Scribd Logo
Upload

Welcome to Scribd!

  • 402 views

    94 PfSense 2 0 and Beyond BSDCan 09

    Uploaded by

    Harry Chan Putra. SP. MTCNA. MTCTCE. MTCRE
    pfSense is a free and open source firewall and routing platform based on FreeBSD that started as an internal firewall project 13 years ago. It has grown significantly with millions of downloads, over 11,000 forum members, and 21 developers. Version 2.0 introduced many new features like Layer 7 QoS, an improved traffic shaper, a user manager, and OpenVPN improvements. The project also provides tools to customize pfSense like building appliances and packages that add functionality.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd

    94 PfSense 2 0 and Beyond BSDCan 09

    Uploaded by

    Harry Chan Putra. SP. MTCNA. MTCTCE. MTCRE
    402 views36 pages
    pfSense is a free and open source firewall and routing platform based on FreeBSD that started as an internal firewall project 13 years ago. It has grown significantly with millions of downloads, over 11,000 forum members, and 21 developers. Version 2.0 introduced many new features like Layer 7 QoS, an improved traffic shaper, a user manager, and OpenVPN improvements. The project also provides tools to customize pfSense like building appliances and packages that add functionality.

    Original Description:

    BSD

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    pfSense is a free and open source firewall and routing platform based on FreeBSD that started as an internal firewall project 13 years ago. It has grown significantly with millions of downloads, over 11,000 forum members, and 21 developers. Version 2.0 introduced many new features like Layer 7 QoS, an improved traffic shaper, a user manager, and OpenVPN improvements. The project also provides tools to customize pfSense like building appliances and packages that add functionality.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    402 views36 pages

    94 PfSense 2 0 and Beyond BSDCan 09

    Uploaded by

    Harry Chan Putra. SP. MTCNA. MTCTCE. MTCRE
    pfSense is a free and open source firewall and routing platform based on FreeBSD that started as an internal firewall project 13 years ago. It has grown significantly with millions of downloads, over 11,000 forum members, and 21 developers. Version 2.0 introduced many new features like Layer 7 QoS, an improved traffic shaper, a user manager, and OpenVPN improvements. The project also provides tools to customize pfSense like building appliances and packages that add functionality.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 36

    pfSense - 2.

    0 and beyond

    Chris Buechler - cmb@pfsense.org


    Scott Ullrich - sullrich@pfsense.org
    History of pfSense
    Started as a work project 13 years ago when we needed a
    internal firewall
    Originally Linux, switched to FreeBSD 2.2
    Evolution of this path shrunk the firewall down to a Soekris size
    Moatware was started
    Met Chris Buechler during this time
    Sell a number of products
    Sales guy moves to Florida
    Moatware fails
    Chris and myself debate starting over fresh
    pfSense is forked from m0n0wall roughly 4 years ago
    Still going strong today - momentum is snowballing
    pfSense Overview

    Customized FreeBSD distribution tailored for use as a


    firewall and router.
    pfSense has many base features and can be extended with
    the package system including one touch installations of
    popular 3rd party packages such as SpamD (spam filter)
    and Squid (web caching).
    Includes many features found in commercial products such
    as Cisco PIX, Sonicwall, Watchguard, etc.
    Many support avenues available, mailing lists, forum and
    commercial support.
    Has the best price on the planet.... Free!
    pfSense Platforms

    Live CD
    Full Install
    Embedded
    Developers
    Project statistics
    millions of downloads served
    11,400 forum members
    ~1200 mailing list users (support and discussion)
    21 developers
    12 active developers (committed in the last year)
    Consistent Google growth
    New features (base)
    Layer 7 QoS
    New traffic shaper
    User Manager
    OpenVPN Improvements
    PHP 5
    Certificate Manager
    Routing / Gateways improvements
    Dashboard
    Load balancer changes
    Web based PFTOP, TOP
    IGMP proxy
    New features (continued)

    Complete new interface system


    Multiple DynDNS interface support
    DHCP Server improvements
    PPTP Improvements
    New LIBALIAS based in-kernel FTP helper
    Improved load balancing (incoming and outgoing)
    Layer 7 QoS improvements

    Based on regex matching system


    Detects BitTorrent very nicely
    Can detect between bulk and interactive traffic ?
    About X% overhead for L7
    PF peels off first X bytes of header for inspection via divert
    New traffic shaper

    Rewritten from scratch by Ermal Luci


    Supports HFSC, CBQ, FairQ, PriQ
    Uses ALTQ
    Now works on more than 2 interfaces
    Supports bridging
    Pretty much all limitations are now gone!
    User Manager

    Full user manager with user and groups support


    Can allow an account to specific areas
    Consolidating all accounts in various areas (VPN users, etc)
    LDAP authentication support
    Per user certificate support
    IPsec
    Major overhaul by Matthew Grooms, ipsec-tools committer
    and author of Shrew Soft IPsec client - http://shrew.net
    Multiple Phase 2 per Phase 1
    Transport mode support added
    IPsec
    Xauth - user and group authentication
    pfSense local user database
    LDAP
    Microsoft Active Directory
    Novell eDirectory
    and others...
    RADIUS
    Microsoft Active Directory
    many others
    Now a drop-in replacement for Cisco VPN concentrators,
    PIX firewalls, and routers
    OpenVPN

