WireGuard, OpenWrt & pfSense

  • Thread starter Thread starter JB701
  • Start date Start date
  • Replies Replies 5
  • Views Views 3,229

JB701

🇵🇸🤝🇮🇳
Messages
2,391
Location
Kochi, KL
ISP
Airtel
1. WireGuard is a VPN Protocol that is very lightweight and performs very well even on weak devices unlike much heavier OpenVPN. This is why many VPN Providers are offering WireGuard as an option since its usually much faster and consumes less battery on battery powered devices. WireGuard is also less prone to disconnections compared to OpenVPN. SBCs like in Raspberry Pi can give very good speeds on WireGuard whereas OpenVPN will struggle with encryption/decryption especially without AES-NI (found on newer CPUs).

2. OpenWRT is a Linux based firewall/routing software that is much more customizable compared to default consumer router software.
It's not as fancy as PFSense but it is very lightweight and can be installed on many regular routers. It unlocks many stuff in normal routers that is typically found in much more expensive routers such as IPS/IDS to look for harmful packets/stop attacks on network (though this is usually quite hard on weak CPUs), much higher control on WiFi like changing power to high levels not usually allowed in normal routers, fancier firewall rules, collecting network stats, VPN Support which might be disabled on stock software etc.

3. PFSense is FreeBSD based firewall/routing software, it is more suited towards x86/x64 CPUs unlike OpenWRT and has even more customizablity like newer Suricata IPS/IDS with much fancier graphs compared to OpenWRT's snort. While OpenWRT is suited towards really low end routers, PFSense is more suited towards full fledged computers. PFSense is most suited for things like OpenVPN,IDS/IPS because its usually installed on faster computers. Though there are ARM based routers/firewall which run on PFSense like SG-1100, these are typically suited for small networks and you can't run things like Suricata, OpenVPN without maxing the CPU.

Sources:


I would suggest going through these videos/channels as well:


Source


Source


Source


Source
 
Hey there!
Thanks for these videos, they are really helpful.

I want to configure something like this, basically operate a pfsense/opnsense firewall as perimeter firewall and use an external router as an AP for wi-fi. I have one doubt though. My setup and steps look something like this with Airtel ISP, and ZTE router.

1. Enable bridge mode on ZTE.
2. Connect LAN port 4 of ZTE to my laptop's ethernet port running pfsense/opnsense as a VM.
3. Configure the interfaces and PPPoE on pfsense/OPNsense.
4. Now, since a laptop has only 1 Ethernet port, I'll use a USB to Ethernet converter to connect laptop to the TP-Link router.
5. LAN from my USB to ethernet converter goes into the WAN port of TP-Link.

I have a doubt and am confused if step 5 would work? Will I be able to broadcast Wi-Fi in this manner, given that I am not using a dedicated switch? Although the TPLink in itself also works like a switch too, but I am still confused.

P.S. - Wi-Fi is very importnat to me, since almost everything will connect via Wi-Fi.
Also, please correct me if any of the above steps are wrong, or if I am missing something.

Thanks in advance! 🙂
 
TP-Link router acts as access point correct?

With a network switch you might be able to use vlans to create a router on a stick without needing USB to ether net adapter. USB ether net adapters can have performance, driver issues and aren't meant to run 24/7.

Router on a stick method using a managed switch in between requires you to have ethernet card which supports vlans on the laptop though but most do.


Source
 
Yes, that's right, TP-Link acts as an AP.
Actually I am not plannning on buying a switch and want to keep things simple, with 2 routers and a spare PC, and now a swtich on top that , everything would get quite messy in my room.

I understand the USB adapter thing, but will my configuration work?
 
I was loooking for a switch on Amazon, and found a cheap one here, will this work? It's unmanaged though, not sure if this is the right choice.
I can use this, if the USB adapter thing fails in the long run.
 
I'm not sure, there are reports of USB to ether net working fine but drivers are always a bit iffy along with irregular speeds.

 


Top