Skip to content

Instantly share code, notes, and snippets.

@daemonhorn

daemonhorn/pfsense-airgap-environment.md

Last active May 18, 2024 23:08
Show Gist options
  • Save daemonhorn/25d9c51622d2e1fcdf0377cca04fa1f8 to your computer and use it in GitHub Desktop.
Save daemonhorn/25d9c51622d2e1fcdf0377cca04fa1f8 to your computer and use it in GitHub Desktop.
Download ZIP
PfSense as an air-gapped router
Raw
pfsense-airgap-environment.md

PfSense Air-gapped configuration

In certain environments, it is useful to have a router and firewall between two private vlans. When the WAN interface of PfSense is not able to access the internet (e.g. DNS Resolution, Update Checks, etc.) it can become sluggish to boot and configure. This guide attempts to capture configuration knobs that can improve the usability in these environments, and was written with PfSense CE 2.7.2 configuration as a baseline.

TODO

  • Finish Documentation
  • tcpdump -nn -i XXX pfsense at steady state air-gapped {for em0 (WAN), em1 (LAN), lo0 (loopback)} Loopback will show you all of the items that would have being queried via root.hints or other pfsense internals. Start with udp port 53 capture filter to look for DNS traffic.
  • tcpdump pfsense at boot with WAN interface to look for extra ntp, dns, http, tls packets

Install

Installation from the PfSense CE ISO file can easily be done in these environments. Download the ISO from mirror (to avoid creating a netgate TAC account), upload to your virtualization/burn to physical media, and boot from the ISO.

  • https://atxfiles.netgate.com/mirror/downloads/
  • https://repo.ialab.dsu.edu/pfsense/
  • Capture the WAN (Air-gapped VLAN#1) and LAN (Air-gapped VLAN#2) interface ip addresses, and make sure that the LAN link is up so that it will serve DHCP to other clients on the same VLAN to enable configuration steps.
  • If you are using virtualization (e.g. VMWare), recommend you use intel e1000 NIC configuration in your VM and/or disable the hardware offload knobs in "System->Advanced->Networking".
    • Hardware Checksum: disable
    • Hardware TCP Segmentation: disable
    • Hardware Large Receive: disable

Base Configuration

Here is a list of configuration knobs:

  1. Setup a single GUI client (VM or otherwise) that can load a web browser and access the administration page (by default this is on the LAN interface defined during install step. This is most easily done by assigning another vm to the same vlan as the pfsense LAN interface (Air-gapped VLAN#2) and using the web browser from that console. Default web administration for pfsense installation username is admin, password is pfsense. Change immediately to something secure.
  2. System->Update->Update Settings-> Select "Disable the Dashboard auto-update check"
  3. Dashboard-> Remove the "Netgate Services and Support" widget by clicking the "X" in the top-right corner of the UI element.
  4. Disable Network Time Protocol Daemon (NTP). Configuration is in Services->NTP.
    • Make sure Enable NTP Server is not checked (OFF)
  5. Setup Unbound (DNS Resolver in PfSense parlance) to use custom root.hints file to prevent reaching out to external hardcoded X.root-servers.net ip addresses. Configuration is in Services->DNS Resolver in the Web admin interface.
    • Make sure Enable DNS resolver checkbox is checked (ON).
    • Click Display Custom Options, then enter the string: root-hints: /var/unbound/airgap.hints
    • Create a text file (using vi or your favorite editor) on pfsense filesystem (via console or ssh) with the following data in /var/unbound/airgap.hints:
.                   3600000 NS   A.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET  3600000 A    127.0.0.1
A.ROOT-SERVERS.NET  3600000 AAAA ::1
  1. Setup DNS resolver stub zones: (TBD on details)
  • PTR addresses .arpa (PTR IPv4/IPv6)
  • Common TLDs .net, .com, .org, etc. so that root zone SOA/NS lookups land on 127.0.0.1

Optional Configuration

Here is a list of useful things for the LAN interface of PfSense to provide to clients that enable them to "think" they are internet connected without actually providing internet access.

  1. DNS Config: Services->DNS Resolver
  • WIP
  1. Internet Reachability:

Known Issues:

  1. During reboot, "DNS Resolver" service start is slow. Delays boot by around 30 seconds.
  2. During reboot, "NTP Server" service start is slow. Delays boot by around 30 seconds.
  3. During reboot, "Configuring WAN interface" will be VERY slow if set for DHCP, and DHCP packets do not receive a response.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment