FW- 525B Quick Start Guide

Transcription

1 FW- 525B Quick Start Guide 2013 Rubicon Communications, LP

2 Contents Introduction... 3 Plugging everything in... 3 Description of Port Indicators... 3 Initial Configuration... 4 Logging into the web interface... 4 Setup Wizard... 4 Hostname... 4 Domain... 4 DNS Servers... 5 Time Zone and Server... 5 WAN Configuration... 6 Configure LAN Interface... 6 Setting the password... 7 Introduction to the web interface... 7 Backing up and restoring... 8 What else can I do?... 8 Support... 9 Commercial Support... 9 Free Support Options... 9 Forum... 9 Mailing Lists... 9 IRC... 9 Configuring Wireless...Error! Bookmark not defined. Assigning the interface...error! Bookmark not defined. Configuring the interface...error! Bookmark not defined. IP Configuration...Error! Bookmark not defined. Wireless configuration...error! Bookmark not defined. Configuring Firewall Rules...Error! Bookmark not defined. Using the serial console...10 Windows using PuTTY...10 Windows using Hyperterminal...10 Accessing the BIOS Using the Serial Console...11 Additional Documentation

3 Introduction Thank you for your purchase of the Netgate FW- 525B with pfsense 2.0. The FW- 525B hardware platform in combination with the popular open source pfsense software provides a powerful, reliable, cost- effective solution for your network security needs. This Quick Start Guide will help you get up and running with a basic configuration on your FW- 525B. Plugging everything in The system comes pre- assembled and ready to plug in and get started with configuration. The following image shows the location of the WAN and LAN ports. Description of Port Indicators The following list will help you in decoding the LED indicators on the face of the FW- 525B unit. HDD LED If the light is on, the HDD or storage medium is being accessed. Power LED If the light is on, it indicates the system is powered on. Network Interface LEDs (Front) LEDs are off and flash amber to indicate activity. Network Interface LEDs (Rear) Left LED Green indicates 100Mbit/s link, Amber is 1000Mbit/s. Right LED LED indicates port activity. If you are replacing an existing firewall on a production network, you will want to go through the initial configuration with the device not plugged into your production network. You can plug a laptop or desktop PC into the LAN port to perform the initial configuration. For new networks, you can start by plugging the LAN into your switch. 3

4 Note: The FW- 525B Ethernet ports are auto MDI/MDI- X, meaning you can use either a straight through or crossover CAT5 cable regardless of the type of device you are connecting it to. To get started, plug the LAN port into the network or system where you will perform the initial configuration, and then plug in the power as seen in the image below, which shows the rear side of the unit and the buttons/connectors found there. Initial Configuration After powering on your FW- 525B, it will boot up and be ready for the initial configuration after approximately two minutes. The initial boot takes longer if your WAN interface is not plugged into something where it can receive a DHCP address, as it must wait for that to time out. Once the system is booted, you should receive a X IP address on the system(s) plugged into the LAN port from the DHCP server. Logging into the web interface Browse to to access the web interface. You will be prompted for username and password, the default username is admin and password is pfsense. Setup Wizard After logging in, the setup wizard will run. This will walk you through a few steps to get up and running with a basic configuration. At the first screen, click Next. The subsequent screen allows you to configure the hostname, domain and DNS servers to be used. Hostname For hostname, choose a name for the host. This does not affect functionality. Domain If you have an existing DNS domain in use inside your network (such as a Microsoft Active Directory domain), use that domain here. This is the domain suffix assigned 4

