Kitz Forum

Computers & Hardware => Networking => Topic started by: Ronski on November 26, 2016, 08:58:22 PM

Title: Ronski's Pfsense router build
Post by: Ronski on November 26, 2016, 08:58:22 PM
I have for a long time been wanting something with a better firewall than a bog standard router, and having seen Chrysalis build decided to build a Pfsense router myself.

I've decided to use a Qotom QOTOM-Q190G4-S02 Mini PC (http://www.qotom.net/goods-129-QOTOM-Q190G4+4+LAN+Mini+PC.html), which has 4 Intel LAN ports, the S02 version will take a 2.5" SSD, the S01 version is slightly smaller, and only takes an Msata drive

Purchased from Amazon (https://www.amazon.co.uk/dp/B01GBHC62K/ref=pe_385721_37986871_TE_item), cost is 130.90 + 16 shipping
I've also ordered 8GB of memory (https://www.amazon.co.uk/gp/product/B00VMCUAIM/ref=oh_aui_detailpage_o00_s00?ie=UTF8&psc=1), 4 should of been plenty, but at 30 it was not much more than 4GB.
I have a 80GB Intel SSD which is spare, so will be using this as storage.

There's a thread on the PFsense forums (https://forum.pfsense.org/index.php?topic=114202.0) with quite a lot of useful info.

I've never used Unix/Linux before so this might be a bit of a learning curve, hopefully it will all go well.

Edit.

Install guide is here (http://forum.kitz.co.uk/index.php/topic,18987.msg339029.html#msg339029), which I documented as I went along with a lot of help from Chrysalis and others.

When taking the case apart make sure you undo the screws on the base, not the sides. Only minor problems I've noticed is the Sata cable is very tight against the side, and when installing the drive, hopefully it will be OK. I also had to use a USB lead to plug my USB thumb drive into as there are only two ports and they are close together.

Some pictures of the hardware.

(https://forum.kitz.co.uk/proxy.php?request=http%3A%2F%2Fi672.photobucket.com%2Falbums%2Fvv87%2FRonskiman%2FComputer%2FPfsense%2FP1030108_zpsjukji6av.jpg&hash=3ccf6ded97405da521e1d98f4c1b04ae) (http://s672.photobucket.com/user/Ronskiman/media/Computer/Pfsense/P1030108_zpsjukji6av.jpg.html)

(https://forum.kitz.co.uk/proxy.php?request=http%3A%2F%2Fi672.photobucket.com%2Falbums%2Fvv87%2FRonskiman%2FComputer%2FPfsense%2FP1030109_zps3cw31mx5.jpg&hash=2c1791daac19d12b89fa4d5ef471b4d0) (http://s672.photobucket.com/user/Ronskiman/media/Computer/Pfsense/P1030109_zps3cw31mx5.jpg.html)

(https://forum.kitz.co.uk/proxy.php?request=http%3A%2F%2Fi672.photobucket.com%2Falbums%2Fvv87%2FRonskiman%2FComputer%2FPfsense%2FP1030110_zpsbz3kpa7w.jpg&hash=93bd19058ff870dfc628a4f6569e64bb) (http://s672.photobucket.com/user/Ronskiman/media/Computer/Pfsense/P1030110_zpsbz3kpa7w.jpg.html)

(https://forum.kitz.co.uk/proxy.php?request=http%3A%2F%2Fi672.photobucket.com%2Falbums%2Fvv87%2FRonskiman%2FComputer%2FPfsense%2FP1030111_zpsahmeaitv.jpg&hash=074165d7330fd65e47f7fa2114a204cc) (http://s672.photobucket.com/user/Ronskiman/media/Computer/Pfsense/P1030111_zpsahmeaitv.jpg.html)

(https://forum.kitz.co.uk/proxy.php?request=http%3A%2F%2Fi672.photobucket.com%2Falbums%2Fvv87%2FRonskiman%2FComputer%2FPfsense%2FP1030112_zpsrn7acn0b.jpg&hash=2bcee90ab111c84b73549b0788b8406f) (http://s672.photobucket.com/user/Ronskiman/media/Computer/Pfsense/P1030112_zpsrn7acn0b.jpg.html)
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on November 27, 2016, 12:59:15 AM
yeah at 30 thats a nice find, mine was 24 and the 8 gig for the same brand was 41, but I think 8 gig for 30 is a good find. :)  Rest looks good also. :)

I suggest following what I posted regarding ssd alignment and trim. :)
Title: Re: Ronski's Pfsense router build
Post by: Chunkers on November 27, 2016, 05:05:51 AM
This is cool, I think @Chrysalis and @skyeci have a lot to answer for ...

I like your choice of unit, 4 LAN intel LAN ports, 2Ghz quad core and 8 Gb RAM with only 10W power consumption seems almost too good to be true!  I like how it has a VGA out so you don't need to faff around with serial comms like I will with the APU2 I have bought.

Look forward to seeing how you get on, as far as I am concerned the more people using pfSense on here, the more likely I will be able to get some help!

I have never installed the FreeBSD flavour of Unix before either but I have installed Linux on lots of different things and have generally found it to be really easy, easier than Windows even, due to its wide compatibility and tolerance of old / legacy hardware and the abundance of helpful people on forums  ;) .

Good luck, keep us posted!

Chunks
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on November 27, 2016, 06:08:07 AM
Is the apu2 serial out only?

Mine has dual hdmi, I never went with the apu2.

In terms of overall value, ronski I would say has picked the best unit tho assuming of course it actually works, on mine I have already removed the wireless card (which by the way is not  detected by pfsense), so if I add the intel nic's the mini pcie is already empty ready for use. Also the bios on my unit is enterprise stuff, lots of options I typically only have seen on server motherboards.

If I had found ronski's unit first before finding mine, would have I ordered it? I was specifically looking for a aesni cpu, but given the price and the inclusive 4 intel lan ports I think I would have done.  I did a bench on my unit which I posted the results in my thread, and even with aesni disabled its more than a dozen times faster than high end consumer routers on the market, and this unit ronski picked has more raw horsepower than mine.

Both units are significantly faster than the apu2 tho, so I am no longer feeling bad I skipped on the apu2 especially as I can simply add a mini pcie to get native intel ports, as serial access only would bug me.
Title: Re: Ronski's Pfsense router build
Post by: Chunkers on November 27, 2016, 07:26:50 AM
Is the apu2 serial out only?

Yep, so you need to add the cost of a null modem cable / serial interface if you don't have already, plus its faffy

In terms of overall value, ronski I would say has picked the best unit tho assuming of course it actually works, on mine I have already removed the wireless card (which by the way is not  detected by pfsense), so if I add the intel nic's the mini pcie is already empty ready for use. Also the bios on my unit is enterprise stuff, lots of options I typically only have seen on server motherboards.

Found this on arstechnica forum (http://arstechnica.com/civis/viewtopic.php?f=2&t=1327591) discussing the QOTOM unit :

Quote from: Some Random Dude
Also, I've used the Qotom system mentioned in the article. Specifically, I've used the Qotom Q190G4. Beware that while it's advertised as having a mini PCI-Express on-board expansion slot for a wireless card, it actually has a plain mini PCI slot. Consequently, the Q190G4 is not suitable for use as a high performance wireless router.

If I had found ronski's unit first before finding mine, would have I ordered it? I was specifically looking for a aesni cpu, but given the price and the inclusive 4 intel lan ports I think I would have done.  I did a bench on my unit which I posted the results in my thread, and even with aesni disabled its more done a dozen times faster than high end consumer routers on the market, and this unit ronski picked has more raw horsepower than mine.

Both units are significantly faster than the apu2 tho, so I am no longer feeling bad I skipped on the apu2 especially as I can simply add a mini pcie to get native intel ports, as serial access only would bug me.
Yep, when I add the pennies up I think I would have been better getting a QOTOM unit as it seems much more powerful than an APU2 unit and just as power efficient - I am pretty sure the APU2 will more than meet my needs however.

