Source
r/PFSENSE•
Studystand

[Question] pfSense in-between my modem and router

I'd like to set up a pfSense firewall (along with snort, and whatever else I'm interested in) between my cable modem, and my wireless router.

To my understanding, the modem has to be placed into bridged mode, since it is a combo modem/router, but from there it gets a little hazy. I've looked into this but it's pretty limited, unless it is actually that simple. The How-To doesn't state anything about turning off DNS, or the possibility of a double NAT issue?

Also, what's the recommended order? I was thinking...

Internet --> Modem (bridged) --> pfSense (running atop ESXi 5.5) --> Router/Wireless AP --> Switch

EDIT: Just wanted to add, any reason to swap the order of the switch and wireless AP?

Posted Aug 25, 2015, 5:36 AM UTC · edited

18
rengler•

That's about right. If you are bridging the modem, consider it to be invisible to traffic going through it. You would then assign a public IP address to the outside of the pfSense VM (via static assignment or DHCP from your ISP) and start configuring. Bridging means there is no double-NAT. You will need to have two interfaces on the ESXi host for this, but I'll assume you know your way around VMware. The AP goes into the local/inside port on the pfSense firewall.

1
wolfcry0•

You want to turn your router into an AP to do this

Basically to do that you go and disable DHCP on the router, and then connect it using the LAN ports instead of the WAN port

1
StudystandOP•

I was under the impression that a wireless router and an AP were essentially the same thing. Does that mean that my pfSense box will be acting as a router? It will handle DHCP, DNS, NAT, etc?

1
oisteink•

A wireless router is a wireless accesspoint with routing (and often other) services. You can usually utilize a wifi router as wifi ap by disabling the dhcp server on the box and plug your lan into a lan port rather than the internet port.

1
oisteink•

Dhcp does not really have anything to do with routing. But it will inform clients about where to send packets if they are outside of their own net.

1
wolfcry0•

An AP is just purely an AP, no NAT, no DHCP, no DNS, no Firewall, no QoS, etc...

A wireless router has all of that plus the AP

In your case PfSense would take over NAT, DHCP, DNS and those types of functions

1
metajames•

A WiFi router is like a combo of a router, WiFi AP and ether net switch. I would turn off everything except the WiFi AP part and connect it with the LAN port to the LAN of the pfsense.

Modem - > switch - > WiFi AP

Then do all of of your routing and firewall on the pfsense

1
oisteink•

If you dont use the routing part of your wifi router then it's basically a 4 port switch with wifi. So it's modem->pfsense->switch->switch. Personally I'd put the "normal" switch first and attach the ap to this like any other devices (printer etc). There might be cases where this is not optimal, like if you have a shitty switch and a superduper ap.

1