5 to DHCP clients, which you will want to match your internal network. For networks without any internal DNS domains, you can fill in anything you want here. DNS Servers The DNS server fields can be left blank if you have a WAN connection using DHCP, PPTP or PPPoE types of Internet connections and the ISP automatically assigns DNS servers. When using a static IP on WAN, you must enter DNS server IPs here for name resolution to function. You can specify DNS servers here even if your ISP assigns different ones. Either enter the IPs provided by your ISP, or you may want to consider using a service like OpenDNS ( whose free service will allow you to add content filtering and phishing protection amongst other benefits to your pfsense install. Using Google s public DNS servers ( , ) is another popular choice. Click Next after filling in the fields as appropriate. Time Zone and Server The next screen allows you to configure the time (NTP) server to be used to synchronize your firewall s time, and also specify its time zone. The default NTP server points you ntp.org s NTP server pool. If you have an internal time server, you should specify it here instead. You also want to select a city in your time zone so your log timestamps are in local time (unless you have a policy to timestamp all logs in GMT). 5

6 Click Next. WAN Configuration This page is where your Internet connection is configured. You will need information from your ISP to configure this screen appropriately. A few notes to assist you: MAC address if replacing an existing firewall, you may want to enter the old firewall s WAN MAC address here, if you can easily tell what that is. This commonly avoids issues involved in switching out firewalls, such as ARP caches, ISPs locking to single MAC addresses, etc. If you can t enter the MAC of your current firewall here, it probably isn t a big deal power cycle your router or modem and your new MAC will usually be able to get online. For some ISPs, you have to call when switching devices, or go through an activation process of some sort. Static IP configurations the subnet mask is configured in CIDR format, which is usually provided by the ISP in addition to the 255.x.x.x subnet mask. The following table shows the most common subnet masks and their CIDR equivalent. Subnet Mask CIDR Block private networks and bogons these two options will block private, unassigned, and reserved IP subnets for traffic initiated on your WAN connection (i.e. coming in from the Internet). These IP ranges should never be seen on the Internet, and these should both be enabled on systems that are directly connected to the Internet. If your WAN resides on a private network, you may not want to use these options. Configure LAN Interface Here you configure the IP and subnet mask to be used on your LAN. If you don t ever plan to connect your network to any other network via VPN, the x default is fine. 6

7 If you want to be able to connect into your network using VPN from remote locations, you should choose a private IP address range much more obscure than the very common /24. Space within the /12 RFC1918 private address block seems to be the least frequently used, so choose something between x.x and x.x for least likelihood of having VPN connectivity difficulties. If your LAN is x and you are at a wireless hotspot using x (very common), you won t be able to communicate across the VPN x is the local network, not your network over VPN. Setting the password Enter the admin password for your firewall here, and again to confirm. You should choose a strong password, with a combination of letters, numbers and symbols. Should you forget your password, you can reset it using a serial console on your FW- 525B. After entering your password and confirming it, click Next. Then click Reload to apply your changes. Introduction to the web interface You are now at the front page of the pfsense web interface. This screen provides an overview of your system resource utilization. The menu across the top of the screen groups the various configuration, status and diagnostics screens. There are also additional themes available to change the layout of the web interface, under System - > General Setup if you prefer a different look and feel. 7

8 Note: The default theme does not function on an iphone, ipad, or ipod Touch, but when browsing from one of these devices it will automatically switch to a different, plainer theme that is functional. Yes, you can configure your FW- 525B from your ios devices. The default theme does function properly in the Android browser, but is difficult to navigate due to the screen size, so it also will switch to the plainer theme. The default firewall rules can be viewed under Firewall - > Rules. If you need to forward ports, you will configure them under Firewall - > NAT. More information on port forwarding can be found here: You can view your real time traffic throughput under Status - > Traffic Graph. For many longer term statistics, browse to Status - > RRD Graphs. Logs can be viewed under Diagnostics - > System logs. Backing up and restoring At this point your basic two interface LAN and WAN configuration is complete. Before proceeding with additional configuration, you will want to get a backup of your configuration. To do so, browse to Diagnostics - > Backup/Restore in the web interface. Click the Download Configuration button, and a copy of your configuration will be downloaded. You can restore this configuration at the same screen, by choosing your backup file under Restore configuration. If you purchased support with your FW- 525B, you also have access to the AutoConfigBackup service. This will encrypt your configuration and upload it to our servers every time you make a configuration change. Just don t lose your encryption key it s impossible for anyone to read the backup without the key, and the backup cannot be restored without the key. You can find more information here: What else can I do? The pfsense software provides a wide array of functionality beyond the simple configuration documented here. See the Additional Documentation section to find information on this functionality and more. A few of the most commonly used possibilities follow. Captive portal allows you to present a splash page to all users upon connecting to your network, optionally with authentication. This is commonly used with wireless hot spots, or as an additional layer of protection for wireless networks with authentication against a local user database, or external RADIUS server such as Microsoft Active Directory. 8

9 VPN three types of VPNs are supported, IPsec, OpenVPN and PPTP. You can use these options to connect roaming users for remote access, or site to site connectivity to connect multiple locations. Multi- WAN multiple Internet connections with failover and load balancing are supported. In combination with a VLAN capable switch, you can connect numerous Internet connections over a single physical interface on the firewall. Dynamic DNS if your public IP is dynamic, you may want to sign up with a dynamic DNS provider (many options are free) and use the Dynamic DNS client to keep your hostname updated. This is especially helpful if you want to access services like VPN remotely. Wireless with a wireless kit available from Netgate, your FW- 525B can act as a wireless access point, or be used in Ad- hoc networks. It can also connect to a wireless access point as a client use your neighbor s wireless as a second WAN (with permission, of course), amongst many other possible deployments. There is a hole on the rear of the FW- 525B with a removable dust- proof cap that can be used for a wireless antenna. Three additional knock- outs, removable via screwdriver or similar prying, are available on the case for future expansion one on the rear of the case, and two on the front for a total of four possible antennae in use at one time. Support There are numerous support options available for the pfsense software. Commercial Support If you purchased commercial support along with your system, you received information separately on accessing support. If you did not purchase support with the system but would like to do so, please supportinfo@pfsense.org or call Electric Sheep Fencing at Free Support Options There is a large community of pfsense users who volunteer their time to help others. You may find all the help you need through the community, though generally not as promptly as with commercial support, and with no assurance of response or a resolution. Forum There is a very active forum at Mailing Lists Mailing lists are also available, with information at IRC The official IRC channel is ##pfsense on FreeNode. 9

10 Using the serial console With the pre- assigned interfaces on the FW- 525B, you do not need to use the serial console to setup the device. You may want to access the console menu at times, for instance if you need to reset your admin password. The serial console port (COM1) is the COM port on the same side of the unit that has the power connector, Ethernet ports, and the (unused) VGA connector. The serial port on the FW- 525B requires using a null modem cable. Most network professionals should already have one; they come with many switches, routers and other network equipment (with Cisco being one notable exception). They can be found for purchase at many electronics stores, and considerably cheaper online. With the default firmware image, the VGA port is unused. Plug one end of the console cable into the console serial port on the FW- 525B (next to the power connector), and the other into a serial port on a computer with a terminal emulator. USB to serial adapters should work well for systems that don t have a serial port. The FW- 525B ships with the speed set to , but if the firmware image is manually reloaded or other changes are made that result in the serial console not working properly at , try using a speed of 9600 instead. Windows using PuTTY PuTTY is a free option for Windows that includes serial console support. For Connection type, select Serial. In Serial line, enter the COM port (e.g. COM1 or COM3). Lastly, for Speed, enter Windows using Hyperterminal Hyperterminal is another free option for Windows. 10

11 Configure it as shown in the following screenshot. Accessing the BIOS Using the Serial Console To access the BIOS while connected to the serial console, press the TAB key as the BIOS initializes. Additional Documentation This guide illustrates the basics for getting up and running with your FW- 525B. There is much more that can be accomplished with the pfsense software. The best source of information is the book pfsense: The Definitive Guide available from Amazon, Barnes & Noble, and other booksellers. If you purchased support, contact BSD Perimeter and they will provide the latest work in progress copy electronically. The book was written for pfsense 1.2.3, but the fundamentals and much of the GUI instructions still apply. There will be an updated book in the near future, available from the same retailers. There is also a growing amount of information freely available on the pfsense documentation site at 11