Pfsense/OPNsense with Airtel?

[Ashbro]

Is anyone here using a pfsense/opnsense firewall?

If yes, could you please elaborate on your setup. Example: is it running on a raspberrypi, or a spare laptop/PC or something else.

Thanks.

 

[Chip]

@Ashbro I am dual booting both. They are simple to set up with just the basic functions, in case you are not familiar with router setup process there's a wizard that guides you through the basics. If you have specific question(s) please ask.

I do not believe there's a step by step procedude detailed on this forum that helps noobs. But you can visit either pfSense and OPNSense documentation on their website for details on basic and advanced options. The firewall software is powerful and flexible too, way more so than the normal household WiFi routers that most use.

PS - I am running it on a spare old PC but I am thinking of alternatives that use less power.

 

[Ashbro]

Thank you for your response!
Configuration of pfsense/opnsense I can handle with the documentation and YT tutorials.

I was also thinking how my overall setup would look like?
I suppose it would be ISP Router (which would now act as a modem only) -> OPNSense -> external router (TP-Link in my case, to broadcast the wifi network). Is my understading right or am I missing/wrong about seomthing?

Also, will it be possible to discuss this with you on a phone call or probably on discord?

 

[Chip]

@Ashbro the way I have configured my network (with CAT6 cabling as a "back haul" in the home) is as follows:

Airtel/TPBB -->pfSense/OPNSense -->LAN switch/WiFi APs-->LAN or WiFi Clients

pfSense WAN connections are set for load balancing and fail over functions. In addition I have installed Snort and Suricata on pfSense and OPNSense respectively. There are plenty of setup instructions available on YT and on other sites, but if you need authoritative help visit the help pages or even the forums where some of the development/design staff visit and offer help frequently.

After having dual booted both I prefer pfSense for ease of configuration and operation.

 

[WieldyBinkie]

@Chip Do you have a snort vrt subscription?

 

[Chip]

@WieldyBinkie yes I do. A personal subs is about ~$30/year.

 

---

[WieldyBinkie]

@Chip Is it really worth it? What about ETPro?
And do you get full bandwidth with snort?

 

[Chip]

@WieldyBinkie to me it is, YMMV of course. ET Pro is very very expensive and mostly targeted at corporates not individuals.
Any IPS/IDS may have an impact (depending on the machine) otherwise how will it do it's job? Ditto for firewalls, AV scanners on PCs etc. There's always a small tradeoff when you choose security solutions.

 

[WieldyBinkie]

@Chip Got it. And one last thing, I’ve read somewhere that snort doesn’t support multithreading and suricata does. Do you see any difference in performance?

 

[Chip]

Yes, Snort was single threaded and Suricata is multi threaded. Works best on multi core processors. However Snort 3 is multi threaded. Read more here: Snort 3

What do I prefer? Snort. Why? Only because it works flawlessly with pfSense. I have not tried Suricata on pfS but only on OPNSense which I boot into rarely. I have not done any meaningful comparison yet because TBH I don't really care. There may be detailed comparisons elsewhere on the 'net. Snort, Suricata and pfBlockerNG require additional configuration and fine tuning which you can get on the appropriate forum. I assume you are familiar with the basics of firewalls, routers, network configuration etc. If you have a specific query please feel free to ask.

 

[WieldyBinkie]

I am probably gonna switch to pfsense once I get hold of the hardware (shipping time from China is bad now). I have it running on a vm, getting my feet wet before I dive in. I was particularly curious about snort because I tried it once on OpenWRT and couldn't get it to work properly. Anyway thanks for the info, I'll ask if I get stuck with something.

 

[WieldyBinkie]

@Chip Hey, got my box yesterday. I am having an issue with my access point not being able to connect with the internet (kinda). I have a few static mappings for my main devices that work fine with the main AP connected directly to pfsense but on the secondary ap (using WDS relay) these devices get the set static IPs but the internet won't work. If I enable private mac on my phone I get an IP from DHCP pool and the internet works from secondary IP. Is this because I don't have pfsense configured correctly?

P.S. I was able to make this setup work on OpenWRT.

 

[Chip]

@WieldyBinkie I think for wireless devices just let them use private MAC IDs...don't do fixed client IP reservations/mappings unless you really need them. If you do, then switch off private MAC in your devices because I understand it is randomly generated and can change. Each time it changes your router will think it's a new device. So you choose one or the other.

I use static IP for just 5 devices including my desktop, the printer and 3 APs all connected via LAN cable. All wireless devices use private MAC.

 

[WieldyBinkie]

@Chip Actually, clients with static IP work on the main ap, but on the second ap I get assigned static IP on my devices but no internet. I have to turn on private mac to overcome static IP and get an IP from DHCP pool to get the internet working

Btw, do you know how to install stock firmware on archer a6(openwrt).

 

[Lolita_Magnum]

The easiest way would be to flash the Stock Firmware, you will be put into kernel mode (DHCP won't work you need to use your default router IP, TP-Link one). It will ask you to flash firmware, and flash the stock firmware again. Done.