you can see here that we've got rules for the WAN, we've got some rules here for the LAN. This one is basically saying the LAN can go anywhere. That's typically how you would set this up. And you'll see the top one here is an anti-lockout rule, so you can't lock yourself out from accessing pfSense. But now, if we go to the VLANs we set up, there's no rule, and there's no rule. So, what's actually happening when we're on this machine here, and this one here, is there isn't a rule that's allowing traffic from this VLAN to this VLAN.
So, let's fix that, and let's try and keep that up on screen so we can see it changing. So, I'm going to add a rule here, and it's going to be an action of Pass. You can have Block or Reject, and I'm going to assign that to this interface, the OPT1, that's the VLAN 20. It's going to be for IPv4, and the protocol will be TCP. But we could put UDP, TCP, UDP. I'll do TCP, UDP, because that covers pretty much most traffic, but there are specific ones if you need that. Um, IGMP, I think is Ping. So, the source can be anything. So, what that means is the source can be anywhere on this network. So, you know how I've just used 20.20? Well, it could be 20.21, 20.22, you get the idea, basically anything within the subnet range we created.
Now, the destination could be any. And if I were to just save this, this VLAN would behave exactly like the LAN one. So, anything on this VLAN would have access to anything on the pfSense itself, so any network, physical, virtual, whatever it might be. So, you can just do that if you want, maybe you want this as say, a trusted VLAN. But I'm going to change this, and I'm going to change it to OPT2. Now, I want OPT2, and I want the subnets. Now, basically, what it's saying is anything on this VLAN can go to that VLAN. We don't want to put the OPT2 address, because that's just the address of the interface. Now, if you wanted to be specific or prescriptive, you can actually then change the port range. So, you could actually then say, "Hey, you can go from this VLAN to this VLAN, this network to this network, but only using certain ports." And that can be useful if you want to dial things down. And we'll touch a little bit on that when we get into port forwarding later on, where we want to only port forward certain, certain ports. It's the same sort of principle.
So, you can decide whether you want to log this. Um, I'm not going to do that for this demonstration, just to make sure I don't chew up too much space. But if you're logging something like your DMZ, your firewall, your WAN, for instance, it's probably a good idea. Now, I won't give it a description, but you could, just to make life easier. So, you could say, "This VLAN has access to this VLAN." And I'm going to hit Save. Now, we want to hit Apply. Apply.
So, after a quick edit, you need to change the protocol. It's actually ICMP, not IGMP, for Ping. Um, either do ICMP, or do Any. I just changed both firewall rules to Any. So, if you go here, I've now got a rule that allows anything OPT2 to OPT1, and anything on OPT2 or OPT1 onto OPT2. So, if we now go back to our virtual machines, you'll see that they're now both merrily pinging away, and we've now got access across these virtual machines. Excellent. You're now starting to understand the power of VLANs and how we can tie in firewalls to restrict access, access across our network. So, other areas where this might be useful, things like if you've got a NAS or something that you want to safeguard, you could put that on its own dedicated VLAN, and then you could provide prescriptive access on which networks, or even which devices, you want to have access to that. So, it might even be a case that say, you've got this VLAN here, you don't want the source to be anything on here, you might want to tie the source to a specific IP, i.e., a specific machine on that network.
Next up, we're going to have a look at Dynamic DNS. Now, thankfully, that's already available here under the Services tab, and we can go down to Dynamic DNS. Now, I'm not going to go into this in detail because I'm going to cheat and I'm going to refer you to a previous video I did whereby I went down this route using various different options. One of those was OPNsense, the other was pfSense, there was also a Docker script and a bash script which you could run with something like a cron job. But suffice to say, it's really straightforward. You'll simply need to fill in your details, choose the interface to monitor, put the creds in. I use something like Cloudflare, which makes this super easy, and then hit Save. What it will do is monitor the IP address on your WAN, so your internet connection, and it will make sure that your domain record is accurate to the IP address. It will look for changes circa every 5 or 10 minutes and update when necessary. That means that all of your URLs, your DNS records are kept up to date, and it means you can access this when you're out and about without the worry of when a router fails, or you flip the power, or your ISP decides to change your IP, those will still work. So, go and check that video out, and you'll be up and running.
Moving on, we're going to have a look at VPNs. Now, this comes with a few options out of the box. So, you've got IPsec, Layer 2 Tunneling Protocol, and OpenVPN. Now, I've touched on these before, especially when we did OPNsense, and probably the most common one that you'll be aware of is probably OpenVPN. Now, I'm not going to show you how to set up OpenVPN because I prefer to use WireGuard.
Now, we can do that quite handily by going in and downloading WireGuard. Now, to get WireGuard installed, we're going to hit System, and then we're going to go to the Package Manager. You'll see that there's nothing installed, this is just a vanilla installation, but we want to go to the available packages. That's going to go away and look. So, what we want to do is put in WireGuard, and you'll see that it brings up these two here. Now, Tailscale, I haven't yet covered, I will be doing a video on that, but I've also shown you how to do the open-source version of that with Headscale. Similar things with mesh VPNs such as Netbird. So, it's a similar sort of thing. It is quite nice though to have Tailscale baked into your firewall, and I might look at that in the future if that's what people want to look at.
So, what we want to do here is this WireGuard 0.2.1, we want to install this. So, going to install. We want to hit Confirm. That will go away in the background and do that for you. Now, that that's installed, we're ready to move on. So, at the top now, VPN, we should have WireGuard. So, brilliant, that's embedded now into the firewall, and it's part of the UI, which makes this process a lot simpler.
