Software

pfSense® CE Configuration Recommendations

Overview

pfSense® CE is an open source routing and firewall software which is based on FreeBSD. An article covering installation can be found at this link. This article offers some basic recommendations to configure pfSense® CE on the Vault. Some of these recommendations had been in other articles, but for ease of use, we are consolidating them here in one article. This article includes the following areas of interest:

• Thermal Monitoring
• Enable Cryptographic Hardware assist with AES-NI and BDS 
• Power Management with PowerD
• Enable Optional (OPT) ports

At the bottom of this article, there is a table with downloadable configuration files for each of the Vaults that include the settings described below.

Thermal Monitoring

The Vault has a solid state, fanless design. The case is designed to dissipate the heat generated by the unit. Although the case may be warm to the touch, it most likely indicates that the system is functioning correctly. However, Thermal Monitoring can be used to verify the Vault is operating under normal thermal conditions.  Intel based CPUs have built in thermal monitoring and pfSense® CE can access it to display temperatures on the dashboard. The following article will describe how to enable and monitor the thermal sensors.

Enable Thermal Monitoring

Enabling Thermal Monitoring is done through the pfSense® CE WebUI.

• Browse to the pfSense® CE Dashboard, default 192.168.1.1 on the LAN port
• Select “System –> Advanced” and click on the “Miscellaneous” tab

System->Advanced

• Scroll down to “Cryptographic & Thermal Hardware”
• Click on “Thermal Sensors.”
• From the drop down, choose “Intel Core* CPU…”

System->Advanced->Miscellaneous->Cryptographic & Thermal Hardware

• Click “Save” button at the bottom of the page
• Verify success message is displayed at the top of the page
• Thermal monitoring of the CPUs is now enabled

Display Thermal Sensors on the Dashboard

The preceding steps enabled thermal monitoring.  The following steps will show how to display thermal monitoring on the dashboard.

• Select the Dashboard
• Click the “+” icon in the upper right corner
• Verify the “Available Widgets” box appears
• Click the “+” next to Thermal Sensors

Dashboard->Available Widgets

• Verify the Thermal Sensors box is displayed at the bottom of the dashboard

Dashboard with Thermal Monitoring, Idle

The screenshot above shows an example of the FW4B that is essentially idle for over 40 minutes. Note that the core temperatures range from 51 to 53 degrees C. This is well within normal range.

Dashboard with Thermal Monitoring, Iperf 40 Minutes

The screenshot above shows an example of the same FW4B that is running an iperf test at linerate for over 40 minutes. Note that the CPU usage has increased from 3% to 30% and core temperatures range from 55 to 58 degrees C. Although this may seem high, and the case may be warm to the touch, it indicates that the case is functioning correctly and dissipating the heat. The Intel TJmax core temperatures from ark.intel.com for each of the processors is displayed in the table below.

Cryptographic Hardware Support (AES-NI and BDS)

The FW2B, FW4A, FW4B and FW6 series of the vault have cryptographic hardware support built into the CPU. Cryptographic Hardware support is critical for the performance of VPNs and other features that encrypt and decrypt packets as they traverse the unit. By default, it is not enabled in pfSense® CE.

Enable Cryptographic Hardware Support

Enabling Cryptographic Hardware Support is done through the pfSense® CE WebUI.

• Browse to the pfSense® CE Dashboard, default 192.168.1.1 on the LAN port
• Select “System –> Advanced” and click on the “Miscellaneous” tab

System->Advanced

• Scroll down to “Cryptographic & Thermal Hardware”
• Click on “Cryptographic Hardware.”
• From the drop down, choose “Intel Core* CPU…”

System->Advanced->Miscellaneous->Cryptographic & Thermal Hardware

• Click “Save” button at the bottom of the page
• Verify success message is displayed at the top of the page

At this point cryptographic hardware support should be enabled.

Power Management with PowerD

All of the Vault series use Intel CPUs that have Power Management features that allow the selection of power management modes. The power management modes trade performance vs. power by adjusting the frequency based on system load. PowerD is a power control utility built into pfSense® CE, which is inherited from the underlying FreeBSD operating system. In this section, we will enable PowerD and select the optimum performance vs. power settings.

Enable PowerD

In this example we will enable PowerD within the pfSense® CE  WebUI.

• Browse to the pfSense® CE Dashboard, default 192.168.1.1 on the LAN port
• Navigate to the System tab and select Advanced from the drop down menu

pfSense® CE Dashboard

• Verify the Advanced page is displayed
• Select the Miscellaneous tab
• Verify the Miscellaneous page is displayed
• Scroll down to the section labeled Power Savings
• To enable PowerD, check the box next to Enable PowerD
• Verify Hiadaptive is selected for the power modes as shown in the image below

PowerD Settings

• Scroll down to the bottom of the page and click Save
• Verify a message stating “The changes have been applied successfully” is displayed at the top of the page.

At this point, PowerD should be enabled for optimum power management.

