Network Security with pfSense

Architect, deploy, and operate enterprise-grade firewalls

Manuj Aggarwal

• Publisher: Packt Publishing
• Year: 2018
• ISBN:
  9781789538618
• Edition: 1
• Topic: Informatik
• Subtopic: Cybersicherheit

Use an open source firewall and features such as failover, load balancer, OpenVPN, IPSec, and Squid to protect your network

Key Features

• Explore pfSense, a trusted open source network security solution
• Configure pfSense as a firewall and create and manage firewall rules
• Test pfSense for failover and load balancing across multiple WAN connections

Book Description

While connected to the internet, you're a potential target for an array of cyber threats, such as hackers, keyloggers, and Trojans that attack through unpatched security holes. A firewall works as a barrier (or 'shield') between your computer and cyberspace. pfSense is highly versatile firewall software. With thousands of enterprises using pfSense, it is fast becoming the world's most trusted open source network security solution.

Network Security with pfSense begins with an introduction to pfSense, where you will gain an understanding of what pfSense is, its key features, and advantages. Next, you will learn how to configure pfSense as a firewall and create and manage firewall rules. As you make your way through the chapters, you will test pfSense for failover and load balancing across multiple wide area network (WAN) connections. You will then configure pfSense with OpenVPN for secure remote connectivity and implement IPsec VPN tunnels with pfSense. In the concluding chapters, you'll understand how to configure and integrate pfSense as a Squid proxy server.

By the end of this book, you will be able to leverage the power of pfSense to build a secure network.

What you will learn

• Understand what pfSense is, its key features, and advantages
• Configure pfSense as a firewall
• Set up pfSense for failover and load balancing
• Connect clients through an OpenVPN client
• Configure an IPsec VPN tunnel with pfSense
• Integrate the Squid proxy into pfSense

Who this book is for

Network Security with pfSense is for IT administrators, security administrators, technical architects, chief experience officers, and individuals who own a home or small office network and want to secure it.

Introduction to pfSense

his book aims to provide you with in-depth knowledge of a very widely used technology, pfSense. This will provide you with some real-world scenarios and use cases, which you will be able to leverage immediately in your own projects. The introductory modules will help you to understand what pfSense is, its features, the key services it provides, and how you can install it. After the introductory modules, we will deep dive into each of its exciting features. You'll learn about the installation, configuration, and use of pfSense. This education will enable you to do everything from setting up firewalls, load balancing, and failover settings, to integrating with other software such as OpenVPN and Squid proxy server.

In this book, we will give you the information you need in order to work with this amazing piece of software.

In this chapter, you will be introduced to pfSense. You will gain an understanding of what pfSense is, its key features, and its advantages. You will also view demonstrations on the installation of pfSense on a virtual platform on VMware, as well as some other configurations. Let's get started.

What is pfSense?

pfSense is a free, customized distribution of FreeBSD. FreeBSD itself is an operating system for a variety of platforms, which focuses on features, speed, and stability. It's derived from BSD, the version of UNIX developed at the University of California, Berkeley. It is developed and maintained by a large community. You can use pfSense to turn a computer into a fully-featured router and firewall. This software was first developed in 2004 as an offshoot of the popular m0n0wall project. The main difference between pfSense and m0n0wall is that pfSense is designed for personal computers and servers instead of embedded devices. This allows pfSense to offer more flexibility and features. pfSense is a very flexible and powerful tool that you can easily adapt to numerous applications, from a home router to a firewall, for a large corporate network. pfSense is easy to install and maintain. It has a very useful web-based user interface. pfSense also has many features that are usually only found in expensive commercial routers. You can use the following three types of install media to install pfSense:

1. Optical disk image: That could be an ISO image, a CD, or a DVD disc. This is an easy and familiar choice. Use this option if the target hardware has an optical drive. This is especially useful if the BIOS will not boot from USB.
2. Memstick: This option is similar to the CD or DVD, but runs the installation from a USB thumb drive. It's often faster than a CD or DVD. This is very useful with new devices, as many of them don't have integrated optical drives, making this the current best recommendation.
3. Serial memstick: This option is similar to the memstick image, but runs using the serial console rather than VGA for newer embedded systems.

The following is the graphical representation of the installation media:

pfSense is a very impressive software. The following are some of its key features:

• pfSense is very robust and it supports a number of great features. This allows you to have a single device that performs all the functions you need at the edge of your network. The downside of this is that all your functions work from a single machine, so it's a single point of failure.
• To offset this, pfSense also supports high availability, which means that you can group several devices together.
• One of the most significant benefits is that pfSense is free. You can simply download the software from the website. Although virtualization is supported, you will, of course, need to spend on the hardware that you are going to install the software on. However, all things considered, it is more cost-effective than other solutions.
• pfSense can be installed on any hardware, which makes it highly flexible and very scalable.
• pfSense is also highly extensible. It has an energetic and dedicated community behind it. They have built and contributed tons of useful add-ons to the pfSense platform. Most of these add-ons are also completely free.

Benefits of pfSense

The first benefit is that pfSense is feature-rich, robust, and very flexible software. Besides the essential firewall features, it has tons of additional features for network routing, remote connectivity, diagnostics, and reporting, along with many more. What's more, it is an extensible platform. You do not have to settle for the functionality provided out of the box with pfSense. You're free to write your own plugins and add-ons. Many members of the community have done just that. You will go over some of its key extensions later in this book.

With all the enterprise-grade features and security pfSense provides, it is incredible that it is a free and open source product. This is possibly its biggest benefit. You can download it from the pfSense website at https://www.pfsense.org/download/, and install it by yourself. For large implementations and complex configurations, you do have the option to purchase license support from professionals, but that is completely optional.

pfSense is very versatile and flexible. If you are a professional working out of a home-based office, you can use pfSense to protect your network. But if you are a large company running a global infrastructure, you can still use pfSense to protect various parts of your work. pfSense can run on a 10-year-old PC with limited resources, and it can also run on large multicore servers. This makes it quite scalable. You can easily expand the resources on your pfSense infrastructure in the event that your network needs an increase. And due to these benefits, and many other features which pfSense brings to the table, individuals, network administrators, security enthusiasts, and companies across the world are embracing pfSense. These are just some of the most recognizable names who have adopted pfSense as a core part of their network infrastructure. Needless to say, with organizations such as Google, the US Department of Homeland Security, Shopify, and NASA putting their faith in pfSense, this free open source firewall solution is here to stay.

Use cases

Let's take a look at some use cases where pfSense can prove to be instrumental.

LAN or WAN router

pfSense can act as a LAN or WAN router. LAN, as you know, is basically a group of computers and associated devices that share a common communication line or wireless link to a server. A LAN usually consis...

Table of contents

• Title Page
• Copyright and Credits
• Packt Upsell
• Contributor
• Preface
• Introduction to pfSense
• pfSense as a Firewall
• pfSense as a Failover and Load Balancer
• Remote Connectivity with pfSense and IPsec
• Using pfSense as a Squid Proxy Server
• Other Books You May Enjoy