So, to get this working quickly, we need to add a new tunnel. So, we're going to click Add a Tunnel here. I'm going to give this a description of Remote Access. Do make sure that the tunnel is enabled, it should be by default. The listen port here is 51820, which is the default for WireGuard, but you can obviously change that if you want to. You can also add multiple tunnels to this pfSense. So, you could have things like WireGuard for site-to-site, or in the case that I'm going to demonstrate today, you can have WireGuard for sort of remote access from a typical user.
Now, for the keys, I'm going to generate some keys here. So, click Generate. We will need this public key later on when we're setting up our client access. We can leave the interface assignment blank because we'll come back to that in a moment. And then we need to set up an interface address. So, this is basically the address that your clients will get when they join WireGuard. So, I'm just going to use 10.0.0.1 and I'm going to give this a size of 24, so I can get 254 people using this, or 24 devices, whatever they are. Next, we're going to click Save, and then we're going to Apply Changes. Great, now that's all applied.
So, now what we need to do is set up our firewall rules, and there's actually going to be two rules that we require. One on the WAN, which is basically the port forward, and then one on the WireGuard, which is what people on the WireGuard network, or what devices on the WireGuard network can do, i.e., what access do they have within your LAN or VLANs. We'll also need to do a firewall NAT for outbound rules, and we'll come on to that in a moment.
So, let's set up this port forward. So, we're going to go to WAN, and we're going to get Add. We want it to be Pass, so allow it. The interface is the WAN. This will be using IPv4, and the protocol for this will be UDP. Typically for internet traffic, you'd use TCP, UDP, and we'll use that later in a port, for example, but it's basically going to be the same as this. Now, the source I've got as Any, which means that any external IP address will be able to connect to this. I have selected on the interface earlier "No Bogons," so internal IP addresses won't be able to connect to this. I might actually need to disable that for my testing where I'll be testing from my internal network on my OPNsense, which has a 200.192 address, so that would be classified as a bogon. I might need to disable that. So, if you're testing that the same as this, go to your interface on the WAN and disable that. I'm going to leave this as Any, but you might want to geo-restrict this. Say, for example, I'm in Britain, I'm not going to be outside of Britain in the foreseeable future, so I could just restrict that. That's not really a great security mechanism for a human user that's trying to exploit this, but it does help against some automated spam.
Do bear in mind though, that WireGuard is a silent protocol, so anything hitting that 51820, it won't get a request, or it won't, it won't get a response because it will be unauthenticated, it won't have your keys. So, from a port scan perspective, no one's going to know that you've got this open. Now, the destination is going to be the WAN address, and the port is going to be 51820 and 51820. Now, for the description, you can put whatever you want in there, you could call this just your WireGuard port forward, but I'm going to hit Save, and then I'm going to hit Apply. So, now here we've got confirmation that anyone with an IPv4 address, UDP 51820 on the WAN, is going to be allowed.
So, now let's go to the WireGuard, and we want to add another rule here. Here, we want Pass, Interfaces: WireGuard, the IPv4 address, and the protocol. So, I'm actually going to put Any here. So, what that means is when somebody connects to my WireGuard network, i.e., me, the admin, I'm going to have access to my whole network. I can do anything. I can do TCP, UDP, I can use ICMP for pings, all those sorts of things. Now, the source for this one is anything on this WireGuard network, but if I wanted to, I could create a specific address for this and use that instead, so just my user. But I'm going to leave this as Any, just for setting this up. The destination will be Any. So, basically, anyone, once they're on here, can go anywhere on the network. You might wish to restrict that to certain VLANs, certain networks, i.e., you don't want VPN users accessing some certain stuff, you can restrict that in here. And obviously, if you're setting up multiple tunnels and all those sorts of things, you could have multiple rules for those different tunnels.
Now, I'm going to hit Save, and I'm going to hit Apply. Perfect. Now, we're nearly done, but we need to go to the Firewall, and we need to go to NAT. Now, the NAT that we actually want is outbound. So, this is Outbound Network Address Translation. We actually need to go to Hybrid, and that will place our manual ones above the automatic. We want to hit Save, we want to Apply that, and then then we're actually going to go and click Add. So, when we click Add, we want to make sure that the interface is WAN, and the address family, you can use IPv6 if you want to, I'm not going to use it, so I'm going to use IPv4. I'm going to allow Any protocol to go out through the WAN, and the source, instead of Any, I want to restrict this. Now, you could go to a network or an alias, and in here I could do that 10.0.0.1/24. Or, to keep it simple, maybe you want all of your WireGuard tunnels, any that you create, to go over it. So, you can also just click "WireGuard Networks." If you're only going to use one, it'll obviously include that.
Now, the destination can be anywhere. So, this network can go anywhere. Once you're on there, and the address for the translation will be the WAN address. Once you've done that, you want to go down and click Save, and hit Apply. And it should look something like that.
So, with all that configured, we're now ready to start setting up some peers. So, if you hit VPN, go back to WireGuard, you'll see that we don't have any peers here. Now, there's quite a number of ways that we can get this up and running. We can configure and define some pre-shared keys, sorry, pre-generated keys. So, we could hit into the terminal and we can generate a key pair. Now, I'm not going to do that to keep this simple, because I'm just going to be using Windows. And equally, if you're using things like your Android app or your iOS, when you load the application for WireGuard, you'll generate those keys as well.