Configuring Optional Ports

This article covers how to configure the Optional Ports in pfSense® CE. The Optional Ports are labeled “OPTx” on the Vault. The configuration has the same type of default settings as the LAN port.  Those settings include:

• An IP Address of 192.168.x.1
  • OPT1 192.168.2.1
  • OPT2 192.168.3.1
  • OPT3 192.168.4.1 (FW6 only)
  • OPT4 192.168.5.1 (FW6 only)
• Enabling the OPT port to be a DHCP Server
• Firewall rules to allow “Any” traffic originating on this port to pass without being blocked

Configuring Optional Ports – IP Address

• Browse to the pfSense® CE Dashboard, default 192.168.1.1 on the LAN port
• Navigate to the Interfaces tab and select Assignments from the drop down menu

Interface->Assignments

• Verify the Interface Assignments page is displayed and add the next available interface

Interfaces->Interface Assignments

• Verify OPT1 is added and Select Save

Interface->Interface Assignments OPT1

• Select OPT1

Interfaces->Interface Assignments->OPT1 Select

Verify the OPT1 General Configuration page is displayed and configure as follows:

• General Configuration->Enable – Check the box
• General Configuration->IPv4 Configuration Type – Select Static IPv4
• Static IPv4 Configuration>IPv4 Address – Set 192.168.2.1 /24
• Select the Save Button

Interfaces->OPT1 Configure

• Verify the OPT1 Configuration has been changed and Apply Changes

Interfaces->OPT1 ApplyChanges

• Verify changes have been applied successfully

Interfaces->OPT1 Success

Configuring Optional Ports – DHCP Server

• Navigate to the Services tab and select DHCP Server from the drop down menu

Services->DHCP Server

• Verify the Services->DHCP Server page is displayed and Select OPT1

Services->DHCP Server Select OPT1

Verify Services->DHCP Server->OPT1 page is displayed and configure as follows:

• General Configuration->Enable – Check the box
• General Configuration->Range – 192.168.2.100 to 192.168.2.199

Services->DHCP Server Configure OPT1

• Select the Save button and verify the changes have been applied successfully

Services->DHCP Server OPT1 Success

Configuring Optional Ports – Firewall Rules

• Navigate to the Firewall tab and select Rules from the drop down menu

Select Firewall->Rules

• Verify the Firewall Rules page is displayed and Select OPT1

Firewall->Rules Select OPT1

• Verify Firewall OPT1 page is displayed and select the Add Button

Firewall->Rules OPT1 Add Rule

Verify Firewall->Rules->Edit for OPT1 page is displayed and configure as follows:

• Edit Firewall Rule->Action- Pass
• Edit Firewall Rule->Interface- OPT1
• Edit Firewall Rule->Address Family – IPv4
• Edit Firewall Rule->Protocol – Any
• Save the changes

Firewall>Rules Configure OPT1

• Verify the configuration and Apply the changes

Firewall->Rules->OPT1 Apply Changes

• Verify success message

Firewall->Rules->OPT1 Success

OPT1 has now been configured with static IP address 192.168.2.1, it is a DHCP server, and any traffic coming into this port is allowed to pass.

Configuring Optional Ports – Verify Configuration

OPT1 has been configured so it needs to be tested to verify the configuration changes are correct. Follow the instructions below to test the changes:

• Connect a PC to OPT1
• Verify the PC gets an IP address in the range of 192.168.2.100-199
• From the PC, browse to a site outside of the local network
• Verify an external web page is displayed correctly on the PC

At this point OPT1 is up and running. To configure OPT2 repeat the same steps as OPT1, but use IP address 192.168.3.1. For an FW6 with OPT3 and OPT4, repeat the same steps using IP addresses 192.168.4.1 and 192.168.5.1.

Configuration Files

The steps above were described to manually configure the Vault as indicated. It is important to understand the steps required, however, it is very convenient to load a configuration file rather than manually configure each item.

We have included configuration files in the table at the bottom of the page. These configuration files have

• Thermal Monitoring Enabled
• Cryptographic Hardware Support Enabled
• Power Management Enabled
• OPT Ports Enabled with Static IP Address, DHCP Server, and Basic Firewall Rule

Note: These configuration files have the default admin password retained. The additional ports assigned use default firewall rules, same as what pfSense® configures for the LAN port.

How to Restore a Config File

• Verify pfSense® has been installed correctly
• Verify the correct configuration file has been downloaded from the table below and pfSense® will be able to access it
• Log into the WebGUI. This is 192.168.1.1 by default.
• The default pfSense® login user is ‘admin’ and password is ‘pfsense’
• Click Diagnostics on the top of the GUI
• From the drop-down menu click Backup & Restore

• Click Choose File
• Select the appropriate config, click open
• Click Restore Configuration

• Verify the Vault reboots
• Log back into the WebGUI with the default credentials
• Verify OPT1 and OPT2 (OPT3 /OPT4 additionally on the FW6x) now appear on the Interfaces widget

• It is now recommended to change the default ‘admin’ password
• Verify the newly assigned ports are functioning and DHCP is handing out IP addresses

If you experience any issues, please feel free to reach out: support@protectli.com. You can find additional information in our Knowledge Base, or reference pfsense.org directly.

