equipment:fw4c_opnsense
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| equipment:fw4c_opnsense [2023/11/20 15:40] – [Install OPNsense] dirk | equipment:fw4c_opnsense [2023/11/25 09:46] (current) – [Wireguard VPN] dirk | ||
|---|---|---|---|
| Line 9: | Line 9: | ||
| * login as ' | * login as ' | ||
| * select keyboard layout, Install (UFS), select harddrive, ok on swap, change password, reboot without USB plugged in. | * select keyboard layout, Install (UFS), select harddrive, ok on swap, change password, reboot without USB plugged in. | ||
| + | |||
| + | Link: https:// | ||
| + | ===== Connect ===== | ||
| * plug into the LAN port (see below note for the FW4C) and navigate to 192.168.1.1 | * plug into the LAN port (see below note for the FW4C) and navigate to 192.168.1.1 | ||
| * NOTE: OPNsense defines ports right to left as LAN, WAN but the Protectli FW4C labels them right to left as WAN, LAN. So you'll have to plug into the WAN port for this initial login and we will switch the ports in software so that the labels are matched up. | * NOTE: OPNsense defines ports right to left as LAN, WAN but the Protectli FW4C labels them right to left as WAN, LAN. So you'll have to plug into the WAN port for this initial login and we will switch the ports in software so that the labels are matched up. | ||
| * log in using ' | * log in using ' | ||
| - | * | + | * go to Interfaces / Assignments and swap the LAN and WAN ports if needed (see above note) |
| - | + | * once this step is complete, you'll need to plug the wire into the new LAN port and re-login | |
| - | + | ===== Setup ===== | |
| - | + | * go to Interfaces / LAN | |
| - | + | * make sure it is enabled and locked | |
| - | ===== Connect | + | * config type Static IPv4 |
| - | * Plug in using PoE injection or 12V 0.5Amp Power adapter | + | * set IPv4 address |
| - | * Connect computer to ETH0 | + | * upstream gateway is auto-detect |
| - | * Setup computer with 192.168.1.XXX address | + | * Save/Apply |
| - | * Connect | + | * go to Interfaces / WAN |
| - | * Probably need to accept any exceptions / agree to connect | + | * make sure it is enabled |
| - | * Login with " | + | * block private and bogon networks |
| - | ===== Initial Setup ===== | + | * config type DHCP (for CenturyLink at least) |
| - | * Run Wizards | + | * Save/Apply |
| - | * Choose WAN+2LAN2: This will make eth0 internet port and with "only use one LAN" checked will make the other 4 ports a network | + | |
| - | * DHCP | + | |
| - | * Enable the default firewall | + | |
| - | * Only use one LAN | + | |
| - | * Apply, Apply Changes, Reboot | + | |
| - | * Must now plug computer into port 1, 2, 3, or 4 | + | |
| - | * Must now plug internet connection into port 0 | + | |
| - | * Navigate back to 192.168.1.1 | + | |
| - | * Login with " | + | |
| ===== Setting up with CenturyLink Quantum Fiber ===== | ===== Setting up with CenturyLink Quantum Fiber ===== | ||
| * This service provider requires traffic from the ONT to go to a router set to VLAN 201 | * This service provider requires traffic from the ONT to go to a router set to VLAN 201 | ||
| - | * From Dashboard click Add Interface --> Add VLAN | + | * go to Interfaces / Other Types / VLAN |
| - | * VLAN ID: 201 | + | * create new by clicking on the " |
| - | * Interface: eth0 | + | * Device: vlan01 |
| + | * Parent: igc0 (the address of the WAN port) | ||
| + | * VLAN tag: 201 | ||
| + | * VLAN priority: Best Effort | ||
| * Description: | * Description: | ||
| - | * MTU: 1500 | + | * Save |
| - | * Address: Use DHCP | + | * go to Interfaces / Assignments |
| - | ===== Update firmware from EdgeRouter site ===== | + | * change WAN to the new vlan01 that you just created |
| - | * Download latest firmware | + | * Save/ |
| - | * Go to " | + | * Plug line from internet into WAN port. |
| - | * Upload a file button in the " | + | |
| - | * Select file | + | |
| - | * Reboot | + | |
| ===== Firewall/ | ===== Firewall/ | ||
| ==== Port Forwarding ==== | ==== Port Forwarding ==== | ||
| - | * WAN interface: eth0 (or eth0.201 if applicable) | + | * go to Firewall / NAT / Port Forward |
| - | * Hairpin | + | * create new rule by clicking on the " |
| - | * LAN interface: switch0 | + | * Interface: |
| - | * Port Forwarding rules if unraid/ Nginx:< | + | * Protocol: TCP |
| - | 443 | + | * Source Advanced should all be " |
| - | 22 Both | + | * Destination: |
| - | * Port Forwarding rules if standalone:< | + | * Destination port range: select outside port (example: 80 or 443) |
| - | 443 | + | * Redirect target IP: Single host or Network / internal IP address of the server (10.23.79.4) |
| - | 22 Both | + | * Redirect target port: (other) / internal server port (example: 180 or 1443) |
| - | 32400 | + | * Description: |
| - | ==== Firewall Polices ==== | + | |
| - | * Setup VPN: | + | * Filter rule association: Add associated filter rule |
| - | * login to command line using CLI button or SSH | + | * Save/Apply |
| - | * Enter configuration mode< | + | |
| - | * Add firewall rules for the L2TP traffic< | + | |
| - | set firewall name WAN_LOCAL rule 30 description ike | + | 443 |
| - | set firewall name WAN_LOCAL rule 30 destination port 500 | + | 22 Both |
| - | set firewall name WAN_LOCAL rule 30 log disable | + | * Port Forwarding rules if standalone:< |
| - | set firewall name WAN_LOCAL rule 30 protocol udp | + | 443 |
| + | 22 Both | ||
| + | 32400 | ||
| + | * Hairpin NAT: | ||
| + | * go to Firewall | ||
| + | * Check " | ||
| + | * Save / Apply | ||
| - | set firewall name WAN_LOCAL rule 40 action accept | + | ==== Wireguard VPN ==== |
| - | set firewall name WAN_LOCAL rule 40 description esp | + | === Create Instance and Peers === |
| - | set firewall name WAN_LOCAL | + | * go to System / Firmware / Plugins and install os-wireguard |
| - | set firewall name WAN_LOCAL | + | * go to VPN / WireGuard / Settings / Instances |
| + | * create new instance by clicking on the " | ||
| + | * Enabled: check | ||
| + | * Name: WG1 | ||
| + | * click the gear to create a Public/ | ||
| + | * we will call this public key " | ||
| + | * Listen port: 51820 | ||
| + | * Tunnel address: pick a subnet not used elsewhere (10.23.0.1/ | ||
| + | * Save/ | ||
| + | * go to VPN / WireGuard / Settings / General and enable WireGuard | ||
| + | * go to VPN / WireGuard / Settings / Peers | ||
| + | * create new peer by clicking on the " | ||
| + | * Enabled: check | ||
| + | * Name: iPhone / Macbook / whatever | ||
| + | * Public key: PEERPUBLIC (put in the key created when you setup the client... see below) | ||
| + | * Allowed IPs: something on the subnet configured above (10.23.0.11/ | ||
| + | * Instances: select above instance (WG1) | ||
| + | * Save/ | ||
| + | * go to VPN / WireGuard / Settings / Instances / Edit WG1 | ||
| + | * Add Peers into Peers drop down | ||
| + | * Save/ | ||
| + | * go to Lobby / Dashboard and restart wireguard | ||
| + | === Create interface === | ||
| + | * go to Interfaces / Assignments | ||
| + | * in the drop down under new interface, select the WireGuard instance (wg1) | ||
| + | * Enable: check | ||
| + | * Description: | ||
| + | * Save/ | ||
| + | * go to Interfaces / WG1 | ||
| + | * Enable: check | ||
| + | * Description: | ||
| + | * Save/ | ||
| + | === Create VPN Firewall rules === | ||
| + | * go to Firewall / Rules / WAN | ||
| + | * create new rule by clicking on the " | ||
| + | * Action: Pass | ||
| + | * Quick: check | ||
| + | * Interface: WAN | ||
| + | * Direction: in | ||
| + | * TCP/IP Version: IPv4 | ||
| + | * Protocol: UDP | ||
| + | * Source Invert: unchecked | ||
| + | * Source: any | ||
| + | * Destination Invert: unchecked | ||