So, if I now load up WireGuard, so I've just been to the WireGuard website and I've downloaded the client, installed that, you'll get this window here. Sorry, it's quite small. And what we're going to do is we're going to add a tunnel. So, we're going to click on the little arrow and we're going to say "Add an empty tunnel." Now, what you'll notice here is it's generated a public and private key pair. So, here's the private key, and here's the public key. Now, what we can do with that is we can head back into WireGuard Peers, click Add Peer, and we're going to assign this to this tunnel here. Remember, I mentioned that you can have multiple tunnels, so you can put different peers on different tunnels. This one I'm just going to call Windows. The public key, we'll get that from back over here, so that's this one here. We will copy that, and we will paste that into here. That's done.
And now we can get the allowed IPs. Now, the allowed IPs is basically the IP address that this peer is allowed to have. So, remember the network range was 10.0.0.1/24, and this is /32. So, this is a single IP address. So, basically, what this is saying is whenever this Windows peer connects, it will get 10.0.0.2 on the 1/24 network. So, we've got 254 maximum users, devices, whatever it might be. So, for that, I'm going to hit Save Peer, then I'm going to click Apply. So, now that peer has been created, and we're nearly ready to get this thing up and running.
So, what we actually need to do now is go back to this configuration, and we need to start adding in some values. Now, one of the first things we need to do is to actually put in the address, and that will be as simple as 10.0.0.1 and /24. So, remember that's basically the network for this tunnel. Now, after that, we want to set up, and we want to open a Peers section. So, the Peers section, we want to grab the public key. So, the way that we do that is we head back over here to this tunnel, remember this peer is on this tunnel, we want to hit the Edit button here, and we want to copy this public key here. So, that's copied. So, that's Alt+Tab, and then here we want to put Public Key, and we're going to paste in that value.
Next, we want to specify the endpoint. Now, the endpoint is basically the you're going to connect to. So, in my instance, if I go to my pfSense here, you'll see that I've got the IP address of 192.168.21.13. A reminder for those that are skipping ahead to this section for WireGuard setup, I'm running this behind OPNsense because I like to configure my new firewalls on my existing network without breaking my current network. So, this is getting an IPv4 address from OPNsense. You'll obviously want to change this to your real public IP address in the future. So, the endpoint here will be that address, and importantly, what you need to do is you need to specify a port, which is 51820. Do bear in mind that I recommend when you put this into sort of your production or live, change the endpoint from an IP address to a domain name, and set up something like Dynamic DNS. That will mean that you only need to put in your Dynamic DNS, your URL, your domain name, and it doesn't matter if your IP address changes, you'll always reach your WireGuard.
Now, the next section is the allowed IPs, and the allowed IPs is basically the concept of split tunneling. So, you may or may not be aware that for all the traffic you want to funnel through a VPN, you can select which bits you want. So, for example, you might just want to do things like 192, 172, and the 10 network ranges, i.e., internal ranges. That means if you're out and about or on your mobile device, whatever it might be, if you choose the allowed IPs to be those network ranges, it will mean that all your internet traffic goes out via your local, your local WAN connection, which isn't your home connection, it could be cellular, it could be Wi-Fi, wherever you are. And anything that's going to a local IP address will actually be sent over the VPN. That's a pretty common setup. Or, if you actually want to do something like you want to route...
All your traffic, i.e., you're worried about privacy or you're on a public network, you can put something like 0.0.0.0/sl0. And what that means is every bit of traffic will be funneled over the VPN. Now, depending on what kind of connection you've got, that might be a bit too heavy. You might want to break out locally, but you've got any option you want on here. So, specify the ranges that you want to be rooted over the VPN.
One thing that's sometimes quite useful is up here, you can actually put in the DNS as well. So for this, I'm just going to put Cloudflare, but usually, I would put in something like my local DNS resolver, like my Pi-hole or AdBlock or whatever it is. Once we've done that, we're ready to hit save. Oh, it says a name is required, so let's put in pfSense. Now I'm going to hit save, and you can see that that's there. All of that looks right.
So now, what I'm going to do is I'm going to unplug the Ethernet cable, which is currently plugged on this machine you're looking at here, me, and it's connected into this virtual pfSense box. I'm going to take it and going to connect it into my OPNsense box. And there, this IP address here won't be seen as a local. It's basically the one device of pfSense. So I'm effectively emulating this being on the internet, and I should be able to connect to it as though I was out and about. So let's try that.
I am, just as a precaution, going to go into the interfaces of the WAN. And as I mentioned, uh, this bogon, yeah, just check that's actually disabled. So that's fine. So as you can see, it actually blocks here, internal hitting the WAN. And we know that because I'm going to be on my other OPNsense on an internal IP address, um, that would have got blocked. So make sure that's off when you put this into production. Again, you probably want to turn this back on.
So here goes. I'm going to switch over, and hopefully, in a second, we'll be able to connect through my WireGuard. So I've now switched over, and if I were to hit refresh and continue, yeah, it's not allowing me onto the firewall because, actually, it's taking me to my OPNsense router, which is on the same network. So if I fire up WireGuard now, hopefully, when I click activate, fingers crossed, yep, we're getting some traffic, a few kilobytes. That looks good. Hopefully, now I can refresh this machine and, yeah, I'm back into pfSense. Excellent.