Configuration Files

Overview: Install pfSense® CE

pfSense® CE is an open source routing and firewall software which is based on FreeBSD. It has a variety of packages easily downloaded and configurable within the GUI itself. https://www.pfsense.org/getting-started/

Note: pfSense® CE is open source software developed for the benefit of the community.  If you are using pfSense® CE with the Vault, please consider supporting the pfSense project. https://www.pfsense.org/get-involved

Note: pfSense® CE version 2.4.5 is now available. Protectli recommends using the latest released version.

Verify Hardware Recommendations

pfSense® CE has good documentation regarding general hardware recommendations on their web site. See https://docs.netgate.com/pfsense/en/latest/book/hardware/minimum-hardware-requirements.html to verify that  the proper memory and storage is available for the intended application.

Install pfSense® CE

Obtain the Installation Image and Uncompress it

There are two ways to install pfSense® CE on the Vault.  Because the Vault has a COM (serial console) port, users can install pfSense® CE using only the COM port, OR, users can install pfSense® CE the more ‘traditional’ way by using a VGA or HDMI monitor, along with a USB keyboard.

• The easiest way to install pfSense® CE that is most likely to be error-free is with a VGA (FW1, FW2, FW4A series) or HDMI (FW2B, FW4B, FW6 series) monitor and a USB keyboard, using the VGA version of the installer
• If the user chooses to install pfSense® CE with the serial console port on the Vault, the user MUST use the serial version of the installer.
• If the user encounters an issue whereby the installation appears to stop and not proceed, please double check to ensure you’re using the correct version of the pfSense® CE installer with your chosen installation method.

The pfSense® CE installation image (IMG) can be downloaded from https://www.pfsense.org/download/. The same image can be used to install pfSense® CE on any of the Vault platforms. It is important to choose the correct options when downloading the image including “Version”, “Architecture”, “Installer”, and “Console.”  The proper selections are as follows for installing the Vault using a VGA monitor and USB Keyboard:

Version: The latest available (2.4.5 as of this edit)

Architecture: AMD64 (64 bit)

Console: VGA or Serial as needed (see note above; VGA or HDMI monitor = VGA installer; COM port  = serial installer)

Installer: USB Memstick Installer

Your download should begin immediately and when it is completed you should have a compressed IMG file (an example file name is: pfSense-CE-memstick-2.4.5-RELEASE-amd64.img.gz) downloaded that is ~800MB in size.

Now that the compressed image file has been downloaded, you will need to use a program like “7zip” or “winzip” on Windows to decompress the file.  The resulting file should look the same, except that the file name will now end in “.img” instead of “.img.gz”.

Burn the installation image to a USB drive

The easiest way to transfer the installation image to a USB drive is by using software called “Rufus” on Windows or “Etcher” on Mac OSX. See this link for  detailed instructions on how to create a bootable USB drive using Rufus or Etcher.

Note: If installing using a VGA monitor and USB keyboard on a Vault FW1x, FW2x, or FW4x, be sure to use a USB stick and a USB keyboard with a plug that is relatively skinny.  The 2 USB ports on the Vault are very close to each other and if either the USB stick or the USB keyboard plug is too wide, you will not be able to plug both in at the same time, which will prevent you from doing the installation.

Verify the BIOS mode

Note: There is an important issue and workaround in some versions of pfSense® CE version 2.4 due to the fact that it is based on FreeBSD 11.2. See this link. The issue affects the FW1, FW2, and FW4A platforms. See the BIOS Compatibility table at the bottom of this article. If UEFI is required, follow the steps below to set UEFI mode.

• Verify the Vault is powered down
• Verify the monitor is connected
• Verify the USB keyboard is plugged in (you can skip this step if you are using the serial installer)
• While powering up the Vault, press “DEL” key and verify that it boots to the BIOS.

• Select “Advanced” tab

• Select “CSM Configuration”

• Select “Boot option filter”

• Select “UEFI only”
• Press RETURN then “F4” to save and exit the BIOS
• Power off the unit

Install pfSense® Operating System on the Vault

• Insert the USB installation drive into the USB port on the Vault
• While powering up the Vault, press “F11” key and verify that it boots to the BIOS boot options screen.

NOTE: If using the serial installer, F11 commonly will not show the boot options menu.  In this case, use the “DEL” key to enter the BIOS.  In the BIOS, a specific boot device can be chosen from the “Save & Exit”, or rightmost tab.

• Select the USB drive UEFI partition to boot from if UEFI was configured, else just select the USB drive
• Verify the Vault boots and begins the installation process
• Follow the on screen installation prompts to install pfSense® CE

For detailed installation information, see the procedures presented on the pfSense® CE website at this link.

pfSense® CE Dashboard

For more detailed configuration instructions, the documentation page at: https://docs.netgate.com/pfsense/en/latest/index.html

Once rebooted, the Vault should be up and running. Follow any on screen instructions for logging in to pfSense® CE.  

If you experience any issues, please feel free to reach out: support@protectli.com.

BIOS Compatibility

The table below shows the compatibility of tested releases of pfSense® CE and BIOS on each of the Vaults.