|
Wazo, LLC Network Administrators Blog > Categories
|
4/2/2008
A client I work for needed a new firewall solution, but didn't want to break the bank. A few requirements were the ability to have the firewall bridge transparently to allow public IP addressing behind the device - 1:1 NAT wasn't an option for various reasons - traffic graphing, and preferrably have an intrusion detection system.
Luckily, pfSense, a firewall built upon m0n0wall and BSD, fit the bill perfectly. It has the ability to bridge transparently, has an automated package system which can be used to install the Snort IDS, and has a built in RRDTool graphing for network traffic and system load.
Unfortunately, I ran into a few gotchas when installing pfSense in transparent bridge mode and thought I'd document them here for internet posterity.
-
-
Note the following:
-
Make sure to use a different IP on the LAN side. It doesn't matter what IP, as it's never used.
-
Create a firewall rule to allow web management. Create a WAN rule with a destination of the WAN Address and a port of 80 HTTP.
-
Connect the WAN port to your ISP and the LAN port to your LAN. This seems obvious, but routing doesn't start right away, so you may think you have it hooked up incorrectly.
-
Don't use the pfSense box as your gateway! Use the gateway of your ISP.
-
Install the Dashboard package. You'll thank me later.
Happy pfSense'ing!
|
|
|
|
|