| + | * Destination: | ||
| + | * Destination port range: from (other) 51820 to (other) 51820 | ||
| + | * Description: | ||
| + | * Save/ | ||
| + | * go to Firewall / Rules / [Name of interface assigned above (WG1)] | ||
| + | * create new rule by clicking on the " | ||
| + | * Action: Pass | ||
| + | * Quick: check | ||
| + | * Interface: WG1 | ||
| + | * Direction: in | ||
| + | * TCP/IP Version: IPv4 | ||
| + | * Protocol: any | ||
| + | * Source Invert: unchecked | ||
| + | * Source [Name of interface assigned above NET (WG1 net)] | ||
| + | * Destination Invert: unchecked | ||
| + | * Destination: | ||
| + | * Destination port range: any | ||
| + | * Save/ | ||
| + | === Setup Clients === | ||
| + | * This will differ based on device... principal is the same. | ||
| + | * iPhone | ||
| + | * Download WireGuard from app store | ||
| + | * create new | ||
| + | * Name: brimble.com | ||
| + | * Generate keypair | ||
| + | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | ||
| + | * Addresses: This will be whatever you put in the Allowed IPs box of VPN / WireGuard / Settings / Peers (10.23.0.11/ | ||
| + | * Listen port: Automatic | ||
| + | * MTU: Automatic | ||
| + | * DNS servers: 8.8.8.8, 8.8.4.4 | ||
| + | * click Add peer | ||
| + | * Public key: MAINPUBLIC this will be in VPN / WireGuard / Settings / Instances / Public key box | ||
| + | * Preshared key: blank | ||
| + | * Endpoint: the address and port of your server (brimble.com: | ||
| + | * Allowed IPs: 0.0.0.0/0 | ||
| + | * Save | ||
| + | * macbook | ||
| + | * Downlaod WireGuard from app store | ||
| + | * create new | ||
| + | * Name: brimble.com | ||
| + | * This public key (PEERPUBLIC) will go in VPN / WireGuard / Settings / Peers / Public key box | ||
| + | * < | ||
| + | PrivateKey = whatever is there | ||
| + | Address = This will be whatever you put in the Allowed IPs box of VPN / WireGuard / Settings / Peers (10.23.0.11/ | ||
| + | DNS = 8.8.8.8, 8.8.4.4 | ||
| - | set firewall name WAN_LOCAL rule 50 action accept | + | [Peer] |
| - | set firewall name WAN_LOCAL rule 50 description nat-t | + | PublicKey = MAINPUBLIC this will be in VPN / WireGuard / Settings / Instances / Public key box |
| - | set firewall name WAN_LOCAL rule 50 destination | + | AllowedIPs = 0.0.0.0/0 |
| - | set firewall name WAN_LOCAL | + | Endpoint = the address and port of your server (brimble.com: |
| - | set firewall name WAN_LOCAL | + | </ |
| + | * Save | ||
| + | Link: https:// | ||
| + | ==== NAT for online gaming ==== | ||
| + | * go to Firewall / Aliases | ||
| + | * create new alias by clicking on the " | ||
| + | * Enabled: check | ||
| + | * Name: NintendoSwitch | ||
| + | * Type: Host(s) | ||
| + | * Content: IP address of Switch | ||
| + | * Save/ | ||
| + | * go to Firewall / NAT / Outbound | ||
| + | * change mode to Hybrid so you can add manual | ||
| + | * create new rule by clicking on the " | ||
| + | * Interface: WAN | ||
| + | * Protocol: any | ||
| + | * Source address: NintendoSwitch | ||
| + | * Static-port: | ||
| + | * Give it a description | ||
| + | * Save/Apply | ||
| - | set firewall name WAN_LOCAL rule 60 action accept | + | Link: https:// |
| - | set firewall name WAN_LOCAL rule 60 description l2tp | + | |
| - | set firewall name WAN_LOCAL rule 60 destination port 1701 | + | |
| - | set firewall name WAN_LOCAL rule 60 ipsec match-ipsec | + | |
| - | set firewall name WAN_LOCAL rule 60 log disable | + | |
| - | set firewall name WAN_LOCAL rule 60 protocol udp</code> | + | |
| - | * Configure the server authentication settings< | + | |
| - | set vpn l2tp remote-access ipsec-settings authentication pre-shared-secret < | + | |
| - | set vpn l2tp remote-access authentication mode local | + | ==== Services ==== |
| - | set vpn l2tp remote-access authentication local-users username < | + | * DHCPv4 |