Chunks
Title: Re: Ronski's Pfsense router build
Post by: skyeci on November 27, 2016, 10:33:12 AM
Serial interface on the apu2 works fine and you only need it on the first install, but handy of course in case something totally fails. I used a 9 cable from amazon. Usb stick serial install etc..
Never seen the cpu more than 23% so far on the odd chance  it actually gets any stress  ;D
Title: Re: Ronski's Pfsense router build
Post by: d2d4j on November 27, 2016, 11:56:30 AM
Hi

I hope you do not mind, but as we use pfsense along with other firewalls/systems I thought I would show you some stats from 1 of our installations (certain details have been deleted) as below

Many thanks

John

This Month (to date, does not include this hour, starting at day 01):

Bandwidth

In 329490 MBytes
Out 4146200 MBytes
Total 4475690 MBytes

Last Month:

Bandwidth

In 424860 MBytes
Out 5274777 MBytes
Total 5699637 MBytes
Title: Re: Ronski's Pfsense router build
Post by: Ronski on November 27, 2016, 07:06:07 PM
@Chrysalis I will certainly follow your advice. Hopefully everything will arrive OK, and be OK, always a possibility something may be iffy on these lower than the norm priced items.

I will also do some benchmark tests but you'll have to explain how.

The trouble I've found with Linux, from my Android experience and what my brother says is that it might as well be written in Chinese (commands and string just seem to be random characters), and what people have often written on forums assumes the reader knows what they are on about.

Memory should be here tomorrow, but the PC is estimated to arrive on 9 December, still gives me plenty of time to watch the rest of those videos and read up and get stuff ready.

I'm not planning on putting a wireless card in it, I may just rely on my AC AP which is in the loft or get another AP for downstairs if coverage is not good enough, at the moment my modem/router also has wi-fi so coverage is good.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 02, 2016, 01:13:48 PM
The memory arrived Monday,  and the Qotom PC arrived this morning. It was shipped from the Netherlands so no import duty.it looks good and feels solid, and even has a uk power cable.

I'll post some pictures as things progress.

Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 03, 2016, 09:33:15 PM
@Chrysalis I have PFsense installed and I'm looking at the options screen, the one with options 1 to 16.

ok some information for those using pfsense with an ssd.

The pfsense devs are using an old way to configure partitions, in short they -

dont enable trim
dont align partitions to 4k alignment
and they also enable SUJ which I think is best disabled on an ssd.

to fix the alignment follow this guide https://forum.pfsense.org/index.php?topic=86139.0
if you try to do it all manually pfsense will rewrite the partitions, but I have confirmed the above guide does lead to a 4k aligned partition.

Now this is what I mean about it might as well be in Chinese, you say follow the guide, but all the link basically says is to run a couple of commands, it doesn't say when or where?
Actually it says he did that before using advanced install, which would make sense but not where or how?

Could you perhaps give some clearer instructions for a complete noob to this please and the following, assume I know nothing  :)

Quote
The commands to enable trime and disable soft updates journaling are.  (assuming the ssd is on ada0, which it will be if its the only sata device)

Code: [Select]
tunefs -t enable /dev/adas0p1
tunefs -j disable /dev/adas0p1

Less important is to have the swap on a swapfile not partition as the partition wont utilise trim, but I think its unlikely a pfsense box with at least 4 gig of ram will even use the swap.

bottom of this page is a couple of commands to make the swapfile http://www.wonkity.com/~wblock/docs/html/ssd.html

so

Code: [Select]
mkdir /usr/swap (although can be put anywhere you like)
Code: [Select]
dd if=/dev/zero of=/usr/swap/swap bs=128k count=16384 (2 gig swap)

add these 2 lines to /etc/fstab

Code: [Select]
# Device        Mountpoint      FStype  Options                         Dump    Pass#
md99            none            swap    sw,file=/usr/swap/swap,late     0       0

then after run
Code: [Select]
swapon -aL

I will post those pics at some point.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 04, 2016, 12:15:33 AM
ok will do tomorrow.

for the 4k alignment tho you will need to reinstall pfsense, as that has to be done prior to completing the install.
the trim enable can be done anytime but if you dont do it before you reboot after installation to set it requires booting the system up from the rescue disk, as you cannot toggle trim when its mounted.

I also just noticed the fstab is not enough to auto mount the swap file so I need to look into that and will edit the guide.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 04, 2016, 10:48:20 AM
@Chrysalis,  Thanks, I'll look forward to it.

I need to update my switch as it only has 16 ports, so have been using the ports on the existing router.

Would the Netgear JGS524E-200EUS (https://www.amazon.co.uk/NETGEAR-JGS524E-200EUS-ProSAFE-Managed-Ethernet/dp/B00GGD10FY/ref=sr_1_2?s=computers&ie=UTF8&qid=1480847991&sr=1-2&keywords=JGS524PE) ProSAFE 24 Port Web Managed (Plus) Gigabit Ethernet Switch be a good choice?

At this moment in time I don't think I need a managed switch, but cost and power usage is not much more than say a Netgear GS324-100EUS (https://www.amazon.co.uk/dp/B01ARQWN6U/ref=twister_B00QYUSXHC?_encoding=UTF8&psc=1) 24-Port Gigabit switch.

When you start looking there are so many model's and choices, and thats just in the Netgear range  :-\
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 05, 2016, 07:13:31 PM
Sorry got tied up and right now am feeling pretty tired.

Basically when you boot pfsense from the usb stick, choose to boot to single user mode.
After thats done run the commands he provided on the shell.
When the commands have been ran typing exit if I remember correctly will cause it to boot into the installer, but if I dont remember correctly, then just reboot again and boot it normally into the installer, when at the installer you want to choose skip as much as possible on the partitioning questions, eventually you wont be able to skip anymore and then you choose the ssd partition, it will rerun partition commands, but wont completely wipe what has been set and you should end up with a 4k aligned partition.

After the installer has finished, there should be an option where you can exit to the shell, if you do that then you can run the command to enable trim.  After thats ran type reboot to reboot.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 05, 2016, 07:30:49 PM
Thanks for the info, how can I check if I have a correctly aligned partition?

Found these links, but not much info

https://forum.pfsense.org/index.php?topic=44955.0

Actually there's some info on the following page, and from that I think I can work out if it's 4k aligned.

https://dan.langille.org/2013/01/25/aligned-versus-not-aligned/

You really would think that the Dev's of Pfsense would build in 4k alignment and have trim enabled, any idea why they haven't?
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 05, 2016, 07:39:06 PM
I asked and I got a vague answer telling me to chill its been fixed in the next version of pfsense. :)

pfsense doesnt even use GPT yet either.

However gpart can be used to check if its aligned, here is what mine looks like so you can compare, you basically want to see starting sector of 504 for the partition

[2.3.2-RELEASE][admin@pfSense.localdomain]/usr/local/pkg: gpart show ada0
=>       63  117231345  ada0  MBR  (56G)
         63        441        - free -  (221K)
        504  117230904     1  freebsd  (56G)
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 05, 2016, 07:59:16 PM
OK, just tried to look at the existing alignment - see attached

Would I be correct in saying it is aligned 16 x 512 = 8192 / 4096 = 2

Although that's for ada0s1, not ada0, not quite sure what the s1 is??

Trim is not enabled, as tunefs -p / returns tunefs: trim: (-t)                   disabled (code for this was found here (https://forum.pfsense.org/index.php?topic=109384.0))
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 05, 2016, 08:04:51 PM
no is not aligned, that 16k is from the start of the first slice, but the first slice itself is not aligned.

notice you got no free space as a sandwich on the ada0
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 05, 2016, 08:20:16 PM
Just seen your edit to your earlier post and I now appear to have the same as you, with a small bit tagged on the end.

Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 05, 2016, 08:34:02 PM
Sorry got tied up and right now am feeling pretty tired.

