Installing pfSense onto a VMware VM
In this project I’m going to do a basic install pfSense on a Vmware VM and have it ready to filter incoming and outgoing traffic from another VM.
I downloaded the pfSense Community Edition iso file from https://www.pfsense.org/download/ and extracted it into a folder of my choosing.
I like to have at least 20GB for any new VM, and I also like to store the virtual disk in one file because it’s easier to manage.
- Depending on how well you want it to run, you can have the memory and processors the same as mine. You can have it at less and it will still work fine.
- I configured one network adapter to operate as ‘Bridged’. This will allow my internal Lubuntu host to get an IP address from my physical router at home.
- The second network adapter is set to ‘Host-Only’.
- You can also delete ‘USB Controller’ and ‘Sound Card’ as we will not need them.
Now we have to change our VMnet settings so that VMware VMnet doesn’t use DHCP for the internal hosts (the Lubuntu host). This pfSense firewall will act as the DHCP server.
- I chose 192.168.2.0/24 as it was an unused.
CONFIGURING PFSENSE
In order to find the WAN interface, we have to find out what the MAC address is of the Bridged adapter. Note the options in the image above, one ends in ‘c3’, the other ends in ‘cd’.
Therefore we should choose em0 as the WAN interface.
Choose ‘Continue’.
If there were more interfaces, we would do the same process as above to find out the LAN interface, however since there is only one option, we will choose em1.
- I changed the IP address from 192.168.1.1/24 to 192.168.2.2/24. The reason I chose .2 was because I have another VM as .1.
- I configured the DHCPD Range Start and End to be between 192.168.2.100–150. What this means is that when a device gets an IP address from the DHCP server (the pfSense firewall in this case), it will get an IP address between 192.168.2.100–150.
Choose ‘Install CE’.
Get Lumenyx’s stories in your inbox
Join Medium for free to get updates from this writer.
Community Edition (CE) is the free version of pfSense.
I’m just going to stick with the defaults:
As I do not have multiple hard drives, I’m going to choose Stripe — No Redundancy:
I chose the most stable version:
Now that it’s installed, for some reason the LAN IP address is different. Let’s change it to 192.168.2.2/24:
The reason I chose 192.168.2.0/24 was because I already have other VMs configured in 192.168.1.0/24.
I didn’t manage to get a screenshot but I did not configure IPv6. I also set the DHCP Pool IP address from 192.168.2.100–192.168.2.150 inclusive.
I have configured a Lubuntu VM (specs are below) which sits within my Host-Only network:
The basic configuration of a pfSense firewall is now complete. You will notice that traffic from the Lubuntu VM has to go through the firewall first before it gets to my home network:
If you want to start configuring ACLs, you can do so by entering the firewall’s IP address in any browser. In our case, the IP address is 192.168.2.2.
You may get this type of error message. This is because the browser does not trust the certificate. This is okay as we configured it ourselves and it sits in our internal network. It is not a bad actor as it was literally configured by us.
You can bypass this screen by choosing ‘Advanced’ and then ‘Continue to Site’:
The default credentials are:
- Username: admin
- Password: pfsense
We will change the default password shortly.
- I configured the hostname to be pfSense-fw2.
- I left the domain as the default. You can change it if you are configuring the firewall for a business but since this is a home lab I’ll leave it.
- I configured 192.168.0.1 (home router) as my Primary DNS Server, and 8.8.8.8 (Google’s DNS server) as the Secondary DNS Server.
- I unticked ‘Override DNS’, this means that pfSense will explicitly use the DNS servers that have been manually configured, regardless of any DNS servers provided by your ISP (or upstream connection on the WAN interface). You can have this checked if you want but I’m going to have it off.
Below let’s you sync the time with pfSense’s NTP server: 2.pfsense.pool.ntp.org:
I’m going to leave this as the default:
Keep this as the default as we configured it earlier:
IMPORTANT: Configure a new admin password:
The next step will have you reload the switch.
Now you’re ready to add your own rules!