So let's get that up. Yeah, we can see now we've had half a Meg. What about if I do a speed test? It looks like I'm getting about 800 megabits per second here. So if I have a look on here, yeah, you can see that over 600 Megs was just sent, and it's going to do a receiving in a moment. And, yeah, you can see that that's rocking up now as it's doing a speed test.
One thing you might notice is when you do this, if you go back into pfSense, you might have an error message up here. Now, this actually sort of contradicts what I said earlier, and that's because here, this WireGuard network, it might not actually be defined. So to fix that, you can go back to networks or set an alias. And in here, you do something like your 10.1.0.1/24, and hit save. And then, obviously, that's the only IP range that's associated with that WireGuard tunnel. So hopefully, if we mark all of those as red, those will go away. And now we can do another speed test, and that's working. Yeah, there haven't been any more notifications. So excellent, that now gives me some confidence that the WireGuard is set up and configured correctly on the WAN port. I'm connected from a different machine, and I'm able to access pfSense itself, which shows that it is working.
If I deactivate this, that's now deactivated, and I hit refresh, you can actually see it's gone back to my OPNsense interface. So here you go, yeah, I refreshed that, it's asking me to log in. And if I now activate this again, so we're back on, I can hit back, and we're back into pfSense. We can click things like assignments, and, yeah, we're back up and running. Perfect.
So now you should have everything you need to be able to configure your WireGuard instance and connect remotely from wherever you are. Just remember that for each one you want to create a new peer. So you can either add a peer through the GUI like this and generate a key pair. That's probably what you'll need to do if you want to set up something in Linux or be. You can generate it that way, and you'll use a config file for that. But if you're just using something like the Windows client, you'll go through what I did here. Add that, and it's the same sort of thing. You can do that on the Android client as well, albeit you can also use this one in the background.
So a quick wardrobe change later, I'm sure you can appreciate this video has been a bit of a monster to record. We're back on the topic of VPNs, but this time, instead of using WireGuard to connect inwards, an inbound VPN, we're going to be using something like NordVPN or pretty much any VPN that supports OpenVPN, i.e., you can get the config. We're going to be doing outbound VPNs. So what does that mean? Well, you're probably used to downloading your VPN provider's application that allows the PC, the device, the mobile phone you're on to root your traffic over the VPN. You might be doing geo-restrictions, all those sorts of things. Now, what we can actually do is do that within pfSense, and that's pretty powerful because it gives control over the entire network. So we could say, we don't need to install clients on devices. What we can actually do in pfSense is say, hey, that static IP, i.e., that device, root that one over the VPN. Or how about root an entire interface over a VPN? That might be a good idea for something like your guest network. Anything that they connect to here in the UK, you are responsible for what people do on your network. So why not root it all over a VPN? Or why not just avoid the hassle of having to install a VPN client on everything you own? You could just root all the traffic over the VPN in one place. Well, that's what we're going to set up now, and I'm going to be using NordVPN, and you can see a link in the description below whereby if you click it and join up, I get three months as a little thank you. But you can change this to whatever VPN provider you need. The installation steps might be slightly different, but I imagine they're pretty similar at the process level, i.e., creating the interfaces, changing DNS records, doing the NAT rules, all that sort of stuff. The bit that's probably going to change is things like the keys and some of the specific options around security. But anyway, enough go, let's get on with this.
So the first thing we're going to need to do is to create a certificate for this. So to do that, we need to go into system, and then we need to go into the certificates, and we need to create an authority, which is here. So we need to click add. Now, I'm going to give this a name of NordVPN, and the method that's important is to import an existing certificate authority. Now, the reason we're doing that is because we gain all of the certificate authority data from NordVPN itself. That's because this stuff is publicly available. So in my case, I went to the NordVPN website, and I went to their server checker. So what it does is basically says, hey, this is who you are, and this is the server that we recommend based on your location. So for me, it's UK2114.vpn.com. So we need to get the configuration file for this, and what we can do is click here, this OpenVPN UDP. So if I click that, it will now download. And if I click that file, I'll just open that in good old trusty Notepad. We get something like this. Now, I appreciate that's a lot to take in, but this is what a certificate looks like. Now, we'll need some of the parts from here, but the rest we can just get from the official documentation. So going back to our website here, what we need is this here, we need the certificate data. So if we go back to the file we've just downloaded, actually, the certificate data is this one here, and I actually believe this is the same for all, uh, NordVPN servers. So we want to copy that, and then we'll head back to here, and we'll paste that into here. So now that's pasted in there, everything else should look the same as is on screen. Now, all we need to do now is hit the save key, and you'll see that that certificate authority has now been created. Great.
On to the next step. Now, we're actually going to start to configure the VPN client. So we need to go to VPN, OpenVPN, client. You'll see it's blank, and we need to actually create one. So for this, I'm going to call this one NordVPN. And we want to make sure that this isn't disabled. It isn't by default, but I don't know if on older versions it is. The server mode needs to be peer-to-peer because this is going to be a peer-to-peer connection. The device mode is going to be a tunnel, layer three, so it's going to be a tunnel on layer three. The protocol for this is UDP on IPv4 only. That's because this tunnel is going to use UDP. UDP gives you faster speeds than TCP because it doesn't have to go through the whole handshake process. Interface should be left as WAN. You can leave the port blank because it will default to 1194, which is UDP for OpenVPN. The server host address, well, that's here. So we want to copy this value here. So copy that, and I'll paste that into here. Leave the proxy address and proxy port blank, and the proxy authentication should be none as well.