Basically when you boot pfsense from the usb stick, choose to boot to single user mode.
After thats done run the commands he provided on the shell.
When the commands have been ran typing exit if I remember correctly will cause it to boot into the installer, but if I dont remember correctly, then just reboot again and boot it normally into the installer, when at the installer you want to choose skip as much as possible on the partitioning questions, eventually you wont be able to skip anymore and then you choose the ssd partition, it will rerun partition commands, but wont completely wipe what has been set and you should end up with a 4k aligned partition.

After the installer has finished, there should be an option where you can exit to the shell, if you do that then you can run the command to enable trim.  After thats ran type reboot to reboot.

I had to type exit twice, did custom install, chose to install bootblocks.

It's now failing at creating the swap file - Failed with a return code of 1

You've put some info here (http://forum.kitz.co.uk/index.php/topic,18944.msg338041.html#msg338041) about the swap file which I'm not sure on.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 06, 2016, 09:00:46 AM
There was some message about sufficient room, so I'm guessing because we created a partition which took up all the space it now can't create the swap file.

So I either need to go back and leave room when I setup the first partition or create both partitions at the start?
Title: Re: Ronski's Pfsense router build
Post by: roseway on December 06, 2016, 11:05:57 AM
It's normal in Unix-type systems to use a swap partition, not a swap file. I presume that what you were trying to do was create a swap partition, and there was no free space to do it. But you can optionally use a swap file instead, inside one of the already created partitions. See https://www.freebsd.org/doc/handbook/adding-swap-space.html
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 06, 2016, 12:24:21 PM
the swapfile is just so it can utilise trim as trim is not enabled on swap partitions.  It doesnt need unpartitioned space, just space on the filesystem, is best to paste the commands you running with the output.

But thats a minor issue as with 8 gig of ram ronski is not going to be using any swap anyway.

Ronski I edited the post to fix errors on the trim and SUJ commands.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 06, 2016, 01:22:49 PM
Thanks, so given I've got 8 gig of ram can I just completely skip the swap file?

Or is it still required even if unlikely to be used?

@Chrysalis    It might be a good idea to include in your post when these commands should be carried out.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 06, 2016, 02:35:18 PM
If you have the swap partition made by the installer enabled, then given the hassle you having, just leave it as it is and you will probably find it will never be utilised, but good to have just in case.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 06, 2016, 03:49:04 PM
No swap partition yet, haven't touched it since last night, will have another fiddle tonight, will try and make the swap file. Presume I need to do that at the same time as enabling trim or could it be anytime?

Only having hassle as I'm totally unfamiliar with it, grown up with Windows, and dabbled with Android, but only as far installing Roms.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 06, 2016, 05:06:40 PM
the swapfile should be whilst the system is up and running :)

so trim and disabling SUJ in single user mode
swapfile with system booted up normally
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 06, 2016, 08:12:07 PM
Well more hassle  :(

So I skipped creating the swap partition, and got to the end of the installer

At end of installer I chose <return to select task>
From there I chose Exit
Had to press Crtl-C to stop it rebooting
Then Enter to get to shell

Trying to apply the commands to enable trim results in an error - see attached  :wall:

Edit: Think I just twigged where I went wrong.....actually scrub that, it was still in single user mode
Edit: Well it boots in to Pfsense, but of course trim is not enabled
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 06, 2016, 08:44:43 PM
your ada0s1 looks weird

note mine says freebsd-ufs not a !0

[2.3.2-RELEASE][admin@pfSense.localdomain]/root/work: gpart show ada0s1
=>        0  117230904  ada0s1  BSD  (56G)
          0         16          - free -  (8.0K)
         16  113036584       1  freebsd-ufs  (54G)
  113036600    4194304       2  freebsd-swap  (2.0G)

the filesystem looks corrupt based on your output.

I left another mistake in my post tho sorry.

tune2fs -p /dev/ada0s1a

should show the partition settings, run that first to verify shows without error.

then if all looks fine run

tune2fs -t enable /dev/ada0s1a
and
tune2fs -j disable /dev/ada0s1a

based on that output of gpart I would start again tho as the !0 isnt a good sign.

sorry
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 06, 2016, 10:35:52 PM
I'll start again tomorrow, practice makes perfect  :fingers: Chunkers will be glad that we get it all sussed out for him though  ;D

On another note, the new switch (http://www.netgear.co.uk/business/products/switches/web-managed/JGS524Ev2.aspx#tab-techspecs) is ordered, and I also have a new access point on the way, a TP Link RE450 (http://www.tp-link.com/en/products/details/cat-10_RE450.html), this will be used in AP mode to serve the side of the house that doesn't get good wi-fi from my main AP.
Title: Re: Ronski's Pfsense router build
Post by: Chunkers on December 07, 2016, 04:41:55 AM


I'll start again tomorrow, practice makes perfect  :fingers: Chunkers will be glad that we get it all sussed out for him though  ;D

.

Sure will! I'm lurking......

Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 07, 2016, 06:21:35 AM
The installation of Pfsense is straightforward, it's getting the partition 4k aligned and trim enabled that's proving difficult for me.
Title: Re: Ronski's Pfsense router build
Post by: roseway on December 07, 2016, 08:01:38 AM
This may be a bit late, but it would probably be a lot easier to partition the disk using a separate utility, then install Pfsense into the already created partitions. GParted Live is a live CD or USB system which is very easy to use, and includes UFS among its list of supported filesystems.

http://gparted.org/livecd.php
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 07, 2016, 10:08:34 AM
eric the installer of pfsense will overwrite the partitions, however it was discovered by that guy on pfsense that a certain specific partition config was honoured by the pfsense installer, which is the link I put on my post.

If you try to e.g. make your own GPT 2 meg aligned partition, it will be ignored and overwritten by pfsense.  It is corrected in the next version of pfsense but not in the current.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 07, 2016, 10:17:30 AM
 I've been using gpart, the commands to use are shown here.

https://forum.pfsense.org/index.php?topic=86139.0

But it's certainly not a guide - it doesn't tell you where, when or how to issue those commands, although with Chrysalis help I have now worked that out, but something went wrong,  so I need to start again.  Once I get my head around it I'll write a better guide.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 07, 2016, 01:30:37 PM
yeah sorry for not been clear enough and also for the errors, as both occasions I worked on the guide just before shut eye time.

I suppose the problem that me and the other guy both had is making the assumption everyone already knows when to enter these commands, how to get into single user mode etc. and that's a bad assumption to make.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 07, 2016, 01:56:09 PM
No need to apologise,  and that is exactly the problem, when you know something well it's very easy to leave information out that others don't know, which is what I often find with Android. I  probably don't have that problem with Windows as I am far more familiar with the way that works and the way things are done.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 08, 2016, 08:25:56 PM
Well I've had another go tonight, and now have trim enabled, SUJ disabled and Pfsense installed, I still need to setup a Swap file though.

I did get an error though after selecting the partitions, the bit where you'd normally create the swap partition (which I deleted from the list) - see attached log photo. I think there is a chunk of log missing, as when I scroll down it goes straight to the bottom and then can't scroll back up again  ???

Apart from that everything seems to be installed ok and working, and no funny partition names either.

This is what I've got so far in my comprehensive list of what I did.

Quote
Enter into BIOS and make sure it boots from your USB stick
On the options screen select 2 - Boot Single User mode
After a while you will need to press enter to get to the shell
If there are existing partitions on your drive you can use gpart to delete/destroy them http://www.freebsdonline.com/content/view/731/506/
gpart show will display whats setup
To create the partition with the correct offset issue the following two commands
gpart create -s mbr ada0
gpart add -t freebsd -b 504 ada0
Then you can use "Gpart Show ada0"
Your results should look similar to picture SSD Info-1
Now enter Exit, you may have to do this twice
It will then after a short while return to the installer Configure Console
I chose to accept these settings
Choose Custom Install
One the next screen select the disk to install to.
I chose to skip formatting
I chose to skip partitioning
I chose to install bootlocks ????? Presume this is the correct thing to do  :fingers:
I selected the primary partition of ada0 - there was only one anyway
Chose OK on the Are You SURE screen!
Got an information message that Primary partition one was formatted
Select Subpartitions - I deleted the swap one, then proceeded to create
Got a warning about not having a swap partition, just OK'd this

At this point I got an error - attached, I think there is a chunk of log missing, as when I scroll down it goes straight to the bottom and then can't scroll back up again.

