pfSense® CE

pfSense IPSec VPN Performance

Overview

Depending on individual use cases, different hardware firewalls may be useful for different types of network applications and as such, Protectli offers different hardware with varying capabilities.  Frequently, it is useful for a customer to know the performance characteristics of specific hardware before making a decision to purchase.  This article aims to provide a baseline of IPSec performance for several different Vaults, as tested in a lab environment, so the customer can make an informed decision as to what products best suit their needs.

Basic Performance

In a basic setup, The Vault is capable of routing packets at wire speed on all ports for all models. For a 1 Gbps ethernet interface, the actual data throughput is ~940 Mbps due to overhead in an IP packet. The test network consists of 2 computers running Ubuntu 20.04.1 version of Linux and 2 Vaults running pfSense® CE version 2.4.5_1. One of the Ubuntu computers is running iperf3 as a server, the other is running iperf3 as a client.

IPsec

IPsec is a set of protocols that is used to authenticate and encrypt/decrypt packets to provide secure transport of packets through the network. An IPsec “tunnel” encrypts the entire packet, not just the payload, and is commonly used to create Virtual Private Networks (VPN).

Configuring IPsec

When configuring IPsec tunnels (and other secure connections) multiple parameters must be configured. The set of parameters is known as a “cipher suite”. The parameters consist of a Key Exchange method, an Encryption method and a Message Authentication method. The configuration must be identical at each end of the tunnel in order to make a connection. An operating system or IPsec implementation will typically support multiple ciphers for each of Key Exchange, Encryption, and Message Authentication that can be combined to form many different cipher suites. OpenSSL, which is an open source software library, provides a large number of ciphers. The list of ciphers supported can be displayed with the command “openssl ciphers –v”. The cipher suite is described by combining the methods together into a single string. For example, the cipher DH-RSA-AES256-SHA256 indicates:

Diffie-Hellman (DH) Key Exchange using a Rivest, Shamir, Adelman key (RSA) with 
Advanced Encryption Standard 256 bit (AES256) encryption 
and Secure Hash Algorithm 256 bit (SHA256) message authentication.

There are various standards and recommendations that dictate the required cipher suite for different applications that is beyond the scope of this article.

The diagram below shows an IPsec tunnel. The difference between the LAN example above and the IPsec tunnel is that the entire packet is encrypted “end-to-end” between the Vault/Firewalls and the data can travel through the network securely.

IPsec Performance

Adding an IPSec tunnel introduces “overhead” which is added when a packet enters a tunnel and stripped off when a packet leaves the tunnel. This process adds additional data to each packet, but is not part of the payload. Therefore, when running performance measurement tests, the indicated traffic throughput will be less than throughput achieved without an IPSec encrypted tunnel. In addition to the pure impact on the payload due to additional overhead, the device that adds the overhead must also encrypt the data. Similarly, the device at the other end of the tunnel receiving the packet must decrypt the data before sending it onward. Encryption and decryption of the packet requires significant processing power and affects the throughput of the devices. The latest versions of The Vault include Intel’s AES-NI hardware support which facilitates faster encryption/decryption with less impact on CPU performance. The performance varies depending on the parameters of the many different cipher suites. For example, a cipher suite that uses AES128 may perform better than AES256 due to easier encryption/decryption. It would be difficult if not impossible to test all possible cipher suites. For this purpose, a variety of different iterations have been tested, including ones that are not optimal in terms of performance, or commonplace. In order to test performance, pfSense® CE 2.4.5_1 was installed on the Vaults and IPsec tunnels were configured with the following initial cipher suite which provided the most optimal results found across all platforms:

Phase 1 settings:

• Diffie Hellman (DH) Key Exchange using Pre-Shared Key (PSK)
• AES128 bit encryption algorithm with AES-XCBC for the hash

Phase 2:

• AES128-GCM with 128 bit key length for the Algorithm
• No hash (Not indicated, AES-GCM provides authentication)

The configuration pages for VPN > IPSec > Tunels are shown below.

In this example, data from LAN network 192.168.50.0 is “tunneled” to LAN network 192.168.60.0 over the WAN interface. In the reverse direction, data from LAN network 192.168.60.0 is “tunneled” to LAN network 192.168.50.0 over the WAN interface. The max throughput as tested over the IPsec tunnel for a 1 Gbps Ethernet interface is ~880 Mbps, which is expected due to the overhead added by the IPsec configuration. The results of performance tests run on the Vaults that contain AES-NI hardware support are shown in the table below.

For more detailed information on the performance results, please click  on the link: IPSec Performance Sheet

Configuration Files for IPSec Performance Testing

Provided is the configuration files for both the IPSec server and IPSec client to be used for performance testing purposes. Please note that configuration changes will have to be made for the IPSec tunnel depending on the WAN IP address issued via DHCP.

