pfSense

[Sin_Chase]

Is the absolute bomb......no idea why I did not do this sooner.

It has also totally resolved an issue my router/modem combo had which would see it drop the connection for a millisecond (Line still trained/Authentication still up). Would boot me from games/IM but reconnect seconds later. Very very annoying.

I'm running it off an ancient lenovo desktop, P4 3GHz, 1GB RAM with the onboard NIC and 1 PCI expansion NIC.

Ontop of that you would expect out of a router/firewall (DHCP etc) pfsense is now running:

PPTP VPN endpoint (Road warrior connection back home for remote access or secure net usage on mobile devices)
SSH Server (Road warrior port tunneling where VPN cannot be connected or SSH client is only option)
Traffic Shaping (More than myself uses the internet connection)
Nice custom rulesets to disallow connections to unauthorised DNS servers as specified by me (Quick and easy block against any DNS hijack exploits)

If anyone has ever considered building their own router/firewall on kit they have laying around I say go for it - It's powerful and fun to do anyway! Does not even need to be super powerful hardware although headroom helps when you start loading up the filters, services and any extra packages. The Antivirus and peerblocking packages look pretty interesting and will have to give them a try.

Having a proper PPTP VPN endpoint is a godsend for my Android devices

 

[Sin_Chase]

Sounds awesome, but the price / performance / leccy bill seriously holds me back.

Leccy isnt an issue if you get a small embedded system or mini-itx. No more than a consumer router really.

pfSense also supports power states so it downclocks CPU etc when not needed. This desktop ticks over at 300Mhz most of the time.

 

[Sin_Chase]

My desktop is basically a full ATX so drawing much more than a mini-itx or embedded system but I do not really care overly much about the draw. THis was more of an experiment in the first instance but I am so happy with it I plan to keep it as my permanent firewall/routing system. In the coming weeks/months I am going to research a nice low power Mini-ITX with headroom for a FTTP 1Gbit/100Mbit connection.

The difference between 5 watts and 30watts is next to nothing over the course of a year though.

 

[Sin_Chase]

1 annoying thing with pfsense.

Will not take a WAN gateway outside of the assigned interface IPs subnet. Rather annoying seeing as my ISP issues IPs in 213.133.215.x and has a gateway on 213.133.195.x

It can be fixed by manually adding -net and default routes but those routes get over-written whenever the interface has a state change. That completely rules out using DHCP to assign the WAN IP.

Sucks big time as I just finished writing my DHCP script on a DG834GT with a half-bridge setup. My new DHCP script dishes out my WAN IP on DHCP whenever the PPP connects instead of issuing useless LAN subnet addresses to my pfsense WAN interface.

Apparently it's a limitation of freeBSD not allowing you to use gateways in a different subnet.

Bizzare really as Windows will do it no worries and even add the routes for you.

 

[Sin_Chase]

Plan is for Sky box, Vodafone SureSignal, Humax , sony blu raybox etc. to all sit in DMZ in front of the pfSense box with all my other kit sat on my main LAN

Why do you want them in a DMZ? Can you not NAT them as with other devices?

 

[Sin_Chase]

Are you sure? I screwed things up by setting the wrong IP on the WAN gateway once.....so I had a fiddle and BANG....screwed things up again but I'm not sure in a way that helps you.
Even reverted back to the correct settings and that didn't work until I cycled the interface. Back online now

Long and short - static IPs FTW with pfsense.

Yes, positive.

It's a documented issue with the manual input of routes listed as the workaround.

Gateway being in a different subnet to the WAN IP is a rare and strange setup but it does exist.

I have to tell FreeBSD which interface to find my WAN gateway on (wan interface) then set the default route to that gateway.

Basically:

route add -net WAN-Gateway-IP/32 -iface WAN-Interface
route add default WAN-Gateway-IP

 

[Sin_Chase]

Have you looked at Alix sys-boards for pfSense as these are a neat all in one solution.

They are neat but only have Fast Ethernet, no Gigabit. As long as your connection to the outside world is less than 100Mbit you should be fine, although even with Gigabit Ethernet I am not sure an Alix board could route much faster than 100Mbit anyway, especially not when adding additional filters like snort.