I chose to skip and the install continued.
Once you get to Reboot you can hot Crtl-C to get back into the shell, pressing Return to fully enter it.

You can use the following to commands to check things look correct

gpart show ada0
tunefs -p /dev/ada0s1a

Then issue the following two commands to enable trim and disable soft updates journaling

tunefs -t enable /dev/ada0s1a
tunefs -j disable /dev/ada0s1a

You can then check the changes have taken affect with the following commands

tunefs -p /dev/ada0s1a

Now type Reboot - you may have to press enter twice.
Now is the time to remove your USB drive, and it will boot into PFsense hopefully!

I still need to setup the swap file!
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 08, 2016, 09:11:18 PM
So now I'm trying to do the following:


Code: [Select]
mkdir /usr/swap (although can be put anywhere you like)
Code: [Select]
dd if=/dev/zero of=/usr/swap/swap bs=128k count=16384 (2 gig swap)

The above all seemed to go ok.

I then used the command "/etc/fstab" to try to do the below;

Quote
add these 2 lines to /etc/fstab

Code: [Select]
# Device        Mountpoint      FStype  Options                         Dump    Pass#
md99            none            swap    sw,file=/usr/swap/swap,late     0       0

then after run
Code: [Select]
swapon -aL

Now I'm in EE and it displays the attached, do I just literally type out the above that's enclosed in code quotes, both lines???
Title: Re: Ronski's Pfsense router build
Post by: NEXUS2345 on December 08, 2016, 09:18:08 PM
To add lines to that file, you would most likely have to use an editor such as Nano or Vim. Not a complete expert on this, but from what those instructions are saying, that is what I believe to be the thing needed.

P.S. I have only really used Ubuntu and its derivatives. Just getting into Fedora now and appreciating its improved battery life on my laptop.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 08, 2016, 09:48:28 PM
'ee' will work, but nano is definitely easier, to install nano do 'pkg install nano'. (needs the pfsense box to have working internet access).

Also ronski you will have a much easier time using ssh instead of the console, then you can e.g. copy and paste stuff.

In the pfsense UI you will need to enable the sshd service, then download something like putty to use as ssh client and with that can login using the client on your windows desktop.

If you do ue 'ee' then when you done editing, press ctrl-c, it will show a command prompt, typing 'quit' will discard changes, typing 'exit' will preserve changes.

Strictly speaking only the second md99 line is needed in fstab, the first line is just a commented line used for showing descriptions of each column.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 09, 2016, 06:26:52 AM
Thanks very much Chrysalis, appreciate your help. Any thoughts on the error I got?
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 09, 2016, 03:46:09 PM
the output of the tunefs commmands is not an error, a warning at worst just ignore it.

The installer error is that a binary is missing and that is an issue with their installer, although I dont know how you got that screen as I was never presented with an installer log like that when installing pfsense, if pfsense is booting up fine and filesystem is working then ignore both those.

I dont know what atacontrol is supposed to be for as its not a valid binary on my pfsense box, its also not valid on FreeBSD, there is still a manpage for it so conclusion is that it is something that was in older versions of FreeBSD but is now gone.

Indeed there is even a bug report here.

https://redmine.pfsense.org/issues/4533
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 09, 2016, 09:00:16 PM
I've added the line, just used ee for now but will setup SSH at some point.

I saved the file, reloaded it just to check, and the extra line is there.

Now when I type swapon -aL it appears I get an error

swapon: mdconfig (attach) error: md99 on file=/usr/swap

Hmmm, I've also now got that !0 showing when I do gpart show ada0s1
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 09, 2016, 09:20:20 PM
Pfsense can now access the internet  :)

SSH is also working  :)

Code: [Select]
=>       63  156301425  ada0  MBR  (75G)
         63        441        - free -  (221K)
        504  156299976     1  freebsd  (75G)
  156300480       1008        - free -  (504K)

=>        0  156299976  ada0s1  BSD  (75G)
          0         16          - free -  (8.0K)
         16  156299960       1  !0  (75G)

No idea why that !0 has appeared again, it wasn't there after the install finished  ???

Also installed Nano
Title: Re: Ronski's Pfsense router build
Post by: Chunkers on December 10, 2016, 07:06:03 AM
Pfsense can now access the internet  :)

SSH is also working  :)


GJ!  I am interested in what packages you are planning to install, are you going to use snort or any of the caching plugins eg squid?

Glad you got your issues sorted, slightly intimidated by the amount command line stuff you seemed to have to do.

C
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 10, 2016, 08:36:14 AM
I'm not yet using it as a router, I've disabled DHCP and added a gateway pointing at my current one, I disabled the other two for good measure. Not sure what packages I will be using yet, I've not looked into them yet, I certainly will be using one to block much of the worlds IP addresses.

All the command line stuff is solely related to making sure that the SSD is 4K aligned, trim is setup, SUJ (I don't even know what that is!) is disabled and a swap file is created. Pfsense would run fine if you just went ahead and did a straight forward install, I'm not sure what the affects would be of not doing the above, reads and writes to the drive would be slower and the drive may wear out quicker, but whether any of that would make a difference given what the drives being used for I doubt it. Any sign of your hardware yet?

Anyway I've written a step by step guide to help you and as a record for myself.

A some point Pfsense will install aligned and enable Trim on SSD's, I've no idea when though, Chrysalis said he'd been told in the next release, that could well mean the next major release rather than minor incremental releases.

I still don't have the swap file enabled, although I probably will never need it with 8GB ram, and I still have that strange name in gpart show, but it doesn't look like that's causing any problems.
Title: Re: Ronski's Pfsense router build
Post by: d2d4j on December 10, 2016, 09:11:52 AM
Hi ronski

I would check your fstab, as I think you have not added or added wrongly

I could be wrong so apologies in advance

Many thanks

John
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 10, 2016, 01:31:15 PM
yes is next major release not maintenance releases.

you can use pfsense using its built in functions without touching the command line, the only initial bit would be when booting up the first time and telling it which ports to use for lan.

Asuswrt is similar, it has command line but a gui frontend, you can use with just the UI only but of course UI only means you not utilising the full potential, but the UI has a lot of core functions in place.

PFsense is definitely UI focused, you can add plugins via the UI and those almost all have UI elements.

There is cli packages but none are required for core operation, they just useful for nix fluent users who want specific tools for advanced stuff.

If you leave the ssd misaligned and with trim disabled, the affects are lower performance (but the performance would still be fine for typical router use) and faster wear on the flash storage.

An example of what can only be done via cli is enabling checksum offloading on a per device basis, the UI lets you turn it on and off but the setting applies to all nic ports, whilst in the CLI it can be toggled per port.  However for the majority of situations the UI on/off globally is enough.

I have applied various tweaks to loader.conf and sysctl.conf but this is from my knowledge of FreeBSD, some of these tweaks are configurable in the UI tho as well so can be done via point and click.

Ronski now pfsense is installed, another suggestion.

In the GUI you should find reference to powerd, you will want to enable that to allow the cpu to fluctuate its clock speed for better temps and power consumption, also select either adaptive or hiadaptive mode.  hiadaptive is adaptive but will increase the clock speed with less load than adaptive and also take longer to reduce clock speed when idle. There is also options to enable advanced temp sensors so can monitor temp of each cpu core.

