Book Image

pfSense 2.x Cookbook - Second Edition

By : David Zientara
Book Image

pfSense 2.x Cookbook - Second Edition

By: David Zientara

Overview of this book

pfSense is an open source distribution of the FreeBSD-based firewall that provides a platform for ?exible and powerful routing and firewalling. The versatility of pfSense presents us with a wide array of configuration options, which makes determining requirements a little more difficult and a lot more important compared to other offerings. pfSense 2.x Cookbook – Second Edition starts by providing you with an understanding of how to complete the basic steps needed to render a pfSense firewall operational. It starts by showing you how to set up different forms of NAT entries and firewall rules and use aliases and scheduling in firewall rules. Moving on, you will learn how to implement a captive portal set up in different ways (no authentication, user manager authentication, and RADIUS authentication), as well as NTP and SNMP configuration. You will then learn how to set up a VPN tunnel with pfSense. The book then focuses on setting up traffic shaping with pfSense, using either the built-in traffic shaping wizard, custom ?oating rules, or Snort. Toward the end, you will set up multiple WAN interfaces, load balancing and failover groups, and a CARP failover group. You will also learn how to bridge interfaces, add static routing entries, and use dynamic routing protocols via third-party packages.
Table of Contents (18 chapters)
Title Page
Copyright and Credits
About Packt

Configuring VLANs

This recipe describes how to set up a Virtual LAN (VLAN) from the pfSense web GUI.For example, we could set up a VLAN for developers.

Getting ready

In order to complete this recipe, you must have at least one unassigned interface to use as the parent interface.

How to do it...

  1. Navigate toInterfaces | Assignments, and click on the VLANs tab.
  2. Click on theAddbutton.
  3. Choose aParent Interfacefrom the drop-down menu; this should be a currently unassigned interface:
  1. Enter a VLAN Tag from 2 to 4094 (1 is reserved as the default VLAN tag and should not be used).
  2. Enter aVLAN Prioritylevel from 0 to 7 (or just leave it at the default value of 0).
  3. Enter a briefDescription.
  4. When you are done, click on theSavebutton.
  5. Click on theInterface Assignmentstab.
  6. In theAvailable network portscolumn, select the newly created VLAN in the drop-down box, and click on the Add button:
  1. To configure the VLAN, click on the interface name in theInterfacecolumn.
  2. On the Interfaces configuration page, check theEnable Interfacecheckbox.
  3. Change theDescriptionto an appropriate one for the VLAN (for example, DEV).
  4. Set theIPv4 Configuration Typeto an appropriate value (usuallyStatic IPv4).
  5. Set theIPv6 Configuration Type, or leave it set toNone.
  6. If you set theIPv4 Configuration TypetoStatic IPv4, you must enter theIPv4 Addressand CIDR for the new VLAN. Use a subnet that has not yet been used (for example,
  1. Leave the IPv4 Upstream gatewayset to None.
  2. If you set theIPv6 Configuration TypetoStatic IPv6, you must enter theIPv6 Addressand CIDR for the new VLAN.
  3. Leave theIPv6 Upstream gatewayset to none.
  4. Leave theBlock private networksandBlock bogon networkscheckboxes unchecked.
  5. When you are done making changes, click on theSavebutton, and then, when the page reloads, click on theApply Changesbutton.

How it works...

Up to now, we have contemplated networks that correspond to a single network interface. Sometimes, however, we want to decouple logical network groupings from physical interfaces. We may want to have more than one network on a single interface—or, less commonly, have a network span multiple interfaces. We can accomplish this with virtual LANs, or VLANs. By attaching a special header to an Ethernet frame, known as an 802.1Q tag, we can have VLANs. Since the VLAN tag is an integer from 1 to 4094, it would seem that we are limited to 4094 VLANs (or 4093, since we are not supposed to use 1 as a tag), but by using QinQ tagging, we can nest VLAN tags, making it possible to have a much greater number of VLANs on our private network (in fact, a much greater number of VLANs than we would probably ever need).


In step 5 of this recipe, we referenced the VLAN priority level. This is a feature added to pfSense with version 2.3 that allows you to define a class of service for your VLAN. It is a 3 bit field from 0 to 7. Somewhat counter-intuitively, 1 is the lowest priority level (background), while 7 is the highest, and 0 is best effort treatment, which is one step above the lowest priority level.

There's more...

In order to utilize VLANs on your network, you need one or more managed switches. These are switches that recognize 802.1Q tags placed in the Ethernet frame by pfSense, and which will forward the frames to the correct port. Managed switches are never plug and play, they always involve some configuration, so consult your switch’s documentation for details on how to configure it.

See also

  • TheConfiguring VLANs from the consolerecipe