Next, we get on to the user authentication. Now, this will be different depending on the VPN provider you're using. But for me, you need to log into your Nord Account dashboard. So once you're in here, what you need to click on is NordVPN. Now, once you're in here, what you need to do is scroll down, and you want to click on manual setup. That's because we need to generate some API tokens for this to work. It no longer uses the traditional username, which was your email and your password. So once you click that, you're going to get a request for MFA. Go ahead and enter that, and then you should move on to the next step. Once that's completed, you're going to get a username and password in an API style. So just basically copy that and go back to your pfSense, and you want to paste that here into your username. And you want to grab the password, and you also want to copy that into the password file. So that's there. Now, we can leave authentication retry off. We don't want to do that. And then we get on to the TLS configuration. Now, for TLS, we want to use a TLS key, but we don't want to automatically generate one. We want the one that's provided for us. So again, we can either find that in the documentation or we can actually find find that bit of information just here. So here is the static key that we need. So let's just copy that part, Ctrl+C, head back, and we're just going to dump that in this section here. Now, scrolling down, the TLS authentication, that should be left at default. The, uh, bidirectional key should just be left as default. The peer certificate authority will be NordVPN, which we just set up previously. The client certificate should be this one here, the GUI default. And then we get on to the data encryption algorithms. Now, we want to remove those by clicking it, and the ones we want are CBC and GCM. So just click those on the left, and that'll appear on the right. That's what you want. Now, the fallback encryption standard should be CBC. So I'm assuming that it uses, uh, GCM first. The authorization digest algorithm, now for this one, we want SHA512. So do make sure that you get the right one. It's just plain SHA SHA512 here. It's not SHA3-512. It's standard SHA. We don't want any crypto acceleration on this one, and again, I'm using a VM, so we wouldn't be able to do that very easily anyway.
Next, we get on to the tunnel settings. Now, most of this stuff we can just leave blank. Now, under compression, you want to make sure that that says to refuse. That's the most secure. The topology should be a subnet, and the Type of Service that should be unchecked. Don't pull routes should be unchecked, and don't add or remove routes should also be unchecked.
Next, we're going to head into the advanced configuration. So go down here, and this is where we need to specify some custom options. And you might get a hint as to what some of those are in here. You can see some of the flags in this section here, but we don't actually need all of those. And I'm going to defer to the recommendations on the NordVPN website for this. So the ones we want are these here. Don't worry, I'll link this site, um, in the description below. So basically, what this is doing is setting things like persistence keys, making sure the tunnel remains persistent. It's saying that we've got a remote certificate TLS server. Now, some of the things we want to make sure here are the defaults look good for me, but make sure that UDP fast IO is off. Exit notify, we want to change that and put to disabled. The send/receive should be on the default. Now, the gateway creation, that does need to change to be IPv4 only. I don't believe Nord supports IPv6, and you probably want to change the verbosity level to three, so that you get some meaningful output in the logs.
Once you've done that, you should be able to hit save. Might take a couple of seconds, but, yeah, there we go. No error messages, and that looks to be good from a client perspective. Now we need to go back to our interfaces and assignments, and you should see here, I should probably have added that from earlier. That's okay. You'll see this one now, this OpenVPN C NordVPN. So I want to click add on that, and then we'll hit save. So now we've got OpenVPN assigned to OPT4. So clicking into that one, we might want to change the description. I'll probably just call that one NordVPN to make life easier. So we'll call that one NordVPN. I'll just get rid of a space in case that's an issue. And the all-important thing, enable. This won't work without enable. Everything else can just remain the same. So now that's done, let's hit the apply button. That all looks good, and we're on to the last few hurdles, and that is chiefly DNS settings and outbound NAT rules.
So for that, we're going to head into the services, the DNS resolver, and we're going to make a few changes here. So most of this stuff we don't actually have to change. So, so it's already enabled. The listen port is 53. So this should automatically for SSL services, so we're not doing encrypted, uh, DNS here. That should be unchecked. The SSL certificate is already correct. The port is already correct, and the network interfaces. So this is applying to all, but what we want to do here is go down to the outgoing network interfaces, and we want to change that. So I'm going to change this one to be the NordVPN. So this will apply to that outgoing NordVPN network interface only. Now, we want to scroll down and we want to make sure this is transparent, and we cannot use DNSSEC for NordVPN. It's not supported, so make sure that that is disabled. Now, everything else, Python module should be unchecked. DNS query forwarding, we want to enable that one, and we also want to make sure that this one remains unchecked. Now, OpenVPN clients, that one should also be unchecked. Once we've done that, we want to hit save. I hit apply. That's gone through successfully. Great.
We're now on to the next step. So the next step is to actually go into the DNS resolver and to go into the advanced settings. Now, these are already enabled by default, which is what we want. The query name minimization, we want to make sure it's unchecked, and strict, um, query name minimization is also unchecked, so we don't need to do anything there, but just make sure that it's replicated. Now, because we disabled DNSSEC, we actually want to uncheck Harden DNS because we're not using it. Once you've done that, you should be able to hit save and apply those changes, and that's been changed successfully.
Next, we're going to go into the firewall and we're going to go to NAT. Now, what we need to do here is outbound NAT, and we need to create something, now a manual NAT rule, and we need to apply it to the NordVPN interface. So this interface here, we don't want this to be the WAN. We actually want this to be NordVPN. So that's that one there. Now, the address family will be IPv4 because, as I said, IPv6 isn't supported. The source, now this can be anything on your network. Now, you probably don't want that. You might do, that's up to you. I'm going to make it a little bit more interesting, and remember, I'm actually still on my OPNsense network, and I'm connected to pfSense through WireGuard. So I'm actually already on a VPN connected into pfSense, and now I can route my traffic out to the internet over another VPN with NordVPN, which hopefully will be up and running in just a moment. But what I might want to do is say, I don't know, anyone who comes in on WireGuard. So I could choose the WireGuard network here, or if it's not defined as an alias, we could just say the network, and we know that the IP address range for my, um, WireGuard is 10.0.0.1/24. Now, we can just scroll down, and everything else should remain the same. So once you've hit save, that should then show up here. That's that one there, and we want to click apply those changes.
Now, just in case, and this is if you're doing it on your LAN, for instance, you might need to go to your rules and then to your LAN, and you might need to disable or delete the IPv6 rule because that won't work. I don't think that's a required step, it's just a precautionary. Now, one thing we do need to do is for the network you want. So if it was your LAN, if it was here, was my, I think that was VLAN 20, VLAN 40 for my WireGuard. So that's this one here, I would need to go to the edit, and if I scroll down and click advanced options, if you go down, you should see the gateway. Now, the gateway here is set to default, but what I'd actually want to do here is change that gateway to be Nord. So the default will be the WAN, i.e., when I'm on WireGuard, it will send it out over my normal IP address, my normal ISP route. But if I do NordVPN as the gateway, because remember, this VPN is basically just another out from your network, it will now route all the traffic from the Nord network over the VPN. So now we click save, and we click apply. So that's now working.
Now, one of the final things that we need to do is just go to the settings and then go to general setup, and is to change the DNS servers for our system. So because we're going to be using a VPN, we want to change it. So this isn't strictly necessary, but it would be if you were using the whole LAN, because the LAN would include your firewall. We'd want to change it to, in this case, the NordVPN servers. Change this to whatever your DNS servers are for your VPN provider. Now, just go down, and I'm going to hit save. That shouldn't need an apply, it just applies it. Yeah, perfect, that's okay.
So now, fingers crossed, if I go to status and click OpenVPN, you have no idea how nervous I was to click that. You can see that I'm now connected. Success. And I've got a virtual IP address on NordVPN, and you can see the remote host that I'm connected to. Now, you can see there's a little bit of traffic there. That will just be that first handshake. But what if we go now up to my address bar and I go to somewhere like a speed test? And so here you can see that my IP address is now 194. It's Claver. And doing a speed test, you'll know that I don't get the normal 2 gig that I normally would. I'm getting something like 350, 360. So brilliant. Now all of my traffic through my WireGuard or anything on that network is going to be routed over the NordVPN. So going back here, we can refresh that now, and you can see, yeah, a few hundred Megs have been sent and received. So we know that this connection is working.
Next on the agenda is where this firewall starts to become what's coined the kind of next-gen. It's where we look at things like IDS and IPS. IDS is Intrusion Detection Service. This is something specifically designed to detect things but not do things. Why might you ask? Well, that's where the IPS comes in, the Intrusion Prevention System. So one of them detects, and then one of them actively prevents. So this isn't installed by default, and what you're going to need to do is go back to the system, go to the package manager, and the IPS is actually provided by Snort. So searching for Snort, you'll see here, version 4.16.17 for me. I'm going to install that now. It's important to note that there are two versions of this. Much like pfSense, there's basically the free edition, and I believe that includes all signatures that are older than 30 days. If you want the most up-to-date things that are probably going to help towards things like zero days, you're going to need to create an account and subscribe to that. Now, I'm not going to show that for this video, but it's pretty self-explanatory.
So now that that's installed, we should be able to now go to services, and we should be able to find Snort. Yeah, there it is. So now we're basically on the interface for Snort, and there's a myriad of options along the top. To get this working though, we want to click on the interfaces, and first click add. Now, the interfaces you're most likely to want to have this on is your WAN, but you could put it on others if you wanted. For example, if you've got unknown people or less trusted people coming in off your WireGuard, for example, the WAN might not be able to see that traffic. So that's where something like this would come in. I'll have to actually dig in. I'm not sure whether if you put WAN because WireGuard is within the WAN on pfSense, um, it's clever enough to see that. I'm not actually sure if anyone knows, do drop me a comment. Now, I would like to send alerts to the system log for this, and we can choose the logs for that. I'm going to enable packet captures, and we can limit the file size to whatever we want here. Now, we want to either block or leave offenders alone. So by default, this doesn't block people, and that's because often you can get a lot of false positives around this stuff. I'm not going to block it for that reason, but if you want to be totally risk-averse, it might be a good idea to do it. Just note that you might start blocking a lot of legitimate traffic as well.
Now, I'm not going to derail this video too much, it's already long enough by going into all the idiosyncrasies and specificities of IDS and IPS, things like all of the search methods and the mechanisms by which you can do the detection. It's extremely complex. I'm just going to be leaving this as default for now. By default, this is going to be set up for both the home network and external network, and you can create a list for that. But you can see here that by default, it only adds the WAN IP gateways and VPNs and VIPs. So I'm going to leave that as is. I'm going to leave all the customizations as is as well, and I'm going to hit save. Save.