SUJ is soft updates journaling, soft updates itself is complex and not a great system, SUJ adds some journaling to the soft updates but its not the same as traditional journaling as seen in ext3/4 and gjournal, SUJ adds extra writes to the ssd, and the track record of SUJ is also not great in terms of filesystem stability.  Its main purpose is to try and avoid long fsck after a improper shutdown, but fsck is very fast on ssd's anyway and not to mention the filesystem usage on a router will be very small so the benefits of skipping fsck is minimal.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 10, 2016, 10:38:55 PM
@John, you was not wrong, I deleted the line and pasted it in as per Chrysalis example and this time it worked, thanks very much. Much easier via Putty.
@Chrysalis Made the adjustments you suggested, thanks.


 
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 10, 2016, 11:02:26 PM
Well here's my step by step guide of what I've done so far (with a lot of help - thanks)

Quote
You can download the latest version of Pfsense from https://www.pfsense.org/download/
See this link https://doc.pfsense.org/index.php/Writing_Disk_Images to create a bootable USB drive - I used Rufus

The following install guide includes correct 4K alignment for an SSD, enabling Trim, create a Swap File instead of Swap Partition, disabling SUJ.
In the future some of the above may not be required as Pfsense will support SSD's properly, so these steps could be skipped.

Enter into BIOS and make sure it boots from your USB stick
On the options screen select 2 - Boot Single User mode
After a while you will need to press enter to get to the shell
If there are existing partitions on your drive you can use gpart to delete/destroy them http://www.freebsdonline.com/content/view/731/506/
The command "gpart show" will display whats setup
To create the partition with the correct offset issue the following two commands
gpart create -s mbr ada0
gpart add -t freebsd -b 504 ada0
Then you can use "gpart show ada0"
Your results should look similar to picture SSD Info-1
Now enter Exit, you may have to do this twice
It will then after a short while return to the installers Configure Console
I chose to accept these settings
Choose Custom Install
One the next screen select the disk to install to.
I chose to skip formatting
I chose to skip partitioning
I chose to install bootblocks
I selected the primary partition of ada0 - there was only one anyway
Choose OK on the Are You SURE screen!
Got an information message that Primary partition one was formatted
Select Subpartitions - I deleted the swap one, then proceeded to create
Got a warning about not having a swap partition, just OK'd this

At this point I got an error.

I chose to skip and the install continued.
Once you get to Reboot you can hit Crtl-C to get back into the shell, pressing Return to fully enter it.

You can use the following two commands to check things look correct

gpart show ada0
tunefs -p /dev/ada0s1a

Then issue the following two commands to enable trim and disable soft updates journaling

tunefs -t enable /dev/ada0s1a
tunefs -j disable /dev/ada0s1a

You can then check the changes have taken affect with the following commands

tunefs -p /dev/ada0s1a

Now type Reboot - you may have to press enter twice.
Now is the time to remove your USB drive, and it will boot into PFsense hopefully!

After reboot

At this point you can change the LAN IP of the router using option 2 to set the interface IP

I set it up as an address on my local network and disabled DHCP.
I then logged into the Pfsense web interface, doing as little as possible through the setup Wizard
I added a Gateway (System > routing) which pointed to my current router, and disabled any other gateways whilst fiddling - you'll need to change this back when using as a router.
I also checked that DHCP was disabled.
Pfsense should now have internet access.

Now to enable SSH so you can telnet in using something like Putty

This can be done via the GUI or via console - see https://doc.pfsense.org/index.php/HOWTO_enable_SSH_access

Now on to making the swap file - this needs to be done from the console, so telnet in from your PC using port 22 unless you've changed it.
If using Putty you can paste with a right mouse click, don't forget to press enter when pasting passwords like I did!
Chose option 8 from the console menu, to enter the shell

Now enter the following commands

mkdir /usr/swap

I got no confirmation, just another line

Now enter the following command for a 2Gig swap file

dd if=/dev/zero of=/usr/swap/swap bs=128k count=16384

After a long pause I got some info displayed as follows

16384+0 records in
16384+0 records out
2147483648 bytes transferred in 25.284832 secs (84931695 bytes/sec)

I then entered the following command

ee /etc/fstab

and added the following line (use copy and paste), I also inserted a carriage return (enter) at the end so the cursor dropped down the next line

md99            none            swap    sw,file=/usr/swap/swap,late     0       0

When you've added the above hit Ctrl C and type exit to save the changes

Then enter the following command

swapon -aL

If you get an error check you've entered the line correctly in fstab

If that all went well, you can now Exit back to the console menu and get on with exploring!

Settings that you may want to make from the GUI.

Setup PowerD, Thermal Sensors and Cryptographic hardware if applicable, all of which are located in System - Advanced - Miscellaneous

Hopefully I've documented it fairly accurately, if there are any mistakes please let me know.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 10, 2016, 11:22:21 PM
Added some pictures to the first post.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 17, 2016, 05:44:00 PM
Have now got my Pfsense box running live  ;D

Have switched to using the HG612 as my modem, rather than the Zyxel, I've lost 7.2Mbps on the downstream (attainable was slightly lower than the sync on the Zyxel), but have gained 2Mbps on the upstream (attainable was pretty much the same as the sync). I shall probably stick to using the HG612 given the boost in upstream, and it makes for a tidier set up.

I still have a lot of work to do, have setup some port forwards to cover my extremly basic website, and WHS2011 access. Have also set up a firewall rule so that only pings from TBB ping monitor are responded to.

Currently I can't access my website from within my own network, which also means update checks for the GUI fail, which is not a problem but I would like to fix it. I roughly know whats wrong (https://doc.pfsense.org/index.php/Why_can%27t_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks) but I'm not sure how to fix it.
Title: Re: Ronski's Pfsense router build
Post by: d2d4j on December 17, 2016, 05:58:38 PM
Hi ronski

Sounds good, well done

I would use dns to allow access and the link you posted tells you how to do this, split dns

In simple terms, you have dns for external WAN side and internal LAN side dns

If you still have not managed it, I'll see if I can post a pic tommorow from one of our pfsense firewalls for you

Many thanks

John
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 18, 2016, 08:51:31 AM
Thanks John, was in a bit of a rush yesterday and should have mentioned that the website runs on a non standad port.

The link says that Method 2: Split DNS is the more elegant solution, but that gives no option to enter port numbers, perhaps nat reflection is the way to go.

I'll take a look later when my heads a bit clearer from last night's Christmas works do.
Title: Re: Ronski's Pfsense router build
Post by: d2d4j on December 18, 2016, 08:59:00 AM
Hi ronski

Many thanks, were you at elland road football stadium. It was our works do last night and had a 1920 theme

The split dns does not need port setup. If using different ports, you input this into your browser as normal. Split dns just resolves the URL to either external or internal, so that gives you as an example

Mydomain.url:8080 - external 5.5.5.5

Mydomain.url:8080 - internal 192.168.1.1

Obviously the above is an example using made up information, so it's easier to understand

If it helps, the only dns records which use ports, are srv records

I hope that helps a little

Many thanks

John
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 18, 2016, 10:45:19 AM
Winter Gardens Margate - Winter Wonderland theme, very nice but far too much to eat.

Just looking into this now, it seems that DNS Resolver is the replacement for DNS Forwarder, although the latter is still present, but disabled.

Not sure what you mean by If using different ports, you input this into your browser as normal, I just enter www.ronski.me.uk into my browser, my domain name provider has a redirect which then incorperates the port number IIRC.
Title: Re: Ronski's Pfsense router build
Post by: d2d4j on December 18, 2016, 11:04:56 AM
Hi ronski

Sounds good, the food this year was not as good as last year I'm sorry to say.

The dns hosting records for a domain.url cannot have port numbers attached, i.e. Cname, A or AAA records. I would guess they have a php or Java script in place

You could do the same on your hosting platform (IIS or Apache or whatever your platform is) and the above would work or you can just add the port to the domain.url in your browser.