| - | * Define the IP address pool< | + | * Range Start 10.23.79.100 |
| - | set vpn l2tp remote-access client-ip-pool stop 192.168.100.99</ | + | * Range Stop 10.23.79.245 |
| - | * Define DNS server(s) used by VPN< | + | * Save Apply |
| - | set vpn l2tp remote-access dns-servers server-2 < | + | * Static MAC/IP Mapping< |
| - | * Define WAN interface which will receive L2TP requests (this one is for DHCP, see link for others)< | + | BrimUpstairsAP |
| - | * Define IPsec interface< | + | BrimDownstairsAP 10.23.79.6 |
| - | * Commit changes and save< | + | |
| - | * Link: https:// | + | |
| - | * Parental Controls | ||
| - | * Add Ruleset | ||
| - | * Add New Rule | ||
| - | * Enter Description (Xbox) | ||
| - | * Action: Drop | ||
| - | * Protocol: All protocols | ||
| - | * State: All checked | ||
| - | * IPsec: Don't match on IPsec packets | ||
| - | * P2P: None | ||
| - | * Enter MAC Address of item in Source | ||
| - | * Set Start Time and Stop Time (UTC) | ||
| - | * Configuration | ||
| - | * Description: | ||
| - | * Default Action: Accept | ||
| - | * Interfaces | ||
| - | * Interface: switch0 | ||
| - | * Direction: in | ||
| - | * Repeat for each device you would like to limit | ||
| - | * Xbox | ||
| - | * VizioTV | ||
| - | * AppleTVLR | ||
| - | * J3DS | ||
| - | * M3DS | ||
| - | * WiiU | ||
| - | * NintendoSwitch | ||
| - | * NAT | ||
| - | * default | ||
| - | * Firewall/ | ||
| - | * default | ||
| - | |||
| - | * Guest network setup: Turn on Guest Hotspot in unifi, create new wifi network and select " | ||
| - | ==== Services ==== | ||
| - | * DHCP Server | ||
| - | * Static MAC/IP Mapping< | ||
| - | BrimblecomAP | ||
| - | BrimDownstairsAP 192.168.1.6 | ||
| - | hoobs 192.168.1.7 | ||
| </ | </ | ||
| - | * Details | + | |
| - | * Range Start 192.168.1.100 | + | * 10.23.79.1 to use ISPs |
| - | * Range Stop 192.168.1.255 | + | * 10.23.79.3 if using PiHole |
| - | * Router 192.168.1.1 | + | * 8.8.8.8 / 8.8.4.4 (or others) if hardcoding |
| - | | + | * Dynamic DNS |
| - | * 192.168.1.1 to use ISPs | + | * go to System / Firmware / Plugins and download os-ddclient |
| - | * 192.168.1.2 if using PiHole | + | * go to Services / Dynamic DNS / Settings |
| - | * 8.8.8.8 / 8.8.4.4 (or others) if hardcoding | + | * add new one by clicking on the " |
| + | * Enabled | ||
| + | * Service : easyDNS | ||
| + | * Username : easyDNS username | ||
| + | * Password : easyDNS token (not password). Token can be gotten from website | ||
| + | * Hostnames: brimble.com | ||
| + | * Check ip method: dyndns | ||
| + | * Interface to monitor: WAN | ||
| + | * Check ip timeout: 10 | ||
| + | * Force SSL: checked | ||
| + | * Save/Apply | ||
| - | * DNS | ||
| - | * Cache Size 150 | ||
| - | * Interface switch0 | ||
| - | * Dynamic DNS (new) | ||
| - | * Interface: eth0.201 | ||
| - | * Service: easydns | ||
| - | * Hostname: brimble.com | ||
| - | * Login: mdbrim | ||
| - | * Password: " | ||
| - | * Protocol: easydns | ||
| - | * Server: BLANK! | ||
| - | * Dynamic DNS (old) | ||
| - | * Interface: eth0 | ||
| - | * Service: noip | ||
| - | * Hostname: brimble.com | ||
| - | * Login: mdbrim | ||
| - | * Password: "noip password" | ||
| - | * Protocol: noip | ||
| - | * Note: if more are needed (shouldn' | ||
| - | ===== Other Settings ===== | ||
| - | ==== Hardware offload ==== | ||
| - | * login to command line using CLI button or SSH | ||
| - | * Enter configuration mode< | ||
| - | * enable hwnat offload< | ||
| - | * commit and save< | ||
| - | * Link: https:// | ||
| - | ==== User setup ==== | ||
| - | * Use " | ||
| - | ==== PoE Passthrough ==== | ||
| - | * Use " | ||
| - | * PoE: Passthrough | ||
| - | * Save | ||
equipment/fw4c_opnsense.1700516414.txt.gz · Last modified: by dirk
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
