Book Image

Learn pfSense 2.4

By : David Zientara
Book Image

Learn pfSense 2.4

By: David Zientara

Overview of this book

As computer networks become ubiquitous, it has become increasingly important to both secure and optimize our networks. pfSense, an open-source router/firewall, provides an easy, cost-effective way of achieving this – and this book explains how to install and configure pfSense in such a way that even a networking beginner can successfully deploy and use pfSense. This book begins by covering networking fundamentals, deployment scenarios, and hardware sizing guidelines, as well as how to install pfSense. The book then covers configuration of basic services such as DHCP, DNS, and captive portal and VLAN configuration. Careful consideration is given to the core firewall functionality of pfSense, and how to set up firewall rules and traffic shaping. Finally, the book covers the basics of VPNs, multi-WAN setups, routing and bridging, and how to perform diagnostics and troubleshooting on a network.
Table of Contents (14 chapters)

The pfSense project

pfSense runs on the FreeBSD operating system. FreeBSD is an offshoot from Berkeley UNIX—the University of California, Berkeley had acquired a license for AT&T UNIX in the 1970s. Students started to improve on this version of UNIX, and Berkeley Software Distribution (BSD) was founded as a project to make modifications to AT&T UNIX, as well as to distribute this modified version. This version, however, had proprietary AT&T source code in it, and BSD users thus had to obtain a license from AT&T to use it legally. In the late 1980s, however, work began on a project to eliminate AT&T code from BSD in order to produce an open source version of it, thus spawning the FreeBSD project. Since then, FreeBSD has gained a following among those seeking a stable and secure open source variant of UNIX that provides good performance.

pfSense is based on pf, which is OpenBSD's packet filter (itself designed as a replacement for Darren Reed's IPFilter, which OpenBSD had been using up to that point). pf was incorporated into OpenBSD distributions in 2001. pf is a command-line utility, and, as a result, several projects were launched to provide a graphical interface for the pf utility. m0n0wall, initially released in 2003, was the first successful attempt at providing a graphical front end for pf. pfSense, which began as a fork of this project, was another such project.

Version 1.0 of pfSense was released on October 4, 2006. Version 2.0 was released on September 17, 2011. Version 2.1 was released on September 15, 2013, and Version 2.2 was released on January 23, 2015. Version 2.3, released on April 12, 2016, phased out support for legacy technologies such as the Point-to-Point Tunneling Protocol (PPTP), Wireless Encryption Protocol (WEP) and single DES, and also provided a facelift for the web GUI.

Version 2.4, released on October 12, 2017, continues this trend of phasing out support for legacy technologies while also adding features and improving the web GUI. Support for 32-bit x86 architectures has been deprecated (however, security updates will continue for 32-bit systems for at least a year after the release of 2.4), while support for Netgate Advanced RISC Machines (ARM) devices has been added. A new pfSense installer (based on FreeBSD's bsdinstall) has been incorporated into pfSense, and there is support for the ZFS filesystem, as well as the Unified Extensible Firmware Interface (UEFI). pfSense now supports OpenVPN 2.4.x, and as a result, features such as AES–GCM ciphers can be utilized. In addition, pfSense now supports multiple languages; the web GUI has been translated into 13 different languages. At the time of writing, version 2.4.3, released on May 14, 2018, is the most recent version.

pfSense is not the only option if you are looking for open source firewall/router software—it is not even the only software making use of FreeBSD and pf. The m0n0wall project was discontinued in 2015, but there have been several m0n0wall forks since its end of life, including t1n1wall and SmallWall. Manuel Kasper, the developer behind m0n0wall, supports OPNsense, a project that forked from pfSense in 2015. There are also projects such as Shorewall, an open source firewall tool for Linux that builds on Netfilter.

Nevertheless, pfSense is currently the most popular open source firewall/router, and the developer community contributing to the project is strong. It is fairly easy to install and configure, and is useful in a variety of deployment scenarios.