I hope that explains it more, as I said, only SRV records allow a port to be assigned to the records

Many thanks

John
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 18, 2016, 11:56:55 AM
Thanks John, I opted to use Nat Reflection, and have enabled the options as per this link (https://doc.pfsense.org/index.php/Why_can%27t_I_access_forwarded_ports_on_my_WAN_IP_from_my_LAN/OPTx_networks) and it now all works, the website is of no real use, it just something I played about with, but it also incorperates the updates for the HG612 stats GUI so I do need it to work for testing that.

My domain host just forwards to my IP address and port number.
Title: Re: Ronski's Pfsense router build
Post by: d2d4j on December 18, 2016, 12:01:20 PM
Hi Ronski

Glad you resolved it, and either would work.

Here is a pic for dns in pfsense, to help others if needed, and also, a link to a site to explain over DNS and port numbers better (though a quick google brings many sites up to explain).

Many thanks and wishing everyone a lovely Christmas, and happy New Year

John

http://support.simpledns.com/kb/a35/can-i-specify-a-tcp-ip-port-number-for-my-web-server-in-dns-other-than-the-standard-port-80.aspx
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 18, 2016, 12:22:53 PM
Is it possible to name devices that are attached, I can look in Status / DHCP Leases or Diagnostic / ARP Table and see whats attached, but many have meaningless host names such as android-23bb9a0efce1a2dc. In my old router I could assign names and it was easy to then see what was on my network.

I can enter a description for devices which are issued a static address, but I dont want to give everything a static address.

Perhaps there's a plug in that could do this, it would just need to keep a record of the MAC address and corresponding name of the device? It could even email me when a new device appears thats not in the list, kind of like an alarm system.
Title: Re: Ronski's Pfsense router build
Post by: d2d4j on December 18, 2016, 12:26:45 PM
Hi ronski

In essence, yes, you can but with provisos that the attaching devices uses the pfsense for dhcp, or device dns set to pfsense

It's easier if using dhcp, as pfsense takes care of much of this for you, just as your old router would have

Many thanks

John
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 18, 2016, 12:42:48 PM
Thanks John, but how do I do it?
Title: Re: Ronski's Pfsense router build
Post by: d2d4j on December 18, 2016, 12:49:53 PM
Hi ronski

Sorry, just heading out but I think it's services, dhcp and set dhcp as you need it

As I'm not sure where your current dhcp is assigned, I would turn this dhcp off, so you only then have the pfsense dhcp running

If you want, when I'm back later tonight, I'll take some screen shots for you

Many thanks

John
Title: Re: Ronski's Pfsense router build
Post by: d2d4j on December 18, 2016, 06:13:37 PM
Hi Ronski

Please see pics for DHCP in pfsense.  If you add a static, and do not set an IPV4 address, it will autoassign from DHCP and keep track of it for DNS, so you could reference using its URL of device

Please note you have to click the LAN tab as you would not normally use DHCP on WAN for live CIDR ranges, unless you were using IPV6

ALso, please see this link for any bootp/dhcp advanced options, which you may or usually may not need to use

I hope that helps

Many thanks

John

http://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 18, 2016, 07:19:12 PM
Thanks very much John, I'll take a look when I've got a bit more time
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 18, 2016, 10:19:41 PM
Thanks John, I already have the DHCP server set up, and have added a couple of Static IP's but didn't realise you could leave the IP blank, that's useful to know - I can then add a meaningful name/description but without the need for a static IP

Edit. When I do that it doesn't show what IP address the device has in the DHCP leases list - the IP is blank, surely it should show the IP it's issued???
Title: Re: Ronski's Pfsense router build
Post by: tickmike on December 22, 2016, 03:06:18 PM
With my 'Smoothwall' install I download and burn a live cd, check it's 'checksum' and install, configure with a GUI, use it 30minutes later.  ;)
http://www.smoothwall.org/
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 22, 2016, 03:45:49 PM
If I didn't bother with the SSD tweaks I could probably do it in 15 minutes or less, 30 minutes with the tweaks now I know what I'm doing  :P
Title: Re: Ronski's Pfsense router build
Post by: skyeci on December 22, 2016, 04:41:34 PM
What version are you using? - I am on  2.4.0.b.20161222.0709 . Thanks to some excellent work (not by me) the fixes are coming into snapshots  for sky ipv6 tweaks such as "Do not allow PD/Address release" - already on the latest snapshot & just waiting for the "use fixed DUID" option to go live.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 22, 2016, 07:03:04 PM
I'm using 2.3.2-RELEASE-p1. No idea what those things mean though  ???

I'm still watching those video's someone linked to - they are so long.
Title: Re: Ronski's Pfsense router build
Post by: skyeci on December 22, 2016, 07:08:36 PM
If you change the update to experimental you can upgrade to 2.4 through the gui....

Title: Re: Ronski's Pfsense router build
Post by: Ronski on December 22, 2016, 07:11:55 PM
I think given my lack of experience I'll stay with a stable version  ;)
Title: Re: Ronski's Pfsense router build
Post by: skyeci on December 22, 2016, 07:14:22 PM
Been on 2.4 for ages. Really it just works..interface is the same. Takes minutes to update  ;D
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on December 23, 2016, 05:05:28 AM
Sky fixes can work on stable just need to be applied manually.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on January 05, 2017, 09:27:10 PM
I don't seem to be able to access Drop Box from my browser (FF/Chrome/IE), tried to open a shared folder, even just www.dropbox.com and get the attached error.

I can remote into the PC at work and it works fine, so I presuming it's something to do with Pfsense??? I disabled PFBlockerNG, but that made no difference, any ideas?

Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on January 05, 2017, 09:32:33 PM
loads fine here ronski.

if you add the pfblockerng widget to the dashboard it will tell you if any hits are on the blocklists.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on January 05, 2017, 09:38:59 PM
Already got the widget installed, but following your suggestion though I noticed the DNSBL packet count increase each time I tried to access dropbox. Disabling DNSBL cures the problem, any thoughts what could be causing it?
Title: Re: Ronski's Pfsense router build
Post by: NEXUS2345 on January 05, 2017, 09:40:40 PM
It appears to be overriding the Dropbox SSL certificate with its own, causing HSTS to fail and Firefox to block you from reaching the site. Essentially, to ensure that you aren't loading any malware, it is giving encrypted traffic a certificate that it can decode and read, which is causing Firefox to think someone is spying on you.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on January 05, 2017, 09:44:10 PM
the number is clickable, if you click it then you should see a bit more info including the alias name of the block list with the false positive.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on January 05, 2017, 09:45:37 PM
Well having enabled DNSBL again links to Dropbox are still working  ???

I haven't had any problems connecting to other HTTPS sites.

The only clickable number is the the one for the pfB_Top_v4, the other two aren't clickable?

ETA: Logging is enabled under DNSBL IP Firewall Rule Settings.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on January 05, 2017, 09:47:26 PM
I am talking about the number in the packets column, thats the hit count.

ahh yeah after a test I see its only clickable on the ip block lists, not domain name one's.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on January 05, 2017, 09:49:41 PM
Only clickable one is the 5 in the middle - see attached

PS Got to go now - before I get in trouble with the misses
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on January 05, 2017, 09:50:14 PM
ok do this

goto the pfblockerng config screen

at the top area you see sections, last but one is logs, click it.
Then click dnsbl.log in log file/selection

You should see the info you need, e.g. I tested on a domain just now and here it is in that log.

Code: [Select]
DNSBL Reject,Jan 05 21:47:52,003-pc.ru,192.168.1.124, | / | Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/55.0.2883.87 Safari/537.36
DNSBL Reject,Jan 05 21:47:53,003-pc.ru,192.168.1.124,http://003-pc.ru/ | /favicon.ico | Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/55.0.2883.87 Safari/537.36

it doesnt tell you the dnsbl list tho, which might be why its advisable to split lists into their own dnsbl feed aliases so you know from the counter which list it hits.

I am using malwarepatrol also via dansguardian feed, for that one you definitely be advisable to whitelist alexa top 1k sites.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on January 05, 2017, 10:37:31 PM
Only entry for Dropbox (which is being blocked again) in the logs is as follows, and lots of them.