    Major overhaul by Matthew Grooms


    Can now export a Windows Installer bundled with
    Certificates
    Now considered a first class VPN topology in pfSense
    New interfaces
    GRE
    gif
    PPP (dial up POTS modems, 3G cellular wireless)
    Many 3G wireless additions
    lagg(4) interface bonding
    failover
    load balance
    round robin
    Etherchannel
    LACP
    Bridging enhancements
    all of if_bridge capabilities supported
    18 Advanced configuration options available
    STP and RSTP - fully configurable
    SPAN port capable
    Certificate Manager

    Certificate authority support


    Generate OpenVPN certificates
    Generate user certificates
    Generate HTTPS certificate
    Generate IPsec certificates
    Revocation support
    Import existing certificates
    Routing / Gateway Additions

    New gateway group feature


    Failover threshold supports RTT or packet loss triggers
    Groups now employ a "Tier" type system
    Supports balancing
    Supports interface failover ordering
    Can fail on packet loss % or 100% down situations
    Dashboard
    Allows quick access to
    system information
    Added RSS widget
    Added picture widget
    Added gateways widget
    with RTT and loss
    reporting
    New AJAX CPU utilization
    widget
    Load Balancer changes
    (relayd)
    Layer3 balancing
    Layer7 balancing
    New monitoring features
    Send/expect
    DNS
    HTTP
    HTTPS
    Web based pftop
    Web based top
    IGMP Proxy

    Useful for Video in some cases


    Some phone systems use IGMP for overhead speakers
    IP TV
    Gaming
    New interface system

    All interfaces treated equally - no special status for


    LAN/WAN.
    Multi interface PPPoE support (WAN)
    Multi interface PPTP support (WAN)
    Allows just one interface to be assigned (appliance mode)
    QinQ VLAN support
    Interface groups
    DHCP Server improvements

    Dynamic DNS client name registration support


    Definable NTP Servers
    LDAP URI Integration
    Now allows duplicate IP address registration for multiple
    MAC addresses
    Network booting related additions
    Next-server
    Filename
    root-path-string
    New features (packages)
    Jails
    FreeSWITCH
    Squid 3
    Avahi
    Open-VM Tools
    PHP Service
    OpenVPN Client Export Utility (Windows)
    TFTP Server (useful for upgrading Cisco/HP Switches, etc)
    Appliance building
    pfSense builder system can now automatically generate
    custom "Appliances" from an overlay file.
    Simply add files that you want to include into a directory and
    define the directory in pfsense_local.sh custom_overlay
    directive
    We will go over a quick appliance build later in this
    presentation
    FreeSWITCH Appliance
    Can be run on pfSense directly or as a dedicated appliance.
    Features:
    Voice Mail
    Voice Mail to e-mail (one or more email addresses, also can
    be sent to special email addresses for SMS Text
    Messages)
    Auto Attendant
    Music on Hold (.wav)
    Recordings
    Follow Me
    Text to Speech (flite)
    FreeSWITCH Appliance

    Features Continued:
    Call Park
    Call Forward
    DISA (Direct Inward/Outward System Access)
    Call Queues
    SIP (TLS) and SRTP and more.
    Simple to call between multiple systems using the Internet.
    Call Eavesdrop (aka barge)
    Call Recording
    Call Intercept by Group, Global, Extension
    FreeSWITCH Appliance

    Features Continued:
    Call Park
    Google 411

    Email: markjcrane@gmail.com

    Wiki: http://doc.pfsense.org/index.php/FreeSWITCH

    IRC: #pfsense-freeswitch
    DNS Server Appliance
    Many features removed such as DHCP Server, VPN, etc
    Two versions released so far, newest based on FreeBSD 8
    Based on TinyDNS from DJ Bernstein
    Automatically synchronizes changes to 5 other hosts
    Automatically fail to backup records on host failure using
    ICMP
    Automatically fail to backup record if WAN RTT > X
    Automatically fail to backup record if RTT to host Y.Y.Y.Y >
    X
    Zone transfer support for the BIND folks
    Configuration data stored in master config.xml file
    Creating an appliance
    (overview)
    Install FreeBSD 7
    Follow http://devwiki.pfsense.org/DevelopersBootStrapAndDevIso
    Excute these shell commands:
    cd /home/pfsense/tool/builder_scripts
    cp builder_profiles/pfDNS/pfsense_local.sh
    ./build_iso.sh
    Creating your own appliance
    (Overview)
    cd
    /home/pfsense/tools/builder_scripts/builder_profiles/
    cp -R pfDNS MyAppliance && cd MyAppliance
    grep -R "pfDNS" * | cut -d":" -f1 | sort -u
    README
    config/config.xml
    copy_overlay/boot/beastie.4th
    copy_overlay/etc/inc/globals.inc
    copy_overlay/usr/local/share/dfuibe_lua/conf/pfSense.
    lua
    pfsense_local.sh
    Edit the above files to your liking
    Building your appliance
    (overview)
    cd /home/pfsense/tools/builder_scripts
    cp
    builder_profiles/MyAppliance/pfsense_local.
    sh .
    ./build_iso.sh
    See http://devwiki.pfsense.org/CreatingAnAppliance
    BSD Perimeter milestones

    Chris is now working Full Time


    BSD Perimeter coordinating MIPS port for RouterStation
    pfSense book will be released in the next couple months
    Commercial support is growing with satisfied customers
    Sponsored IPsec improvements
    Sponsoring various misc projects on behalf of customer,
    IGMP package for 1.2.*, etc
    Questions?

    Comments?
    Thanks for attending!

    sullrich@pfsense.org
    cmb@pfsense.org

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy