[guide] pfsense VM on QNAP in 2020

[Trexx]

Thanks M . I do appreciate all that you have been contributing to the community.

Since my little girl was born (right after Christmas), my community time has been very limited due to kids time and less free time at work to do occasional posting during the day.


Sent from my iPhone using Tapatalk

[Moogle Stiltzkin]

...

yeah np. just did it while it was still fresh in my mind how to do it

oo gratz

yeah i didn't see you on much. i'm also awol every now and then. but i've been active lately.

good to see you back.

[Moogle Stiltzkin]

in this section, i am repurposing my previous router, the AC68U as a wireless ap for use with the pfsense vm setup on qnap nas.

ac68u using rt merlin works, but i wanted to set it up so it can vlan tag 30, so that any devices connected to it, would auto be in the guest vlan. basically they have internet access, but now have access to my private lan where i keep my more secure devices. i want to partition of less secure devices, from being able to interact with the rest of my other more important devices

but rt merlin does not seem to have vlan tagging capability. instead it has a guest mode done internally. but i'm not sure that works with the guest vlan settings setup on pfsense which tags that to vlan 30.


okay so i reflashed ac68u to fresh tomato, to find out whether they have vlan tagging or not. features say it can configure vlans
https://www.freshtomato.org/features.html



asus firmware does not want you to flash third party firmwares..... so i had to do a work around (using the asus restoration utility) >_>: This guy's guide for that worked
https://www.reddit.com/r/TomatoFTW/comm ... tac66u_b1/


success



after doing basic configuration, i ran iperf server on pfsense, then iperf client on tomato and ran a benchmark. seems to work fine



found the vlan and also virtual wireless settings. now i just need to configure it





just to be fair to asus stock (rt merlin), they do provide guest vlan access. There is an option for guest wifi, and an option to toggle allow internet only, or also lan access as well. The asus method is more newbie friendly, and does not require complicated settings to do. But because i am using pfsense, i have to do the vlan tagging, which the default asus firmware does not provide. so had to look elsewhere at freshtomato. Another option would be ubiquiti wireless ap which vlan tagging in the settings as well.


https://www.reddit.com/r/TomatoFTW/comm ... se_router/

[Moogle Stiltzkin]

confirmation that installing packages and updating from pfsense admin web ui works just fine




i haven't quite tested whether i can update pfsense from the web ui.... i probably didn't wait long enough for it to move along, and thats why it felt like it was stuck ?

but for pfsense upgrade i was more comfortable doing it via the shell as i suggested in the short version guide. up to you how you want to do yours, i just report what seemed to work best for me

[Moogle Stiltzkin]

more troubleshooting.

i discovered a time out of sync error by checking status > logs

Code: Select all

Oct 18 15:27:23 kernel calcru: runtime went backwards from 80 usec to 48 usec for pid 12 (intr)
Oct 18 15:27:23 kernel calcru: runtime went backwards from 13724059 usec to 8110152 usec for pid 12 (intr)
Oct 18 15:27:23 kernel calcru: runtime went backwards from 822462 usec to 502252 usec for pid 12 (intr)

https://forum.netgate.com/topic/121656/ ... -backwards

matguy Dec 31, 2012,

Virtual Machine Specific info:

Time issues that manifest in all sorts of different error messages are common on just about all virtual machine hosting environments due to how most OS's track time via processor ticks. As a side effect of virtualization, a virtual machine simply doesn't get every processor tick (otherwise you'd have full cores or more devoted to each VM.) So, you get time drift, which is handled usually by some sort of application/tool/service that runs within the virtual machine, in VMWare virtual machines you run the VMWare tools (or some equivalent, often open source, version for less supported OS's), that periodically pulls time back to the reality reported by the VM host (which, itself may be set and time maintained via NTP.)

My theory on what's happening to you:

When you have 2 or more time sources competing and re-setting time like that, you can easily get a situation where one may over-shoot the other as they'll rarely be in perfect sync (or some other latency may introduce some variations.) I can't tell you what is best for your situation, but, assuming you're not otherwise relying on pfSense for some kind of time sync on your network, I would probably set ESXi via NTP and let the VM-tools keep the pfSense OS in sync, not use NTP in pfSense itself. VMWare will set the Virtual BIOS time via it's local host time (which may be set via NTP) so that your pfSense OS will get time from BIOS on boot, then VMWare tools should keep the OS up to date from there.

Supermule Banned Jan 1, 2013,

Yes, but if you use your AD based on VMtools in your guest OS, thats the right way to do it.

Let VM handle the NTP and not your guest OS.

Thats why I think it would be better if it could be turned of in PFsense if it detects vmtools package….

https://forum.netgate.com/topic/51494/r ... ackwards/3



i suspect this works. because after i applied it in pfsense > general settings, then i deleted logs, then looked at logs, i no longer see the ntp issue spamming.

Code: Select all

time.nist.gov pool.ntp.org time.google.com

[–]diyoot

I have following pools added in my ntp settings and it seems to work fine.

time.nist.gov
pool.ntp.org
time.google.com

https://www.reddit.com/r/PFSENSE/commen ... t_of_sync/



everytime you snapshot revert, it will ask you about sync time, what to do. guest tools? i had no idea so i just click yes.



TIP: for troubleshooting pfsense, focus most on "Status > System Logs". And if you got pfblocker running, look at "Firewall > pfBlockerNG > Alerts > reports", diagnostic > ARTP tables


another thing i learned. if you are in pfsense shell (via virtual station cmd), and say you typed "8" but you later want to go back to the other options, then the solution is to type "exit" then enter, without the quotes. So no you don't have to reboot pfsense. Maybe this is obvious to the experienced techies out there, but i'm not a command line user (not my cup of tea), but i'm learning some new tricks bit by bit

[Moogle Stiltzkin]

another thing i spotted in system logs

zorro_66 Apr 27, 2016,

What does this message mean :-[ :-[

Apr 26 19:31:46 pfsensefirewall.localdomain nginx: 2016/04/26 19:31:46 [error] 24577#0: send() failed (54: Connection reset by peer)

phil.davis Apr 27, 2016,

Something on the other end sent a reset (RST).
e.g. this explanation: http://stackoverflow.com/questions/1434 ... -peer-mean

So the "something" did not go away completely (unplugged, powered off…) - it actually sent an RST (and went away).

cmb Apr 27, 2016,

What Phil said. Specifically, something that was communicating with the web GUI's web server. Likely normal and safe to disregard.

https://forum.netgate.com/topic/98999/5 ... -by-peer/3

[peelos]

Another pfSense user checking in - personally run on a mini QOTOM PC with i5 / 8G RAM /128G SSD - model "Q350G4" - figured separate device would be most flexible, I use the built in XML backup function instead of snapshots, I wanted a dedicated OpenVPN server to dial back home and be able to update NAS firmware etc remotely.

Huge thread, thanks for sharing - a lot of further reading for a "rainy lockdown"!

[Moogle Stiltzkin]

np. i'm just sharing what i've learned tinkering around with pfsense so far on qnap vm pfsense.

how are things on qotom? i'm particularly interested about the temperature on it. that was one of the things that held me back from getting one because i wasn't sure. does it have a fan inside? or is it passive cooling. i had a nightmare with my asus ac68u having to resort to using a loud fan to keep it cooled. wanted to make sure my next router replacement didn't have that issue

[peelos]

I once had an issue where log files filled the SSD but that was a user error, was quickly resolved and otherwise it has been extremely stable and has not crashed once in the 2 years it's been running 24/7 with thousands of torrent connections running through it.

Passive cooling, fanless and silent with temperature currently at 51 degrees centigrade.

Overall I have been very pleased with it.

The last hardware specs for reference: http://www.qotom.net/product/28.html - purchased on aliexpress from the official qotom store.

[Moogle Stiltzkin]

I once had an issue where log files filled the SSD but that was a user error, was quickly resolved and otherwise it has been extremely stable and has not crashed once in the 2 years it's been running 24/7 with thousands of torrent connections running through it.

Passive cooling, fanless and silent with temperature currently at 51 degrees centigrade.

Overall I have been very pleased with it.

The last hardware specs for reference: http://www.qotom.net/product/28.html - purchased on aliexpress from the official qotom store.

which is the latest recommended qotom to get? at a good budget price that is capable of vpn and suricata for 100-600 mbps broaband? I don't think i need an I7 do i?
https://www.reddit.com/r/PFSENSE/commen ... om_to_get/

i was looking at between the i3-i5. or whether an intel celeron for lower power consumption would be sufficient (not to mention uses less power which is nice for a 24/7 router)

[–]drbiggly

3 points 12 days ago
I ordered a Qotom quad-NIC (Intel) about three years ago. I can't remember which processor is in it, but it's below the i3 (maybe one of the Celerons?) 8GB RAM and a 32GB SSD. No wireless.

I have gigabit fiber at home and it routes it reliably as fast as the ISP will allow (up to about 950Mbps.)

Snowpeaks14

The i3 is be fine. The i7 will future proof you, easily handle higher speeds as they become available for longer than the i3.

[–]Frnott

The i3 should handle gigabit fine. If OP were to get faster internet, they would need fasters NICs anyway.

Drumdevil86

Neat little box, however;

I ran pfsense off a J1900 for about a year. It looked like the holy grail with it's 10W TDP and 4 cores. But the CPU is slow, and definitely not built for this. They might replace a basic consumer router, plus some lightweight enterprise and VPN capabilities, but that's about it.If you start using say pfblocker to block malicious links, IP's and even advertisements, performance will quickly degrade to the point you start losing WAN connectivity.

I replaced mine with an older Optiplex 390, i5 2500 CPU and 2 server NIC's. Happy ever since.

gimgunwoo

I bought a similar box like that from aliexpress, endedup not able to use it because of heat. When booting it's about 35-40c, but reaches 60+c when idling without a fan. It eventually shut itself down. I reapplied better thermal paste and that didn't really help at all. It cost almost $200CAD for that. Some probably got good experiences with them but I am not one of them.

I got a SFF thinkcentre, will use it for ESXi or proxmox to virtualize pfsense.

https://www.reddit.com/r/homelab/commen ... d_for_vpn/

Will a Celeron 3865u route at gigabit?

Rrajl Dec 6, 2017

I have found a number of boxes on AliExpress like this one:

https://www.aliexpress.com/item/Eglobal ... 44734.html

I know that the more expensive Core i3-7100u will be able to handle gigabit routing. But I am curious if the cheaper Celeron 3865u would also be able to route at gigabit speeds. For reference, the specifications for the Celeron are:

https://ark.intel.com/products/96507/In ... e-1_80-GHz

Thanks for any feedback you can provide.

rajl Dec 7, 2017, 2:35 AM
Thanks for the input. I have one follow up question:

How much "other stuff" (e.g., squid, Suricata/Snort, PFBlocker, OpenVPN, etc.) can I have running and still be able to route traffic at gigabit speeds with that celeron pocessor?

Thanks

newabc Dec 7, 2017,
@rajl:

I don't think the celeron 3865u can do so many stuffs and not lower your speed. An i3-7100u box from Minisys or i5-5250u from Qotom will be better. Of cause, if you consider desktop cpu i3-7100 or 4 core i3-8100 will be much better.

a situation where your pfsense device only has 1 ethernet port

saw_bra_guy_at_gym

Hi /u/emolinare

- This is a wonderful tutorial. I tried this with my Lenovo M93P which had just one ethernet port and a TP Link 8 Port POE switch. It works fantastic. I have Spectrum's 400Mbps plan. With hard wired speed test, I got 350down and 120up.

I even activated Suricata, pfBlockerNG when the above speeds are witnessed. One complain that I have is latency issue. The latency is really really high. I know the reason. Because WAN & LAN has to go through one port and there will be bottlenecking. I just wanted to share my 2cents with people who might be wondering about the speeds. Keep in mind this setup has been removed now because I wanted to add more VLANs via my PFSENSE to my security cameras and I didn't know how. So I just let it pass. Thanks again.

[–]durianbusuk

For most people at home, this is a very practical solution. Anyone thinking of getting a PC with a single nic from somewhere like aliexpress can do much better getting a used dell optiplex 9020m which is the smallest of the optiplex units. 4th gen i5 processors and typically comes with 4-8gb of ram and if you're lucky, an SSD. The NIC is an intel one too. The processor will beat anything qotom or minisys sells in aliexpress.

​

You may notice in aliexpress, anything with more than 1 nic, and with 'pfsense' in the item name gets a +$200 bump in price. This post is such a breath of fresh air for those cash strapped individuals like me.

https://www.reddit.com/r/PFSENSE/commen ... o_pfsense/


Differences between intel quad nics, and which is better with pfSense?

BugKiller

I purchased an Intel I350 T4 V2 BLK for my R210ii. Works 100%.

I run pfSense bare metal now, but I have run a pfSense VM on a dell R710 with ESXi with the same network adapter and with no issues.

I just didn't like the extra "complexity" and taking out my internet when I wanted to do updates my single ESXi host.

Note: Normal hygiene applies. i.e Update server BIOS, Update adapter firmware, etc.

seaQueue

If you want the option to use SR-IOV VF passthrough (virtually split the card in hardware, hand hardware virtualized copies to your VMs) you want an Intel I350-T4.*see below

If you don't care about SR-IOV you probably want an Intel I340-T4. They're relatively cheap at $15-25 for an HP NC365T and much more power efficient than the Pro/1000 VT. The Pro/1000 VT also goes by HP part number NC364T but in almost all cases you're better off spending the extra $5 for the I340.

If you're interested in 10Gb hardware you could also look at the Intel X520 or the Chelsio T420, they'll both run you around $60 on eBay.

* (Note: Be careful ordering I350 based cards on eBay, there are a large number of counterfeit cards for sale by Chinese vendors. They work, but have unknown reliability.

https://www.reddit.com/r/PFSENSE/commen ... _which_is/



lawrence mentions for home user, 4gb should be fine for snort home user. not sure about suricata, 8gb? 16gb ram?
https://www.youtube.com/watch?v=KRlbkG9Bh6I

i was checking a local online e seller, but when i check specs whether cpu has aes-ni some models don't, which explains the cheaper price lots of lands mines if not careful.

yeah 51c is acceptable for me. unlike this asus i got that goes 70-80c .... sometimes 90c ..... (in router mode under normal load usage)

whats the aliexpress link for official qotom store? is this it?
https://qotom.aliexpress.com/store/108231


i also saw other options like this
https://teklager.se/en/products/routers/tlsense-i5-4lan

it's basically a qotom... but they charge you more ...


anyway i want to get a qotom, but the site is just bombarded with a ton of models i'm confused which to get

is this the one i should get? price is within my budget and it's configured with all the hardware. but i will be a bit more comfortable formating it and reinstalling myself (that part i can do easily). Just not sure if this is the model i should, or whether i should be looking at intel celeron models


https://www.aliexpress.com/item/32863060778.html

Intel Core i3 5005U
Released January, 2015
2 GHzDual core

Power Consumption

TDP 15W
Annual home energy cost 3.61 $/year
Performance per watt 50.34 pt/W
Typical power consumption 12.19W

LAN Chipset

4 x Intel I211-AT Gigabit LAN

http://cpuboss.com/cpu/Intel-Core-i3-5005U

and it has aes-ni
https://www.intel.com/content/www/us/en ... 5005u.html


Intel Core i3-5005U vs Intel Core i3-6100U
http://www.cpu-world.com/Compare/840/In ... 3%20memory.

but that 6100u option comes with a smaller ssd capacity, no 250gb option also ram only 4gb no 8gb
https://www.aliexpress.com/item/4001034893168.html

celeron vs i3
http://cpuboss.com/cpus/Intel-Core-i3-6 ... eron-3205U

[Moogle Stiltzkin]

Hi Moogle,

Our 2nd line reply the Qfinder utility show incorrect IP address issue already fixed in the new version of firmware 4.4.2.1333 & Qfinder utility V6.9.1.0603, please wait we release the new version of firmware or later to fix this issue.

When you create a new virtual switch with "software-defined switch mode" this option to bundle NAS LAN adapter 1, you also need to set pfSense LAN adapter 1 into this software defined switch in pfSense VM OS network settings,

About pfSense with NAS virtual switch issues(PPPoE & DHCP), please create a new ticket in our QNAP Customer Portal.

i'm trying to troubleshoot, see if tinkering with virtual switch in virtual station and virtual switch management will fix the issues i'm noticing in pfsense logs for PPPOE and DHCP.


my earlier attempt trying to use their suggested settings, i couldn't get it to work

3. Please test if create a new virtual switch with "software-defined switch mode" this option to bundle NAS LAN adapter 1 & pfSense VM OS adapter 1, the pfSense whether has show the same PPPoE error message again(need to delete existing virtual switch first)?

Tried to do the "software-definited swide mode) to bundle nas lan adapter 1 and pfsense vm os adapter 1. No such thing was possible. the only option was bind it to lan adapter 1 only thats it (there was no selection for the pfsense vm os adapter 1.

maybe i miss something earlier. i'll try again later. if that doesn't work then i have no choice but to get a nuc instead

right now pfsense does work, and i have internet and lan. problem is, the constant pppoe and dhcp drops and reconnects i spotted in pfsense system logs. need to resolve that. i was looking at the pfsense settings, but i don't spot anything misconfigured on that side. so i suspect it's something wrong with the qts virtual switches side of things.


also the guide misses somethings e.g. ntp sync issues. what is the correct setting to avoid ntp going out of sync when using pfsense vm on qnap?

found more info about the ntp here

Keeping a VM's time setting in sync with your network
viewtopic.php?t=111537

viewtopic.php?t=113745

viewtopic.php?f=24&t=55181&start=15#p279347

viewtopic.php?f=15&t=117951&p=598453&hi ... vm#p598453

I've had the NAS hang on beta. Upon restarting there was an issue with port 4 (pfSense WAN, isolated net) where the static IP reverted to factory default.
Shutting down the VMs and restart again fixed it.

I have restarted the NAS on occasion while the VMs were left running. I have found no evidence of corruption. However, looking at pfSense you can see that it does work on it's system clock

when the NAS comes back on. Leaving it as such seems to be ok (though I restart the VM due to mild OCD). The Windows Server does the same thing and loses time. I've had to create a custom time schedule to have the time feature sync constantly every 15 mins on it.

As far as the virtual switch thing, I am not sure.

What I have done is set all of them to static on the NAS, MTU 9000, pfSense as gateway and DNS server as Windows Server IP (or PIA VPN servers if not joined to domain).

It 'hiccups' on startup (before Virtualization Station) and complains about DNS/DHCP services, but smoothes over once pfSense VM comes back on.

viewtopic.php?f=199&t=129504&p=594500&h ... vm#p594500

Just as a point of reference, ALL Virtualization technologies have time drift. See the following article from VMware https://kb.vmware.com/selfservice/micro ... nalId=1318 as an example.

Make sure that you have installed the VirtIO tools in Windows 10, either through VS or manually. See here for latest stable ISO.

IF you are heavily pushing the NAS while your Windows 10 VM is running, that will make the issue worse as the NAS and VM are competing for CPU cycles, which will make the time drift worse (and the VM seem sluggish). So don't run Plex transcoding while the VM is running as an example.

viewtopic.php?f=199&t=128291&p=584283&h ... vm#p584362



old posts, so may not necessary apply now, but i'm just guessing this issue has persisted till now? how else to explain the ntp sync issue. It did go away when i tried that fix i mentioned earlier.



and this part seems unordered. aren't you suppose to create the virtual switches first, BEFORE going to the vm settings to select the virtual switch?