Code: [Select]
DNSBL Reject HTTPS,Jan 05 22:19:41,www.dropbox.com
Only thing Alexa related I can remember is in the DNSBL feeds, where there's an option to Enable Alexa Whitelist, is that what you mean?

Actually after a bit more Googling I've found out there also an Alexa section on the main DNSBL configuration tab, so I just need to enable it here (set to Top 1k) and as per above?
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on January 05, 2017, 11:39:26 PM
yes

yeah it has many hits in the file

https://lists.malwarepatrol.net/cgi/getfile?receipt=f1442112770&product=8&list=dansguardian

the issue is that is a url rather than domain list but pfblockerng just works on the domain, url lists are bound to have false positives when used with the url stripped so if that is to be used then you definitely want to whitelist alexa as otherwise popular file sharing sites will likely keep getting blocked.

for this reason I may disable that list.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on January 06, 2017, 09:57:30 PM
Having had a look in the list and with what you've written I now understand a bit more about what's happening, but although I believe I've set up Alexa for the top 1k domains Dropbox.com is still being blocked. Will it need the list to be updated before it kicks in - surely Dropbox is in the top 1000?

Perhaps as per your post above I'd be better using other lists.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on January 06, 2017, 10:09:03 PM
Ok first goto the DNSBL main config page

scroll down and you see black bar that says Alexa Whitelist
Clink the +
Tick the enable box
Select top 1k
Select TLD's to include, or you can leave just on default which includes .com, I added more tho.

Hit save

Next click on dnsbl feeds
Click the edit button for the alias that has malware patrol
Then on the feed alias page tick enable alexa whitelist (so yes has to be enabled in two different places)
Click save
Also click apply on top if box appears.

Now click update
Click update
Click run to force an update of alexa etc.

I suggest you also do this.

https://doc.pfsense.org/index.php/Redirecting_all_DNS_Requests_to_pfSense

Otherwise any client on your lan can overide the router dns by directly quering other dns servers.

Note the output below when I tried to do a lookup on google dns with a domain in a DNSBL list.

Code: [Select]
C:\Windows\system32>nslookup otorola.clever-search771.ru. 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8

Name:    otorola.clever-search771.ru
Address:  10.10.10.1
Title: Re: Ronski's Pfsense router build
Post by: Ronski on January 12, 2017, 08:16:35 PM
Just got chance to look at this again, or more to the point write it up. I had set up Alexa an run the update, but it still seemed not to work, but tonight it does seem to be working as expected.

I've also just added the DNS port forward rule and that works, thanks.

I've also created a free personal account with OpenDNS, and configured some options of things to block there, although this was set up last night it's not yet showing any traffic stats in my account.

Need to look at adding some other lists as well, still need to set up OpenVPN, and finish watching those videos.....
Title: Re: Ronski's Pfsense router build
Post by: Ronski on February 01, 2017, 06:29:21 AM
Got up this morning to find I had no internet access, pfSense had some sort of crash, I could still login and use the interface, but CPU temperature was up to 48 degrees (usually 36), CPU activity kept jumping up to 30 to 40%, a reboot cured it. System had been up for 29 days.

How do I go about finding out what the issue was?
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on February 01, 2017, 12:57:53 PM
the answer was to not reboot and login to the terminal.  Then you can find if some sort of process was hung or just chewing up extra cpu, now that you have already rebooted its harder.  But you can check all the logs to see if anything stands out.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on February 01, 2017, 01:23:49 PM
Time is short in the morning, so just didn't have time look into things and work out how, and of course the others needed broadband access whilst I'm at work.

I'll have a look at the logs tonight.
Title: Re: Ronski's Pfsense router build
Post by: Chunkers on February 01, 2017, 06:52:14 PM
System had been up for 29 days.

grrrr, only 29 days?  lol

Title: Re: Ronski's Pfsense router build
Post by: Ronski on February 01, 2017, 08:20:56 PM
the answer was to not reboot and login to the terminal.  Then you can find if some sort of process was hung or just chewing up extra cpu, now that you have already rebooted its harder.  But you can check all the logs to see if anything stands out.

Well looking at the logs tonight I can't see anything untoward*, I suppose http://192.168.0.1/status.php#Processes would have come in very useful this morning.

I have notice (some time ago) my swap file has disappeared, I realise this is unrelated.

*I can see hundreds of these errors bad name in /var/dhcpd/var/db/dhcpd.leases which I think relates to one of my devices which has a host name with () in it, I've no way to change the host name, so not sure how to get aground that - I have posted on a thread on the pfSense forums so I'll see what they suggest.
Title: Re: Ronski's Pfsense router build
Post by: displaced on February 05, 2017, 10:26:29 PM
I think a possible solution for the device with the dodgy hostname would be to create a static DHCP entry for it. 

From my tinkering with pfSense, the option's under Services > DHCP Server > DHCP Static Mappings for this Interface.

It should be enough to provide the MAC address of the device and a new hostname.  If you don't provide an IP address for the mapping, one will be allocated as normal from the pool.  Everything else can be left empty.  You're simply telling the DHCP server to override the hostname.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on February 06, 2017, 06:00:22 AM
Thanks Displaced, I did try that exactly as you suggest but it didn't work.
Title: Re: Ronski's Pfsense router build
Post by: displaced on February 06, 2017, 03:54:49 PM
Don't give up just yet!  The dhcpd.leases file is a little odd.  It's not just a record of the current state of the leases -- it's sort of a historic journal.  So it could be that your settings change has resolved the issue, but there are still old records in the file which contain the previous bad hostname.

Might be worth trying to clear the leases -- I can't get to my pfSense installation right now, but I'd presume there'll be an option somewhere to clear the file.

Chris
Title: Re: Ronski's Pfsense router build
Post by: Ronski on February 06, 2017, 08:14:56 PM
My static mapping is still there, I did delete the lease (I no longer have that option), and also restarted the service but alas made no difference.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 30, 2017, 08:36:20 PM
I've been playing around with PFsense again this week, I've had a VPN setup for some time on my Windows Home Server 2011. Whilst Windows laptops connect fine I could not get my Android devices to connect, something to do with GRE I believe, which I couldn't understand.

So I decided to setup Open VPN, I looked around for a guide that seemed to make sense to me and found this.

https://chubbable.com/setup-openvpn-pfsense

Which I followed, and after a bit of trial and error I can finally get my Android phone to connect to my home network through OpenVPN.

But when I turn on tethering on my phone, other devices such as my tablet don't seem to get an IP address, so never connect and I get an error message saying "AP currently not in use.  internet connection slow", then it says failed to obtain an IP address. Any idea how to resolve this?

Also having followed the setup guide my phone gets an IP of 10.0.1.2, how can I set it up so that I appear to be on my internal network via the VPN. Not sure if I should just change that to my normal subnet.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 31, 2017, 02:21:33 PM
It seems there is a known bug in Android that stops tethering from working when using OpenVPN.

So I've tried IPSEC using the guides below.

https://doc.pfsense.org/index.php/IPsec_Road_Warrior/Mobile_Client_How-To
https://doc.pfsense.org/index.php/Routing_internet_traffic_through_a_site-to-site_IPsec_tunnel#Allow_IPsec_traffic_through_the_firewall

I can connect, but get no internet access on my phone, also my phone's IP address stays the same, which seems odd.
Title: Re: Ronski's Pfsense router build
Post by: Dray on May 31, 2017, 02:35:48 PM
There's nothing wrong with that IP address - I believe it has to be outside your LAN for the routing to work.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on May 31, 2017, 07:06:16 PM
Seems you have done it in an odd way ronski.

The documention for using openvpn on pfsense is a bit confusing and even incomplete.

I cannot remember the exact steps I carried out but mine is setup something like this.

