Home Lab Fun: Virtualize a Domain :: Part II - Router Configuration

Part II: Router Configuration

Introduction. Detailed instructions on the installation of pfSense is not covered in this post but is fairly straight forward. The general steps are:

1. Download pfSense

2. Download and install Virtualbox

3. Create a virtual machine in Virtualbox.

4. Determine the ram and HDD space you want the machine to have, the defaults should suffice.

5. Create two adapters, one bridged to your computers NIC and the other set as 'Host Only'. Be sure to use a different network name. This will be crucial for DC2 as this name logically separates those two network.

6. Tell the VM to boot from the pfSense ISO. Instructions here.

7. Follow the prompts to install the operating system.

8. Detailed instructions are here.

Optional: Make the pfSense WebGUI accessible on the WAN. If you would prefer to access the pfSense WebGUI from the host computers browser instead of within the virtual environment, here are the steps:

1. Go to 'Firewall -> Rules -> WAN'. Create a new rule.

• Action: 'Pass'.

• Interface: 'WAN'.

• Address Family: 'IPv4'.

• Protocol: 'TCP'.

• Destination Port Range: 'HTTPS (443)'.

• Click 'Save' and 'Apply'.

• The WebGUI is accessable at: 'https://x.x.x.x' where x is the DHCP address that the primary routed assigned the virtualized pfSense instance.

Creating the IPSec Tunnel. The two offices, Denver and Boston (192.168.0.0/24 and 192.168.1.0/24, respectively) are on completely different networks, separated by an ISP (192.168.2.0/24). Keep in mind the two phases of IPSec accomplish two very different tasks, the first sets up the encryption and resulting data confidentiality and integrity and the second actually establishes the link between the two networks. The general steps in setting up IPSec in pfSense are:

First Router:

Phase 1:

1. Go to 'VPN -> IPSec' and click 'Add P1'.

2. Key Exchange Version: 'IKEv2'.

3. Internet Protocol: 'IPv4'.

4. Interface: 'WAN'.

5. Remote Gateway: Whatever you will assign to the second pfSense instance, I.E. 192.168.2.205, or what your primary router hands out in DHCP.

6. Description: Whatever you want

7. Authentication: 'Mutual PSK' in other words a Preshared Key.

8. My Identifier: 'My IP Addess'

9. Peer Identifier: 'Peer IP Address'

10. Preshared Key: Whatever you want, longer and unique is better.

11. Encryption Algorithm: 'AES'

12. Hash Algorithm: 'SHA256'

13. Everything else: Leave as the defaults

Phase 2:

1. Click 'Add P2'

2. Mode: 'Tunnel IPv4'

3. Local Network: 'LAN Subnet'

4. NAT/BINAT Binding: 'None'

5. Remote Network: 'Network' '192.168.1.1/24'

6. Description: Whatever you want.

7. Protocol: 'ESP'

8. Encryption Algorithm: 'AES'

9. Hash Algorithm: 'SHA256'

10. PFS Key group: 'Off'

11. Lifetime: '3600'

12. Automatically Ping Host: '192.168.1.1'

Click 'Save'

Second Router:

1. Duplicate the same exact settings but don't forget to change the 'Remote Gateway' in Phase 1 and 'Automatically Ping Host' in Phase 2.

2. You can also create the firewall rule as outlined earlier to access the WebGUI from the WAN.

3. Go to 'Status -> IPSec' and click 'Connect'.

4. Verify that there is a connection, if not check and make sure that the settings are correct.

5. You can also run a ping test by going to 'Diagnostics -> Ping Test'. Change the 'Hostname' to the internal address of the other router, I.E. '192.168.1.1' and 'Source address to 'LAN'.

6. Lastly, you can run a packet capture by going to 'Diagnostics -> Packet Capture'.

---

Continue to Part III: Server Configuration