So now that that's saved, we should be able to now start doing some categories. Now, what we need to do here is go to the global settings tab and download some rules. Now, this is where you will need to have an account sign up to do that, or you can download these community rules here. Click to enable the opening emerging threats. This is what I mentioned before about emergent threat zero days, those sorts of things. You will need a pro account for for that. There's a ton of other types of detectors and rules that you can also download here. So things like a botnet, that's probably a good idea, and I'm going to hit save for that. Now, if we go to the updates, I'm going to click update the rules. Hopefully, this should update all of those generally available rules. Like I say, I haven't put in my credentials for this, so that took a little while, but that's now downloaded. And as you can see, these two here, the community rules and the botnet rules, are updated.
So if we go to the alerts, we can download the actions here. There's actually nothing. I've only just announced it. And blocked again, there's nothing here because there's nothing actually active. Now, if we go back to the Snort interfaces here, you'll see that we've got the WAN interface here. Now, we want to start Snort on this interface, and now that is up and running. Remember, we said the blocking mode was disabled for this, it's just going to be doing the detection. So if we want to actually start doing some specifics around this, we've enabled it. We want to go into the WAN categories, and in here we can check actually what we want to enable. So I'm going to tick both of those to enable it, and then click save. That's now going to apply the rule sets to the interface we've just enabled, and thus those rules are now applied to WAN traffic. This can take a little bit of time to apply it, depending on how many rules you've, uh, enabled.
So duplication. Now, this will give you sort of the super bare bones coverage. And if you've got the Snort VRT, that's the sort of the sign-up, the pro versions, you'll actually get another set of options here where you can actually dive in and then enable at a granular level the rules that you want to look at. We can actually do that on some of this stuff here. So if you have a look at the community rules, take that, you'll see here that we can apply or disable any of the rules that we want, dependent on what we're supposed to be doing here. So there are literally probably tens, if not hundreds of thousands of rules. I'll scroll to the bottom, um, 62,000. Oh, no, total rules, 4,000 here. So there's 4,000 rules now applied to our WAN. And if we wanted more, we could obviously sign up. We can create custom ones, etc. Anyway, I'm going to leave the IDS IPS there. And if that's something you want me to cover in more detail, do let me know below. I do work in security, so I would love to get more involved into this. We can also do some triggering of these alerts in a future video as well, much like I've done with CrowdSec, which operates in a similar presence to this, just on the proxy itself, not the firewall. Although I do believe there is a plugin for CrowdSec for pfSense as well. So maybe we'll look at that as well.
The last thing I want to cover in this video really is to look at the backup and restart, which if anyone's got a firewall, it's pretty much one of the most important things. So to do that, we want to go to services and then auto-config backup. Now, auto-config backup is what it says on the tin. We first need to enable that, and then we can automatically back it up on any configuration change or on a regular schedule. Now, when you're first setting this up, you're probably going to be making a ton of changes, so this might get quite noisy. I probably would do a regular schedule because the likelihood of me making changes once I've done this initial installation is probably quite low. So choose something from here that makes sense for you. So maybe once a day, maybe once a week. I can't really tell you now. It's a good idea to put in an encryption password here to keep your backup safe, and also then make sure you remember that password so that you can get your config back up and running when you need it. Having this config is really important because you can install a fresh version of pfSense and you can restore that configuration, and you'll be up and running in a few seconds.
Now, as far as I'm aware, there isn't something like SMTP for this, so you're not going to be able to back this up to your emails, uh, by default. I don't know if there's any community plugins for that. I'm still learning about this, so do let me know below. In failing that, you can probably set up something like a simple cron job, which will go and grab the XML file for this, but you obviously want to make sure that that's secure and encrypted as well.
Now, one final thing I did want to cover, and this is basically just covering all grounds. We've kind of done this already through, um, some of the firewall rules, some of the WireGuard things, etc. But it was just a look at port forwards. So if we go to firewall and then we want NAT, we want to do sort of a port forward. And you'll see here that by default, we're already on port forward. So the simplest way of adding a port forward, just to click add and then configure it for your WAN. And what this is actually doing is it's saying, hey, any traffic that's hitting my IP address, i.e., the one that's provisioned to me by my ISP, I want you to do something with that. I.E., send that traffic from there to somewhere internally. By default, anything that hits your external IP address is going to be blocked, and that's why even if you've got a crappy ISP router, odds are you're not going to get hacked because it's just dropping all of that traffic. The irony is, as soon as you start opening stuff up, that's when you really need to take control of what you let in, how you let it in, what you scan, how you're alerted, how you segmented your network, how you do IDS IPS, all of those sorts of things.