1 - The pfsense unit is the VPN endpoint. So everything LAN/NAT side is same as before.
2 - The VPN is always connected, I actually have 2 VPN's always connected right now.
3 - The routing to the VPN is carried out using firewall rules, so the src ip is the LAN ip of the device and then you route it via the VPN interface.
4 - Each VPN has a gateway device configured in the routing section of pfsense, so I have OPT1 and OPT2 interfaces assigned to my VPN's, these need to be setup so you can route via the firewall.

This basically means your lan device has the same config as before, it will have the same LAN ip address and still have the pfsense unit set as its gateway, so this shouldnt break android phones.

I can change routing for devices etc. on the fly simply by adjusting my firewall rules, I cannot document this soon tho as I got other stuff to work on sadly, but if you still stuck in a few weeks I will try to document what I did.

Also I can ping VPN's from any device e.g. this is a VPN I have hosted in america.

Code: [Select]
C:\Windows\system32>ping 192.168.0.1

Pinging 192.168.0.1 with 32 bytes of data:
Reply from 192.168.0.1: bytes=32 time=97ms TTL=63
Reply from 192.168.0.1: bytes=32 time=96ms TTL=63
Reply from 192.168.0.1: bytes=32 time=96ms TTL=63

It was definitely a more complicated process to set all this up on my pfsense unit than say asuswrt, but its also a more powerful setup.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 31, 2017, 08:07:34 PM
Seems you have done it in an odd way ronski.

Probably because I don't have much clue as to what I'm doing, there are so many options, and not many explanations that make sense.

All I want to be able to achieve is to VPN in securely with my phone, and then tether other devices to my phone, allowing access to the internet via my home connection and local resources such as my TV Server.
Title: Re: Ronski's Pfsense router build
Post by: burakkucat on May 31, 2017, 08:58:50 PM
Surely there needs to be two ends for a VPN?  :-\

If you are defining your Pfsense router to be one end, then where is the other end?  ???
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 31, 2017, 09:10:19 PM
The other end in this case is my mobile phone, wherever that may be in the world.
Title: Re: Ronski's Pfsense router build
Post by: burakkucat on May 31, 2017, 10:01:31 PM
Right, got that.  :)

Now I need to let it ferment . . .
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on June 01, 2017, 12:04:42 AM
The other end in this case is my mobile phone, wherever that may be in the world.

Ahh I misunderstood.

So its so you have a VPN between your phone and home firewall?

Then yeah I probably dont have the answer you need, but I will see if I can find anything out for you.
Title: Re: Ronski's Pfsense router build
Post by: burakkucat on June 01, 2017, 03:46:38 PM
Ahh I misunderstood.

So its so you have a VPN between your phone and home firewall?

That's a relief to know.  :)

I was originally getting myself in a convoluted muddle whilst thinking about things.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on April 29, 2018, 05:20:15 PM
I've been trying to set up my VPN server again, so if I'm using my phone say on a hotels wireless I can connect via VPN to my home network and know my connection is secure.

I did have it working but having changed ISP it stopped working, so following the guide (https://chubbable.com/setup-openvpn-pfsense) I used last time I'm trying to set it all up again, but alas it's not working  :wall: :wall: :wall:

I'm currently getting this error notice after I use the wizard.

Code: [Select]
There were error(s) loading the rules: /tmp/rules.debug:190: unknown protocol udp4 - The line in question reads [190]: pass in quick on $VIRGINMEDIA reply-to ( em2 80.6.28.1 ) inet proto udp4 from any to <<removed my public ip address>> tracker 1525018272 keep state label &quot;USER_RULE: OpenVPN OpenVPN Connection wizard&quot;
Any idea's on what's going wrong???
Title: Re: Ronski's Pfsense router build
Post by: Ronski on April 29, 2018, 05:52:52 PM
I've actually managed to track down the problem, I disabled any rules for OpenVPN one at a time until the error went away when reloading the filter, that way I identified the rule causing the error.

One of the auto generated rules didn't have the protocol set, once I did that it all started working.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on April 30, 2018, 01:44:04 AM
from what you posted it would seem to be a bug in pfsense if its the case auto generated rules are using invalid syntax..
Title: Re: Ronski's Pfsense router build
Post by: Ronski on April 30, 2018, 10:19:44 AM
It certainly seems that way, I may try and post on their forums,  but I'm certainly not going try and replicate it.

At one point I had four rules under OpenVPN as when you delete an OpenVPN server it doesn't delete associated rules, which I hadn't realised.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 05, 2018, 03:18:29 PM
That was a bug in Pfsense, it's fixed in the next version.

Having  another minor problem. I swapped the patch cable from my router to the modem and I had to reboot Pfsense to get internet on other devices to work, although Pfsense reported the connection as up on the dashboard.

This also happened today when I upgraded to Vivid 350.

Any ideas why I loose internet on all attached devices until  a reboot?
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on May 06, 2018, 12:34:18 PM
pfsense can be problematic on things like that, its not completely fluid.

e.g. on a ipv6 prefix change it doesnt auto remove the old prefix leaving all ipv6 connectivity down until the old prefix is manually removed or a device reboot.

Tuning the timeout values in the WAN section may make it behave better.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 06, 2018, 12:47:08 PM
Tuning the timeout values in the WAN section may make it behave better.

Thanks not sure where that is, had a look and a Google but drawn a blank?
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on May 07, 2018, 06:20:47 AM
its in the WAN settings screen where you set it to DHCP type, then you play around with DHCP timeout values, I have absolutely no idea tho what values might be better.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 07, 2018, 09:24:54 AM
Thanks, found it now, it only shows any timing values once you click Advanced Configuration hence why I couldn't find it.
Title: Re: Ronski's Pfsense router build
Post by: skyeci on May 07, 2018, 09:36:38 AM
if you have a spare drive etc you could give Opnsense a go. Couple of forum members here use it. I had issues with BT and wan port not re-establishing ppoe but since moving that to Opnsense it's been fine.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 07, 2018, 10:49:58 AM
Thanks for the suggestion, no spare drive at the moment, and too many other things that need doing - the wife's nagging me to get the decking built, which means I need to be designing that.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on May 08, 2018, 10:18:06 AM
Same here really, I know you guys skyeci and marjohn56 have been bugging me on opnsense, but I just havent found the time to reconfigure my network yet which is what I need to do if I switch over.

I do now have a spare ssd for my old pfsense unit but forgot it needs ram, I plan to configure opnsense on that and then I can hot swap the devices when testing opnsense.
Title: Re: Ronski's Pfsense router build
Post by: underzone on May 08, 2018, 04:36:31 PM
Anyone using OPNsense with igmpproxy for BT multicast IPTV? I have it set up fine with pfsense at the moment, but it would be nice to know before having a go with OPNsense, TIA.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 13, 2018, 06:54:42 PM
I fixed the issue with my connection not coming back up, stumbled across the fix by chance trying something after someone replied to my thread on the Pfsense forums.

In the Status>Routing>Gateways>Edit there is an option to make that gateway the default gateway, once I ticked that option it fixed the issue  ;D

I've got various gateways set up, but disabled, so don't know if one of those was still set as default or not.
Title: Re: Ronski's Pfsense router build
Post by: Chrysalis on May 13, 2018, 07:44:47 PM
ahh so you might have still had the plusnet gateway as default then.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on May 13, 2018, 08:37:07 PM
Most likely, but it was disabled, quite how a disabled gateway can be the default I don't know  ::)
Title: Re: Ronski's Pfsense router build
Post by: Jon21 on January 25, 2019, 02:36:56 PM
Bit of a bump. Are you still using the Qotom for pfsense Ronski? Reason for asking is, what sort of temperature is your Qotom running at? I'm using a Qotom Q355G4 for pfsense. Temps were anywhere between 50-60c at idle. Just changed the thermal paste, using Thermal Grizzly Kryonaut and its now between 33-40c at idle. Tbf, the original thermal paste was absolutely caked all over the die, far too much applied.
Title: Re: Ronski's Pfsense router build
Post by: Ronski on January 25, 2019, 04:04:34 PM
Thanks for the heads up, mine runs around the 40 degree's mark.