Install a pfSense Firewall in Oracle Cloud Infrastructure
pfSense is a firewall that can be used for production or testing purposes where you can simulate the Oracle Cloud Infrastructure (OCI) native firewall services. This pfSense firewall set up can be used inside a hub and spoke VCN routing scenario.
pfSense is not officially supported on Oracle Cloud Infrastructure by Netgate or Oracle. Contact the pfSense support team before trying this tutorial.
The following image illustrates how the environment will look like when you are finished with the deployment and configuration.
Objectives
- Set up a pfSense firewall inside OCI. We will make adjustments to routing and security lists so that the pfSense firewall can be managed properly and we will do some ICMP tests to verify connectivity.
Prerequisites
- Before we start setting up the pfSense firewall inside OCI it is important to have another instance that can connect to the new pfSense firewall using its web browser to perform management on the pfSense firewall. In this tutorial, we have created a Windows instance to do this. Make sure you have something similar.
Task 1 - Download the pfSense Image
- Download the pfSense image from the Netgate website. Ensure to download the `memstick-serial` version. The filename of the image that we are using is `pfSense-CE-memstick-serial-2.7.2-RELEASE-amd64.img.gz`. For more information, see [Netgate].
1. The image will be in the `.gz` format.
2. If you are using OS X, right-click on the compressed file and click Open with.
3. Select Archive Utility (default) to uncompress the image.
- Notice that the image filename is `pfSense-CE-memstick-serial-2.7.2-RELEASE-amd64.img`.
Task 2 - Create an OCI Object Storage Bucket
In this task, we will create an OCI Object Storage bucket that will use to upload the pfSense image and used to create a custom image.
- Create a storage bucket.
1. Click the hamburger menu (≡) from the upper left corner.
2. Click Storage.
3. Click Buckets.
- Click Create Bucket.
1. Enter a Bucket name.
2. Select Standard storage tier as Default Storage Tier.
3. Click Create.
- Notice that the storage bucket is created.
Task 3 - Upload the pfSense Image to the Storage Bucket
- Upload the image that we have downloaded in Task 1.
1. Scroll down.
2. Click Upload.
- In the Upload Objects screen, enter the following information.
1. Enter Object Name Prefix.
2. Select Standard as the Storage Tier.
3. Click select files and select the pfSense image.
4. When you have selected the pfSense image you will see it in the following section.
5. Click Upload.
- While the pfSense image is uploading into the storage bucket, you can monitor the progress.
1. When the pfSense image is fully uploaded the progress status will be Finished. 2. Click Close.
Task 4 - Create a Custom Image
We have uploaded the pfSense image. Now, we need to create a custom OCI image from this uploaded image. This custom OCI image will be used to create the pfSense firewall instance.
- Create a custom image.
1. Click the hamburger menu (≡) from the upper left corner.
2. Click Compute.
3. Click Custom Image.
- Click Import Image.
- In the Import image section, enter the following information.
1. Enter a name.
2. Select Generic Linux as Operating system.
3. Select Import from an Object Storage bucket.
4. Select the storage bucket where you uploaded the image.
5. In Object name, select the pfSense image.
6. Select VMDK as Image type.
7. Scroll down.
- Keep other fields default and click Import Image.
1. Notice that the status is IMPORTING.
2. Scroll down.
1. Notice the state is In progress.
2. Monitor the progress.
1. After a few minutes, status is AVAILABLE the state will change to Succeeded.
2. The % Complete will be 100%.
Task 5 - Create an Instance with the Custom pfSense Image
- Create an instance.
1. Click the hamburger menu (≡) from the upper left corner.
2. Click Compute.
3. Click Instances.
1. Click Create instance.
1. Enter the instance Name.
2. Scroll down.
- Click Change Image.
1. Select My images.
2. Select Custom images.
3. Scroll down.
1. Select the custom image created in Task 4.
2. Click Select image.
1. Notice that the pfSense image is selected.
2. Scroll down.
1. In Primary network, select Select existing Virtual cloud network.
2. Select the VCN that you want to attach to the pfSense instance.
3. In Subnet, select an Select existing subnet.
4. Select the Subnet that you want to attach to the pfSense instance.
5. Scroll down.
1. Select Manually assign private IPv4 address.
2. Enter an IPv4 address.
3. Scroll down.
1. Select No SSH Keys.
2. Scroll down.
- Click Create.
- Notice the status is PROVISIONING.
- After a few minutes, the status will change to RUNNING.
- The following image illustrates the visual representation of what you have created.
Task 6 - Install pfSense on the Instance
We need to do the initial installation and set up of the pfSense firewall. We already have the running instance.
- To install the pfSense firewall software, we need to create a console connection.
1. Scroll down.
2. Click Console connection.
3. Click Launch Cloud Shell connection.
- Notice that the Cloud Shell window will open.
- A few startup messages will show up. Press ENTER.
- Read the copyright messages and select Accept and then press ENTER.
1. Select Install pfSense.
2. Select OK and press ENTER.
1. Select Manual Disk Setup (experts).
2. Select OK and press ENTER.
1. Select da0 - 47 GB MBR.
2. Select Create and press ENTER.
1. In Type, enter freebsd.
2. In Size, enter 46 GB.
3. Enter Mountpoint.
4. Select OK and press ENTER.
1. In da0s4, select 46 GB BSD.
2. Select Create and press ENTER.
1. In Type, enter freebsd-ufs.
2. In Size, enter 40 GB.
3. In Mountpoint, enter /.
4. Select OK and press ENTER.
1. Notice that the mountpoint is created for `/`.
2. In da0s4, enter 46 GB BSD.
3. Select Create and press ENTER.
1. In Type, enter freebsd-swap.
2. In Size, enter 5770 MB.
3. Enter Mountpoint.
4. Select OK and press ENTER.
1. Notice that the mountpoint is created for swap.
2. Select Finish and press ENTER
- Select Commit and press ENTER.
- The installation will start Initializing the set up.
The installation will do a quick Checksum verification.
The installation will do an Archive Extraction.
- You will get a message Could not locate an existing `config.xml` file! as this is a new installation.
- Select Reboot and press ENTER.
- After the first reboot you will get a few configuration options to configure the WAN interface.
- For Should VLANS be set up, enter n and press ENTER.
- For Enter the WAN interface name or 'a' for auto-detection (vtnet0 or a), enter `vtnet0`.
- In this set up, we are creating a firewall with only one interface, so we will not configure the LAN interface, therefore, for Enter the LAN interface name or 'a' for auto-detection, press ENTER to skip this interface set up.
1. Verify the WAN interface name.
2. For Do you want to proceed, enter y and press ENTER.
- Notice some messages and the configuration will be done.
- The pfSense OS will do a full boot.
1. You will see that the IP address will be configured using DHCP.
2. Note the pfSense menu to do some additional basic configuration.
Task 7 - Connect to the pfSense Web Graphic User Interface -GUI- and Complete the Initial Set up
The installation is finished, now we need to connect to the web interface of the pfSense firewall. But before this, we need to open some ports on the security list of the VCN.
- Add ingress rule.
1. Click the hamburger menu (≡) from the upper left corner.
2. Click Virtual Cloud Networks or navigate to Networking and Virtual Cloud Networks.
- Select the VCN to which your pfSense firewall is attached.
1. Scroll down.
2. Click Security Lists.
3. Click the Default Security List for HUB-VCN.
- Click Add Ingress Rules to create the ingress rule.
1. In Source Type, enter CIDR.
2. In Source CIDR, for this tutorial, enter `172.16.0.128/25`. This is the subnet which has the Windows instance, that we will be using to connect to the pfSense firewall using the browser.
3. In IP Protocol, enter TCP.
4. In Destination Port Range, enter `80,443`.
5. Click Add Ingress Rules .
- Notice that the Security Rule is added to allow the TCP/`80` and TCP/`443` ports on the security list that is attached to VCN. This will allow you to set up an HTTP and HTTPS connection from the Windows instance to this new pfSense firewall instance.
1. Navigate to the Compute and Instances.
2. Make a note of your pfSense firewall IP address.
1. In your Windows instance, open a browser and navigate to the pfSense firewall IP using HTTPS.
2. Click Advanced.
- Click Continue.
1. Enter default username as `admin`.
2. Enter default password as `pfsense`.
3. Click Sign In.
- Click Next.
- Click Next.
1. Enter a hostname.
2. Enter a domain name or keep domain name default.
3. Scroll down.
- Click Next.
- Click Next.
If you are into networks this may look a bit weird as we have specified to use a static IPv4 address during the instance creation. The way how it works in this particular case is that Oracle will reserve the static IP in its DHCP server, and will assign this address to the pfSense firewall. So the pfSense firewall will always get the same IP address, but from the OCI perspective, this will be a static IP, and from the pfSense perspective this will be a DHCP address.
1. In Configure WAN interface, select DHCP.
2. Scroll down.
1. Keep all the IP address settings default.
2. Scroll down.
- Scroll down.
- Click Next.
1. Enter a new admin password.
2. Enter a admin password again.
3. Click Next.
- Click Reload.
- Notice that the pfSense firewall configuration is reloaded.
- Scroll down.
- Click Finish.
- Scroll down.
- Click Accept.
- Click Close.
- The following image illustrates a visual representation of what you have created. Notice that we will use the Windows stepping stone to connect to the pfSense firewall.
- If the pfSense firewall is not able to reach the internet, the dashboard page will take a bit longer to load. But this can be fixed by allowing the pfSense firewall to the internet by using the OCI NAT gateway.
1. Notice that the pfSense firewall is installed and the dashboard is visible.
2. Notice that the support information is not available. This is because the pfSense firewall is installed on a private subnet and this private subnet is not able to reach the internet by default.
- Let us route the internet traffic towards the NAT gateway. Make sure you have a NAT gateway present in the VCN.
1. Click the hamburger menu (≡) from the upper left corner.
2. Click Virtual Cloud Networks or navigate to Networking and Virtual Cloud Networks.
- Select the VCN where your pfSense firewall is attached to and the NAT gateway is present.
1. Click Route Tables.
2. Click Default Route Table for HUB-VCN.
1. Notice that the default route table has a route in there that will route all the traffic towards the internet gateway. This is not usable for us as we need to route the traffic for the private subnet towards the NAT gateway.
2. Click HUB-VCN to go back one page from Route Table Details page.
- To route the traffic towards the NAT gateway for a specific subnet we need to create a new route table and attach that route table to the private subnet. Click Create Route Table.
1. Enter a name.
2. In Target Type, enter NAT Gateway.
3. In Destination CIDR Block, enter `0.0.0.0/0`.
4. Scroll down.
1. Select the NAT Gateway that you already have available in the VCN. If you do not have a NAT gateway, click Cancel and create a NAT gateway.
2. Click Create.
1. Notice that the static route towards the NAT gateway is now created.
2. Click HUB-VCN to go back one page from Route Table Details page.
- Notice that you have created a new route table.
- Now, it is time to bind that route table to the subnet.
1. Click Subnets.
2. Click Private subnet, the subnet to where the pfSense instance is currently attached.
- Click Edit.
1. Select the route table you just created.
2. Click Save Changes.
- Notice that the route table has been changed for the private subnet.
- Go back to the Windows instance.
1. Refresh the page.
2. Scroll down.
- Click Accept.
- Click Close.
- Notice that the Netgate Services and Support section will change.
- The response time of the dashboard page will also be quicker.
- Use the pfSense web management interface.
1. Click Firewall. 2. Click Rules.
- Notice the default rules of the pfSense firewall.
- The following image illustrates a visual representation of what you have created.
- Notice that the NAT gateway will be used so that the pfSense firewall can communicate with the internet.
- Notice we have also opened ports TCP/`80` and TCP/`443` on the default security list.
Task 8 - Verify the Connectivity with Ping
- Verifying the connectivity using ping (ICMP) is a good starting point for testing.
1. In the Windows instance, open the Command Prompt and try to ping the pfSense firewall IP address.
2. Notice that the ping results are showing a 100% packet loss.
- To solve this, we need to:
- Open Internet Control Message Protocol (ICMP) on the default security list that is attached to the VCN.
- Open ICMP on the pfSense firewall.
- Let us first start with the default security list.
1. Click the hamburger menu (≡) from the upper left corner.
2. Click Virtual Cloud Networks or navigate to Networking and Virtual Cloud Networks.
- Select the VCN, where your pfSense firewall is attached and has the NAT gateway.
1. Scroll down.
2. Click Security Lists.
3. Click Default Security List for HUB-VCN.
- Click Add Ingress Rules to create the ingress rule.
1. In Source Type, enter CIDR.
2. In Source CIDR, enter `0.0.0.0/0`.
3. In IP Protocol, enter ICMP.
4. Click Add Ingress Rules.
- Notice the ICMP rules we have just added.
- In the pfSense firewall management interface, click Firewall, Rules and Add to add a new rule.
- Enter the following information.
1. Action: Select Pass.
2. Protocol: Select ICMP.
3. ICMP Subtypes: Select Any.
4. Scroll down.
1. Source: Select Any.
2. Destination: Select Any.
3. Click Save.
1. Notice that the new ICMP rule is in place.
2. Click Apply Changes to commit the changes.
- Notice that the changes have been applied successfully.
1. In the Windows instance, open the Command Prompt and try to ping the pfSense firewall IP address.
2. Notice that the ping results are showing a 0% packet loss.
- Another ping test that we can do is from the pfSense firewall towards the internet.
1. Click Diagnostics.
2. Click Ping.
1. In Hostname, enter `8.8.8.8`.
2. Click Ping.
- Notice that the ping results are showing a 0% packet loss.
- The following image illustrates a visual representation of what you have created. Notice we have also opened ICMP on the default security list.
Conclusion
In this tutorial, we explained all the necessary steps that you required to set up a pfSense firewall inside OCI. We made adjustments to routing and security lists so that the pfSense firewall can be managed properly and we also did some ICMP tests to verify connectivity. This pfSense firewall setup can be used inside a Hub and Spoke VCN Routing scenario.