Conclusions on IPSec Performance

IPsec is a critical set of protocols used to provide secure communication through the Internet.  There are many different cipher suites that can be used depending on the requirements of the user. The configuration used may impact the performance and therefore the throughput of the devices in the network. This tutorial is an aid to selecting the best Vault for your application. If you have any questions, feel free to reach out to us! You can submit a ticket here, find more information in our Knowledge Base, or visit the pages at IETF as reference.

Overview

pfBlockerNG is a very powerful package for pfSense® which provides advertisement and malicious content blocking along with geo-blocking capabilities.

Installing pfBlockerNG

• Access the pfSense WebGUI (default 192.168.1.1)
• Click on the System tab, then Package Manager

• From the Package Manager menu select the Available Packages tab
• Scroll down and find pfBlockerNG-devel and click Install

• Verify pfBlockerNG is now installed by going to the Firewall drop down menu
• Open the pfBlockerNG menu and start the wizard

• At the Component Configuration page of the wizard select the WAN interface for inbound. For outbound typically LAN is used. CTRL+Click any additional interfaces you want included.
• Leave the DNSBL default
• Click Finish and allow pfBlocker to update
• If you would like multiple LAN segments to be included in with DNSBL check the setting Permit Firewall Rules and select the interface (ctrl+click) you would like included.

• By Default pfBlockerNG will setup basic advertisement and IP blocking from defaults feeds
• We recommend also including the DNSBL feed from BBcan177(creator of pfBlockerNG) as well as the Cryptojackers feed

• Add by clicking the + next to the feed name
• In the feed configuration click Enable All and change Action to Unbound
• Click Save DNSBL Setting

• Repeat this process for any other feeds you would like to add

• Once the feeds are added, it is important to reload and update

• Now browse a few websites and then check the pfSense dashboard to verify the pfBlockerNG widget is showing data

You might come across false positives possibly breaking certain sites. The solution is adding addresses to a Whitelist

• To add an item to the whitelist access the pfBlockerNG Reports either by clicking on one of the packet stats (arrow below) or through the pfBlocker menu

pfBlocker also has built in GeoIP blocking. This allows you control over geographic regions connecting to your network. You can find this in the pfBlockerNG menu under IP>GeoIP. Careful blocking too much, websites host content and media on servers around the world. Unintentionally blocking some of these IP addresses could result in broken sites or unavailable downloads.

You should now have network wide advertisement and malicious content blocking. If you need additional assistance, please feel free to reach out: support@protectli.com. You can find more information about pfSense on the Vault in our Knowledge Base, or at pfSense.org

Overview

This article covers how to enable a LAN bridge in pfSense®. LAN bridge act as a switch using the optional ports on the Vault. While not optimal compared to using a separate physical switch, it works if needed.

Note: If the port being used for the web interface is added to the bridge, then physical access to the unit will be necessary.

How to Create a LAN Bridge in pfSense®

In this example we will be assigning the LAN interface to a bridge utilizing the Vaults additional ports, OPT1 and OPT2. The idea of this example can be used across all the Vault models with small variation.

• Access the webGUI. The default IP address: 192.168.1.1, username: admin, password: pfsense
• Verify the Vaults optional interfaces(OPT1, OPT2, etc) are assigned with default settings.
• To assign simply click Add next to the port you wish to assign. Click Save.

• To enable the each interface, click the on the interface label(OPT1,OPT2,etc) in the left column.
• Click Enable, leave all other settings default. Save and Apply Changes

• In the Interfaces menu select the Bridges tab and click Add
• Select OPT1 and OPT2 using Ctrl+Click. Don’t select the LAN interface. Click Save.

• Navigate back to the Interface Assignments tab and change the LAN interface port to BRDIGE0
• Note: At this point once the settings are saved the web interface connection will be lost. Swap the Ethernet connection to one of the optional ports(OPT1,OPT2) added into the bridge to regain access

• Assign the port previously used as LAN to OPT3 and enable it as done in the steps earlier
• Navigate back to the Bridges menu and add(Ctrl+Click) OPT3. Save
• Navigate to System > Advanced > System Tunables
• Select net.link.bridge.pfil_member and change its value to 0. Save
• Select net.link.bridge.pfil_bridge and change its value to 1. Save

• Click Apply Changes at the top

• Reboot
• Verify bridged ports are functioning

At this point you should have a functioning LAN bridge in pfSense®. If you need additional assistance, please feel free to reach out: support@protectli.com. You can find more information about pfSense on the Vault in our Knowledge Base, or at pfSense.org

Overview

This article covers how to enable the Vaults optional ports in pfSense®. We have included configuration files in the table at the bottom of the page. These configuration files have the ports assigned and functioning with default firewall rules and DHCP enabled.

