Académique Documents
Professionnel Documents
Culture Documents
Introduction
Thank you for your purchase of the Netgate FW-7541 with pfSense Certified 2.1.
The FW-7541 hardware platform in combination with the popular open source
pfSense software provides a powerful, reliable, cost-effective solution for your
network security needs.
This Quick Start Guide will help you get up and running with a basic configuration
on your FW-7541.
Plugging everything in
The system comes pre-assembled and ready to plug in and get started with
configuration. The following image shows the location of the WAN and LAN ports.
If you are replacing an existing firewall on a production network, you will want to go
through the initial configuration with the device not plugged into your production
network. You can plug a laptop or desktop PC into the LAN port to perform the
initial configuration. For new networks, you can start by plugging the LAN into your
switch.
Note: The FW-7541 Ethernet ports are auto MDI/MDI-X, meaning you can
use either a straight through or crossover CAT5 cable regardless of the type
of device you are connecting it to.
To get started, plug the LAN port into the network or system where you will
perform the initial configuration, and then plug in the power as seen in the image
below, which shows the rear side of the unit and the buttons/connectors found
there.
Initial Configuration
After powering on your FW-7541, it will boot up and be ready for the initial
configuration after approximately two minutes. The initial boot takes longer if your
WAN interface is not plugged into something where it can receive a DHCP address,
as it must wait for that to time out. Once the system is booted, you should receive a
192.168.1.X IP address on the system(s) plugged into the LAN port from the DHCP
server.
Setup Wizard
After logging in, the setup wizard will run. This will walk you through a few steps to
get up and running with a basic configuration. At the first screen, click Next. The
subsequent screen allows you to configure the hostname, domain and DNS servers
to be used.
Hostname
For hostname, choose a name for the host. This does not affect functionality.
Domain
If you have an existing DNS domain in use inside your network (such as a Microsoft
Active Directory domain), use that domain here. This is the domain suffix assigned
to DHCP clients, which you will want to match your internal network. For networks
without any internal DNS domains, you can fill in anything you want here.
DNS Servers
The DNS server fields can be left blank if you have a WAN connection using DHCP,
PPTP or PPPoE types of Internet connections and the ISP automatically assigns DNS
servers. When using a static IP on WAN, you must enter DNS server IPs here for
name resolution to function. You can specify DNS servers here even if your ISP
assigns different ones. Either enter the IPs provided by your ISP, or you may want to
consider using a service like OpenDNS (www.opendns.com) whose free service will
allow you to add content filtering and phishing protection amongst other benefits to
your pfSense install. Using Googles public DNS servers (8.8.8.8, 8.8.4.4) is another
popular choice.
Click Next.
WAN Configuration
This page is where your Internet connection is configured. You will need
information from your ISP to configure this screen appropriately. A few notes to
assist you:
MAC address if replacing an existing firewall, you may want to enter the old
firewalls WAN MAC address here, if you can easily tell what that is. This commonly
avoids issues involved in switching out firewalls, such as ARP caches, ISPs locking to
single MAC addresses, etc.
If you cant enter the MAC of your current firewall here, it probably isnt a big deal
power cycle your router or modem and your new MAC will usually be able to get
online. For some ISPs, you have to call when switching devices, or go through an
activation process of some sort.
Static IP configurations the subnet mask is configured in CIDR format, which is
usually provided by the ISP in addition to the 255.x.x.x subnet mask. The following
table shows the most common subnet masks and their CIDR equivalent.
Subnet Mask
255.255.255.252
255.255.255.248
255.255.255.240
255.255.255.224
255.255.255.192
255.255.255.128
255.255.255.0
255.255.254.0
CIDR
30
29
28
27
26
25
24
23
Block private networks and bogons these two options will block private,
unassigned, and reserved IP subnets for traffic initiated on your WAN connection
(i.e. coming in from the Internet). These IP ranges should never be seen on the
Internet, and these should both be enabled on systems that are directly connected to
5
the Internet. If your WAN resides on a private network, you may not want to use
these options.
Configure LAN Interface
Here you configure the IP and subnet mask to be used on your LAN. If you dont ever
plan to connect your network to any other network via VPN, the 192.168.1.x default
is fine.
If you want to be able to connect into your network using VPN from remote
locations, you should choose a private IP address range much more obscure than the
very common 192.168.1.0/24. Space within the 172.16.0.0/12 RFC1918 private
address block seems to be the least frequently used, so choose something between
172.16.x.x and 172.31.x.x for least likelihood of having VPN connectivity difficulties.
If your LAN is 192.168.1.x and you are at a wireless hotspot using 192.168.1.x (very
common), you wont be able to communicate across the VPN 192.168.1.x is the
local network, not your network over VPN.
IPv6 support for native IPv6 connectivity on the LAN and several variations
of IPv6 connectivity on the WAN is available.
Captive portal allows you to present a splash page to all users upon
connecting to your network, optionally with authentication. This is
commonly used with wireless hot spots, or as an additional layer of
protection for wireless networks with authentication against a local user
database, or external RADIUS server such as Microsoft Active Directory.
VPN three types of VPNs are supported, IPsec, OpenVPN and PPTP. You can
use these options to connect roaming users for remote access, or site to site
connectivity to connect multiple locations.
Multi-WAN multiple Internet connections with failover and load balancing
are supported. In combination with a VLAN capable switch, you can connect
numerous Internet connections over a single physical interface on the
firewall.
Dynamic DNS if your public IP is dynamic, you may want to sign up with a
dynamic DNS provider (many options are free) and use the Dynamic DNS
client to keep your hostname updated. This is especially helpful if you want
to access services like VPN remotely.
Wireless with a wireless kit available from Netgate, your FW-7541 can act
as a wireless access point, or be used in Ad-hoc networks. It can also connect
to a wireless access point as a client use your neighbors wireless as a
second WAN (with permission, of course), amongst many other possible
deployments.
Support
Newly-purchased eligible firewall products come with one year of Netgates
Premium Support. If you are eligible for this, you should have received a welcome
letter with your login credentials to http://support.netgate.com. This service
entitles you to access to our dedicated support portal for subscribers of Netgates
Premium Support, free updates to new version releases of pfSense Certified
pfSense 2.1, and much more.
IRC
The official IRC channel is ##pfsense on FreeNode.
Additional Documentation
This guide illustrates the basics for getting up and running with your FW-7541.
There is much more that can be accomplished with the pfSense software. The best
source of information is the book pfSense: The Definitive Guide available from
Amazon, Barnes & Noble, and other booksellers. If you purchased support, contact
BSD Perimeter and they will provide the latest work in progress copy electronically.
The book was written for pfSense 1.2.3, but the fundamentals and much of the GUI
instructions still apply. There will be an updated book in the near future, available
from the same retailers.
There is also a growing amount of information freely available on the pfSense
documentation site at http://doc.pfsense.org.
10