9. Select the mode.
Click Basic Mode to create a bridged network
Click Advanced Mode to specify a network configuration.

And although they did mention here which mode to use to create, they didn't explain in detail about it. i had to ask helpdesk to clarify on this. and rlsted explained why not to use DHCP and nat in the virtual switches, something also left out of the qnap guide.


the guide needs to mention these things
https://www.qnap.com/en/how-to/tutorial ... a-qnap-nas

[Moogle Stiltzkin]

Okay so i did the fix as helpdesk suggested. this is what i did

step1: shutdown pfsense vm. go virtual station shut down from there.

step2: delete the existing virtual switch 1 (wan). Create the bridge as helpdesk suggested.

step3: go to virtual station pfsense vm settings and make sure that virtual switch 1 vm is pointing to that newly create bridge made.

step4: go to virtual switches to confirm the changes are correct

step5: boot up pfsense vm.

step6: clear the pfsense logs

step7: reboot via pfsense cmd console

step8: monitor pfsense logs see if any issues persist



So i got their virtual switch setup working (although haven't yet determined if the bugs in pfsense log are persisting. i'm still looking).

Earlier when i tried to do this, the virtual switches seemed to be a mess. could be that i was doing it while the vm was active, or something i don't know for sure. but either way it's possible to setup as helpdesk suggested, just wanted to confirm that for now.

this is my current setting






i didn't touch the lan virtual switch. currently it's configured as a static ip. this is the qnap gateway to access qts.



*update

i just checked, i'm still getting this pppoe issues in pfsense logs.


all i can think is related to that setting is

1. isp special config. have to setup vlan tagging for wan PPPOE so....

- created a pppoe login for my wan
- created a vlan tag (bind it to the wan and pppoe login i created)
- interface assignments set to pppoe login.

only wan and lan are assigned as interfaces.

confirmed internet works.

dhcp server also enabled, just the normal dhcp range settings, no conflicts.

PPPoE using VLAN setup

===Hi everyone.
I'm new to pfsense and I just got a sg-1100 box to replace my ISP low-end router.
I have a FTTH connection. The fiber goes into the ONT box which connects through an ethernet cable to the ISP router.
I got all the settings needed from the ISP, I disconnected the ISP router and plugged the above mentioned ethernet cable into the WAN port of the sg-1100.

I created a VLAN tagged 24 and assigned it to the WAN interface (as my ISP uses this VLAN setting for data). I ensured all the settings are correct and the username and password for ppp are correct.
However I keep seeing this error in the logs:

gabric098 Dec 9, 2019, 5:56 AM
Hi Steve,
thanks for the reply.
I'm fairly sure the VLAN is needed to be created in the router as I've access to the ISP router config and it shows VLAN24 configured.

I am assuming all the config I get from the ISP router are correct (user/password VLANID ,MTU...) so I can only think that I'm doing something wrong in setting up the VLAN and assigning it to the WAN interface (which is very possible as this is the first time I use pfSense).

I've screenshotted step by step what I'm doing. Maybe you can figure out what I'm doing wrong.

I start from a factory default settings. I create a WAN connection as PPPeE adding username and password as the ISP modem.

After that I create a VLAN with tagged 24:


Then I assign the newly created VLAN to WAN:


I edit the PPP settings assigning it to the VLAN interface:


And finally I configure the switch as you mentioned above:



Unfortunately, this setup seems not to be working, I keep getting the same error in the logs as the one I posted at the very beginning of the post.

Unfortunately my ISP doesn't offer any support in configuring 3rd party routers so I'm kind of stuck at the moment.

Thanks again,
Gab

https://forum.netgate.com/topic/148741/ ... an-setup/2


might not be a qnap issue, but something in pfsense not configured correctly for interfaces, vlan tagging. but the only setting that got the internet working was this



in regards to this pppoe reconnection spam in log, this was what helpdesk had to say

Hi Moogle,

As I explain in previous reply, in our QTS network & virtual switch current design and topology, the virtual switch cannot support a VLAN tag packet, it also means we don't support pfsense configure a VLAN and pass to NAS LAN port 1 & 2, therefore, the pfSesne system logs list PPPoE link down message may NAS virtual switch didn't support pass VLAN tag packet caused.

If you need the NAS virtual switch support VLAN tag function, I can inform our product team about this feature request.

hm... not sure if that really is the problem, or whether pfsense misconfiguration my side. i'll keep trying until i give up but if after following exact steps and still doesn't work, then it probably is due to the lack of vlan tag capability for the virtual switches which is causing this issue? at least that is what helpdesk say is the problem for why i am getting this error.

i have internet access, and lan works. only issue is that backend activity in logs about an issue occuring. i don't know what effect this will have either for performance or for security. but this is constantly spamming every second i'm using the pfsense, so it can't be good.


this should be how to set it up for my isp. the parts i highlighted is were i suspect i may have made a mistake.

PfSense 2.3.2 with TM Unifi Installation & Configuration
by NOOR AMLI SAID·
NOVEMBER 8, 2016

This article will guide you through the basic installations on how to install and configure pfSense version 2.3.2 in a home network with working HyppTV on TM UNIFI

My Hardware
Pentium 4 2.8Ghz Processor, 2GB RAM, 80GB of HDD, CD-ROM
2 PCI Ethernet cards + 1 onboard ethernet port, and a pfsense ISO file available from http://nyifiles.pfsense.org/mirror/down ... 386.iso.gz

Internet Connection i'm using.

TM UNIFI Advanced 30mb with HyppTV active. We'll setup VLAN 500 for PPPoE and VLAN 600 for HyppTV


Setup Summary
Onboard Ethernet (rl2) - LAN - 192.168.1.1/24. Connect to your home network
PCI Ethernet NIC1 (rl0)- WAN - VLAN500 & VLAN600. Connect your TM BTU here
PCI Ethernect NIC2 (rl1) - IPTV - Connect your HyppTV set top box here 


pfSense Installation
1- Download the image from pfSense download page. Here i am using i386 platform.
2- unzip downloaded gz file using 7zip then burn the ISO image on to CD using imgburn.
3- Now reboot target machine and set BIOS boot option to boot CDROM first.
4- Once boot into CD, select 1 to "Boot Multi User" then press Enter
5- Then press "I" to launch the installer
6- on Configure Console, choose "Accept these Settings"
7- on Select Task, choose "Custom Install"
8- Select disk to install pfSense
9- Choose This Disk
10- Then choose "Use this Geometry" and Format this disk.
11- Partition Disk then choose "Accept and Create"
12- Yes, partition ada0
13- Accept and Install Bootblocks
14- Choose the partition on top for Bootblock. Let it finish partition.
15- on Select Subpartition. Choose "Accept and Create"
16- Install Kernel menu, choose "Standard Kernel"
17- Reboot your machine

pfSense Configuration
1- Once boot up, on "Assign Interfaces" menu choose "y" on "Should VLANs be set up now?"
2- Our first PCI NIC (rl0) will be used as WAN, so type rl0 here
3- Enter VLAN tag : 500
4- Then select rl0 again and Enter VLAN tag :600
5- Press enter to proceed.
6- Enter WAN interface name: rl0
7- Enter LAN interface name: rl2
8- Enter Optional 1 interface name: rl1
9- Press Enter to proceed. Choose 'y' to proceed

VLAN Setup for TM UNIFI
By default IP address is set to 192.168.1.1, username:admin, password:pfsense
10- Login to your pfSense using another laptop. Set laptop IP address to be in 192.168.1.0 range
11- using web browser, type http://192.168.1.1 to access to pfSense login page.
12- Click into Interfaces / then VLANs. Make sure the setup is as below
13- Parent Interface: rl0
14- VLAN Tag : 500
15- then click Save
16- Then another VLAN
17- Parent Interface: rl0
18- VLAN Tag : 600

Interface Assignments PPPoE
20- Browse to Interface / Interface Assignments
20- From "available network ports" choose rl0_vlan500. Then click add
21- On "General Configuration"  Tick Enable interface, and set IPv4 Configuration type to PPPoE 
22- On PPPoE Configuration put in your TM UNIFI account username and password. Please contact TM Support Center for these details.
23- Then Click Save.

Interface Assignments HyppTV
24- Browse to Interface / Interface Assignments
25- Edit OPT1 Interface, change description to IPTV. Then click Save
26- From "available network ports" choose VLAN 600 in rl0
27- Click Add
28- Then browse to Interfaces / Bridges / Edit
29- Member Interfaces. Choose IPTV and VLAN600. Change description to IPTV-Bridge
30- Click Save

Firewall Setup
Now plug everything accordingly rl0-to TM Unifi BTU, rl1- to HyppTV Set top Box and rl2- to your home network switch
31- Browse to Firewall / Rules / LAN.
32- Make sure LAN Action=Pass, Protocol=Any
33- Browse to Firewall / Rules / IPTV
34- Set to IPTV Action=Pass, Protocol=Any
35- Set on IPTV Extra Options / Advanced Options. Tick Allow IP Options to pass.
36- Browse to Firewall / Rules / PPPoE
37- Set to PPPoE Action=Pass, Protocol=Any
38- Browse to Firewall / Rules / VLAN600
39- Set to VLAN600 Action=Pass, Protocol=Any
40- Set on VLAN600 Extra Options / Advanced Options. Tick Allow IP Options to pass.
41- Click save.
Enjoy PfSense with TM Unifi

https://www.facebook.com/notes/noor-aml ... 716993320/


*update

okay i deleted my old config for this, then re-did it based on this guide. had to go back and forth until i got something that worked close enuff to the instructions.

instead of add interface for pppoe, that part i just edit the existing wan, and edited the general config for it, and added pppoe and the isp credentials save. then i check interface assignments, that this is now the wan which it should be.

so in interface assignments, i only have a wan and lan.


in vlan i only have that one vlan tag 500 entry bound to the wan port.

then i go to interface, wan, then edit it to PPPOe and add isp credentials, save.

Now in interface assignments there is a pppoe is bound to vtnet0.500 , this i replace the original wan interface "vnet0" with the new pppoe vtnet0.500 entry.


i then wipe logs and then i rebooted the router via cmd "5" normal reboot.

i confirm that the wan logs into isp, i have broadband access, and no pppoe spam so far.


i'll leave it running over night and see if anything fishy shows up in logs. seems stable for now.



ugh... with asus router it was very ez.... you had a isp special requirement, just tick that, enter your pppoe credentials, and that was it (other than the basic stuff like enabling dhcp adding dhcp range, etc).

pfsense is a bit more fiddly i found.

[peelos]

I think at this stage you know more than me - I did the research 2 years ago and wanted:

• A configuration that would last a few years and support 1Gbps connection

• AES-NI support for OpenVPN

• Space for logging IPS

My i5 / 8GB RAM is still working well on a 1GBps/100MBps line - ran from the command line on the pfsense box https://forum.netgate.com/topic/64735/s ... nse-box/42

Code: Select all

Retrieving speedtest.net configuration...
Testing from XXX
Retrieving speedtest.net server list...
Selecting best server based on ping...
Hosted by [6.61 km]: 9.584 ms
Testing download speed................................................................................
Download: 809.49 Mbit/s
Testing upload speed......................................................................................................
Upload: 89.50 Mbit/s

Currently using 14% of the 8GB RAM and 6% of 128GB SSD - although don't have IPS running

Official Qotom store I used: https://qotom.aliexpress.com/store/108231

Cannot comment on the performance of all of the various flavors of Intel processor available for configuration now..but I expect they will all be suitable for your use case.

I have an i5-4200U, so this box: https://www.aliexpress.com/item/32864883139.html

I would personally go at least i5 and the model you posted looks like it satisfies all of the criteria I used to choose my model, if you want to save some $ you can probably get away with a smaller SSD.

[Moogle Stiltzkin]

thx for info :}

[Moogle Stiltzkin]

vpn test , openvpn aes256 gcm ,

nearest server



international long distance server

latency is pretty decent considering the distance (last time back when i had adsl, my latency for this would have been 600-800ms. things are better now with ftth broadband in comparison), but the download speed was bad


i selected a different server in that same country, and got a better result. but with a worse latency. so if i'm downloading i'd use this one.




i did not set openvpn on router. i use a windows vpn client since it's simpler for me. not all devices want to use vpn through the router.


my isp broadband is 100 mbps dl, 50 ul, so these results aren't too bad for me.