Note: These configuration files have the default admin password retained. The additional ports assigned use default firewall rules, same as what pfSense® configures for the LAN port.

Configuring Optional Ports

This article covers how to configure the Optional Ports in pfSense® CE. The Optional Ports are labeled “OPTx” on the Vault. The configuration has the same type of default settings as the LAN port.  Those settings include:

• An IP Address of 192.168.x.1
  • OPT1 192.168.2.1
  • OPT2 192.168.3.1
  • OPT3 192.168.4.1 (FW6 only)
  • OPT4 192.168.5.1 (FW6 only)
• Enabling the OPT port to be a DHCP Server
• Firewall rules to allow “Any” traffic originating on this port to pass without being blocked

Configuring Optional Ports – IP Address

• Browse to the pfSense® CE Dashboard, default 192.168.1.1 on the LAN port
• Navigate to the Interfaces tab and select Assignments from the drop down menu

Interface->Assignments

• Verify the Interface Assignments page is displayed and add the next available interface

Interfaces->Interface Assignments

• Verify OPT1 is added and Select Save

Interface->Interface Assignments OPT1

• Select OPT1

Interfaces->Interface Assignments->OPT1 Select

Verify the OPT1 General Configuration page is displayed and configure as follows:

• General Configuration->Enable – Check the box
• General Configuration->IPv4 Configuration Type – Select Static IPv4
• Static IPv4 Configuration>IPv4 Address – Set 192.168.2.1 /24
• Select the Save Button

Interfaces->OPT1 Configure

• Verify the OPT1 Configuration has been changed and Apply Changes

Interfaces->OPT1 ApplyChanges

• Verify changes have been applied successfully

Interfaces->OPT1 Success

Configuring Optional Ports – DHCP Server

• Navigate to the Services tab and select DHCP Server from the drop down menu

Services->DHCP Server

• Verify the Services->DHCP Server page is displayed and Select OPT1

Services->DHCP Server Select OPT1

Verify Services->DHCP Server->OPT1 page is displayed and configure as follows:

• General Configuration->Enable – Check the box
• General Configuration->Range – 192.168.2.100 to 192.168.2.199

Services->DHCP Server Configure OPT1

• Select the Save button and verify the changes have been applied successfully

Services->DHCP Server OPT1 Success

Configuring Optional Ports – Firewall Rules

• Navigate to the Firewall tab and select Rules from the drop down menu

Select Firewall->Rules

• Verify the Firewall Rules page is displayed and Select OPT1

Firewall->Rules Select OPT1

• Verify Firewall OPT1 page is displayed and select the Add Button

Firewall->Rules OPT1 Add Rule

Verify Firewall->Rules->Edit for OPT1 page is displayed and configure as follows:

• Edit Firewall Rule->Action- Pass
• Edit Firewall Rule->Interface- OPT1
• Edit Firewall Rule->Address Family – IPv4
• Edit Firewall Rule->Protocol – Any
• Save the changes

Firewall>Rules Configure OPT1

• Verify the configuration and Apply the changes

Firewall->Rules->OPT1 Apply Changes

• Verify success message

Firewall->Rules->OPT1 Success

OPT1 has now been configured with static IP address 192.168.2.1, it is a DHCP server, and any traffic coming into this port is allowed to pass.

Configuring Optional Ports – Verify Configuration

OPT1 has been configured so it needs to be tested to verify the configuration changes are correct. Follow the instructions below to test the changes:

• Connect a PC to OPT1
• Verify the PC gets an IP address in the range of 192.168.2.100-199
• From the PC, browse to a site outside of the local network
• Verify an external web page is displayed correctly on the PC

At this point OPT1 is up and running. To configure OPT2 repeat the same steps as OPT1, but use IP address 192.168.3.1. For an FW6 with OPT3 and OPT4, repeat the same steps using IP addresses 192.168.4.1 and 192.168.5.1.

Configuration Files

The steps above were described to manually configure the Vault as indicated. It is important to understand the steps required, however, it is very convenient to load a configuration file rather than manually configure each item.

We have included configuration files in the table at the bottom of the page. These configuration files have

• Thermal Monitoring Enabled
• Cryptographic Hardware Support Enabled
• Power Management Enabled
• OPT Ports Enabled with Static IP Address, DHCP Server, and Basic Firewall Rule

Note: These configuration files have the default admin password retained. The additional ports assigned use default firewall rules, same as what pfSense® configures for the LAN port.

How to Restore a Config File

• Verify pfSense® has been installed correctly
• Verify the correct configuration file has been downloaded from the table below and pfSense® will be able to access it
• Log into the WebGUI. This is 192.168.1.1 by default.
• The default pfSense® login user is ‘admin’ and password is ‘pfsense’
• Click Diagnostics on the top of the GUI
• From the drop-down menu click Backup & Restore

• Click Choose File
• Select the appropriate config, click open
• Click Restore Configuration

• Verify the Vault reboots
• Log back into the WebGUI with the default credentials
• Verify OPT1 and OPT2 (OPT3 /OPT4 additionally on the FW6x) now appear on the Interfaces widget

• It is now recommended to change the default ‘admin’ password
• Verify the newly assigned ports are functioning and DHCP is handing out IP addresses

If you experience any issues, please feel free to reach out: support@protectli.com. You can find additional information in our Knowledge Base, or reference pfsense.org directly.

Configuration Files

Overview

Depending on individual use cases, different hardware firewalls may be useful for different types of network applications and as such, Protectli offers different hardware with varying capabilities.  Frequently, it is useful for a customer to know the performance characteristics of specific hardware before making a decision to purchase.  This article aims to provide a baseline of OpenVPN performance for several different Vaults, as tested in a lab environment, so the customer can make an informed decision as to what products best suit their needs.

Basic Performance

In a basic setup, The Vault is capable of routing/switching packets at wire speed on all ports for all models. For a 1 Gbps ethernet interface, the actual throughput is ~940 Mbps due to overhead in an IP packet. The test network consists of 2 computers running Ubuntu 18.04 version of Linux and 2 Vaults running pfSense® CE version 2.4.3. One of the Ubuntu computers is running iperf3 as a server, the other is running iperf3 as a client.

IP LAN

OpenVPN

OpenVPN is a set of protocols that is used to authenticate and encrypt/decrypt packets to provide secure transport of packets through the network. An OpenVPN “tunnel” encrypts the entire packet, not just the payload, and is commonly used to create Virtual Private Networks (VPN).

Configuring OpenVPN

When configuring OpenVPN tunnels (and other secure connections) multiple parameters must be configured. The set of parameters is known as a “cipher suite”. The main parameters for OpenVPN consist of an Encryption method and a Message Authentication method. The configuration must be identical at each end of the tunnel in order to make a connection. With OpenVPN, one side of the tunnel is the “server” and the other end is the “client”. Multiple clients can be connected to a single server for a hub and spoke type of architecture.

The diagram below shows an OpenVPN tunnel. The difference between the LAN example above and the OpenVPN tunnel is that the entire packet is encrypted “end-to-end” between the Vault/Firewalls and the data can travel through the network securely.

OpenVPN Tunnel

OpenVPN Performance

Adding an OpenVPN tunnel introduces “overhead” which is added when a packet enters a tunnel and stripped off when a packet leaves the tunnel. This process adds additional data to each packet, but is not part of the payload. Therefore, when running performance measurement tests, the indicated traffic throughput will be less than throughput achieved without an OpenVPN encrypted tunnel.

In addition to the pure impact on the payload due to additional overhead, the device that adds the overhead must also encrypt the data. Similarly, the device at the other end of the tunnel receiving the packet must decrypt the data before sending it onward. Encryption and decryption of the packet requires significant processing power and affects the throughput of the devices. The latest versions of The Vault include Intel’s AES-NI hardware support which facilitates faster encryption/decryption with less impact on CPU performance.

The performance varies depending on the parameters of the many different cipher suites. For example, a cipher suite that uses AES128 may perform better than AES256 due to easier encryption/decryption. It would be difficult if not impossible to test all possible cipher suites.

In order to test performance, pfSense® CE 2.4.3 was installed on the Vaults and OpenVPN tunnels were configured with the following cipher suite:

• AES256 bit encryption algorithm with 128 bit blocks using the Cipher Block Chaining mode (CBC) operation
• Secure Hash Algorithm (SHA) 256 bit Message Authentication

The main configuration page for VPN->OpenVPN->Servers is shown below.

OpenVPN Server

The main configuration page for VPN->OpenVPN->Clients is shown below.

OpenVPN Client

In this example, data from LAN network 192.168.10.0 is “tunneled” to LAN network 192.168.20.0 over the WAN interface. In the reverse direction, data from LAN network 192.168.20.0 is “tunneled” to LAN network 192.168.10.0 over the WAN interface. The results of performance tests  run on the Vaults that contain AES-NI hardware support are shown in the table below.

Conclusions for OpenVPN Performance

OpenVPN is a critical set of protocols used to provide secure communication through the Internet.  There are many different cipher suites that can be used depending on the requirements of the user. The configuration used may impact the performance and therefore the throughput of the devices in the network. This tutorial is an aid to selecting the best Vault for your application.

As always, if there are any questions, feel free to reach out to us! You can submit a ticket here, find more information in our Knowledge Base or check OpenVPN.net as reference.