So a typical use case, if you've been following my videos, will likely be to open up ports 80 and 443. That's for unencrypted and encrypted web traffic. Now, the key thing for that would probably be to point it to your proxy, so that anything coming in will go to your proxy, which will then serve up things on your web server. So it might be a web page, it might be your Plex, it might be your Nextcloud, whatever it might be. So to do that, basically, all we do is say we want the interface of WAN, the IP address, I'm just going to use four, but you could use six, and you could have discrete rules for each one. Now, the protocol you typically would allow any or specifically TCP or UDP, but it depends on what it is that you want to open. So let's just use that example of a web server. So for a web server, I would expect predominantly TCP, but maybe there's some UDP traffic I'm also forwarding because things like traffic understand UDP. Now, for the source, if you leave it as default, it's going to say anything from the internet. But if you want to, you can actually restrict that. So if you click advanced, you could specify where you want that source to be. So that source could be a network, or it could also be things like countries. So it can be a subset of countries. Countries you only want to access this. I've mentioned before, that's not failsafe, but it's pretty good for getting rid of annoying bots. You could also be a bit more granular. So for example, all of the people you want to have access to your services, you could go and spin up Dynamic DNS for them. You can do that free, by the way, and you could then restrict the inbound to a group of those IP addresses, those FQDNs. So you know that this is a concept called kind of whitelisting, whereby only those IPs can access your services. So I'm just leaving it any for this, but I recommend you try and restrict this wherever possible, or drive people over WireGuard, and you don't have to worry about any of this stuff.
Now, the source ports is typically any. So this is kind of where they're coming from. The bit we're going to have to change really is the destination. So the destination is our WAN address. So they're coming from somewhere from a random port, they're going over a certain protocol, and they're trying to hit our WAN IP address. Now, the destination port would typically be something like, let's say, 443. Now, that's the encrypted, um, port for, um, HTTPS. Now, what we want to do with that is a redirect target. So that's basically saying anything hitting this, where do we want to send it? So we'd probably send this to our proxy. So I'm going to make this up. I'm going to say 192.168.100.50. That's my proxy. This would be whatever it is you're trying to port forward. This could be a game server, for example, and you'd forward all traffic on whatever the game server uses to the IP address. And that's pretty much it. Where it gets interesting is, so I'll just click save on that one. Oops.
So one thing here as well, we will actually have to put in a redirect target because we're redirecting it. I'll put in 443 for that one as well. So we're not actually changing it, we're redirecting the traffic, but we're keeping the ports and stuff the same. So hopefully, we just hit save, and then we can hit apply. And let's just have a little summary of what that looks like. That's saying anything hitting the WAN, TCP, UDP, can come from anywhere on any port, but it's going to be hitting our WAN on 443, and it's going to send it to this, which let's say it's our proxy. Great.
Now, one thing that makes life a hell of a lot easier as well is if we go to firewall, we want to set up some aliases. Now, an alias is exactly what it says, it's another name for something, right? So in here, we could actually do something like, um, friends, and it will be of type hosts. Now, type host is good because it accepts an IP or an FQDN. And like I said before, if you use Dynamic DNS with your friends, and they're using an FQDN, you can just use the FQDN in here, and pfSense will automatically keep that up to date. So you only need to allow an entry from those FQDNs, and you don't have to worry about logging in each time and putting a new IP address every time that ISP changes it. So let's put in here, myfriend.com, and we'll save that. So we'll apply that. Now, I don't know if this is actually going to resolve. It might do. God knows what that website actually is. But you can also set up, um, aliases as for different ports. So in here, you could put a port group. So you could just say web traffic, and you could create an alias called web, and in there you would put port 80 and 443. So if I call this one web, and I add port 80, and I add port 443, I can then click save and apply.
So now, if I go back to my firewall, and I go to my NAT, and my port forward, I can actually edit that now, and I can say, hey, no, instead of source, I'm going to use my alias that I used. So I can click that alias. So I can select that alias there. So friends is that alias. And the port range, again, it will come from anywhere, but the destination port range, I should also now be able to change that to, I think we called it web. So we can select other, and then we can put web and web. And now that should have updated, uh, and we can redirect to other, and then we've got web already put in there. So hopefully, if I click save and apply, you can see now. Now that the source address is here, this, uh, myfriend.com, and you could obviously add as many friend, uh, DDNS as you want in there. And if you hover over here, you'll see it's port 80 and 443. So that's basically how you do a port forward, and how you create aliases to make port forwarding easier. And you don't just need to use aliases for port forwards. Once you create aliases, you can use them in any of the rules throughout the firewall, which just makes administration so much easier. You can also shortcut it as well. So if you hover over friend, you can actually just click that, and it takes you into what friends is. So you can do an edit on the fly, which is great.
So that's going to wrap up for this video, and I'm going to finish off my CT. Hopefully, that was useful for you, and it's been great for me to learn all the intricacies of pfSense. Now, the question is, am I going to be using pfSense instead of OPNsense? I don't know. I'm still evaluating it. Probably, it will all depend really around WireGuard, which was one of the key things that I want. And from some preliminary testing, um, pfSense seems to be a lot faster than OPNsense on WireGuard. I believe that's to do with pfSense being closer to things like the FreeBSD, which they actively contributed more to. I think Tom Lawrence did a video on that, which is quite interesting if you want to go and check it out. Also, I believe if you pay for the sort of pfSense Plus, I think it unlocks another kernel module for crypto acceleration for WireGuard. So that could also be another improvement. I'm going to keep doing some speed tests around that just to see which one is faster, and that may ultimately sway my decision. I'm probably going to pony up for the pfSense Plus just because I'm interested in seeing what it can do. Anyway, hopefully, this will get you from sort of zero to meddling hero by the end of this video.
So we've covered a lot of stuff in here, and I think probably the key things for you guys will be the ability to do those port forwards. It will be the ability to do sort of WireGuard networks and route all your traffic out over a VPN. We also touched on firewall rules for checking and changing things for, um, different VLANs. So as always, if you like this video, give it a thumbs up, hit that subscribe, and I'll see you on the next one. Take care, everybody.
[Music]