Sign in to follow this  
Followers 0

PFSense, Static IPs etc


38 posts in this topic

Posted

Would totally agree with you if my router wasn't such a piece of junk.

 

Even though it is now only an AP, I have had to reboot it twice already in 24 hours, because it has been misbehaving.

My reasoning for getting a 'business class' AP, is because of this and no other reason.

Share this post


Link to post
Share on other sites

Posted

Take a look here, When I finally getting around to replacing my aging wrt54g as my AP I think I will go with this

http://www.ubnt.com/unifi

You can pick them on up Amazon

http://www.amazon.com/dp/B004XXMUCQ

Share this post


Link to post
Share on other sites

Posted

Looks really interesting.. any particular model?

Share this post


Link to post
Share on other sites

Posted

The one I linked too would be the model, unless your looking for the Long Range model?

Share this post


Link to post
Share on other sites

Posted

My apologies - only clicked the first link. That's the one I liked the look of too, although slightly more expensive than the Cisco model I was looking at.

 

For the sake of completeness, I drew my network in Visio so you can see what you helped implement.

 

 

post-11693-0-28122000-1372637554.png

Share this post


Link to post
Share on other sites

Posted

Nice -- what cisco AP are you looking at?

Keep meaning to update my layout.. Maybe I can find some time at work tmrw ;)

Share this post


Link to post
Share on other sites

Posted

Was looking at the Cisco WAP121-E-K9-G5.

 

http://www.cisco.com/en/US/products/ps12236/index.html

http://www.amazon.co.uk/gp/product/B007VKMNLQ/ref=ox_sc_sfl_title_2?ie=UTF8&psc=1&smid=A3P5ROKL5A1OLE

 

Would be great to see yours, really interested how a networking expert does it.

Share this post


Link to post
Share on other sites

Posted

@fahim: Why do you have a FreeNAS VM and a separate QNAP NAS box? Isn't QNAP supposed to take care of everything?

 

I've been thinking about a home server set up, where the virtualized server will both serve as a router, NAS, and run whatever else I need (development VMs, web server, etc...), but I'm not sure whether putting all of that on the same machine is a good idea.

 

Wouldn't the NAS be hitting the disks very hard when you're streaming HD movies (say, from multiple home computers), and therefore slow down whatever other services you have running on the same server?

 

I guess I just don't fully understand how the disk management and space allocation would work on such a server. Would you separate the NAS RAID-array from the other VMs or do you use the same RAID-array for everything?

Share this post


Link to post
Share on other sites

Posted

In my setup the nas VM has raw access to the disks it uses to serve up files, no other vm uses those. The only shared disk is the datastore where their OS lives -- os drive is not really a heavy IO hitter, etc.

Share this post


Link to post
Share on other sites

Posted

@fahim: Why do you have a FreeNAS VM and a separate QNAP NAS box? Isn't QNAP supposed to take care of everything?

 

I've been thinking about a home server set up, where the virtualized server will both serve as a router, NAS, and run whatever else I need (development VMs, web server, etc...), but I'm not sure whether putting all of that on the same machine is a good idea.

 

Wouldn't the NAS be hitting the disks very hard when you're streaming HD movies (say, from multiple home computers), and therefore slow down whatever other services you have running on the same server?

 

I guess I just don't fully understand how the disk management and space allocation would work on such a server. Would you separate the NAS RAID-array from the other VMs or do you use the same RAID-array for everything?

 

The QNAP is a TS109 Pro II single bay NAS - it's about 7 years old, has had a single Samsung F1 1TB drive in it since I bought it and I kind of expect it to die soon (although it shows no indication of doing so).  I seldom stream to multiple locations in my home at the same time.  I also don't use a large RAID array in my server.

 

I have a total of 9 drives in my server (I have ports for another 3 but not enough physical space for that many without some serious changes):

  • a 'recycled' 64GB SSD for the OS drives for my VMs under ESXi (ESXi itself is also installed here - This is used via a VMFS datastore.  My VMs have always been very quick - although I have no idea how much slower (if at all) they would be if they weren't on a SSD.
  • 4 large drives (3.5") mapped raw to my FreeNAS VM and used as ZFS array.
  • 4 smaller drives (2.5") mapped raw to a NexentaStor Community Edition VM again as a ZFS array - this is mainly to play with.

I will likely add another SSD (possibly 2) at some point I think for more OS storage as I have run out and am nowhere near hitting my CPU or RAM ceilings.  I have a 96GB SSD in my laptop that will likely get recycled at some point :-)

 

I've not experienced a performance hit so far.  If I do, I'll have to carefully consider my next move!

Share this post


Link to post
Share on other sites

Posted

What's interesting to me about this whole setup is that if any of the non-pfSense VMs need to access the Internet, the ESXi server needs to do a context-switch and load up the pfSense VM to service the request first, and then switch back to the original VM and so on and so forth.

I guess if you have a multi-core CPU this performs well (given that internet speeds aren't all that nowdays).

 

Here's another scenario: I was thinking that if I had a FreeNAS VM and I would want to have the ability to stream my media when I'm away from home, I could install Subsonic for music (or something equivalent), and something else for video. But then the FreeNAS VM would be running Internet services and have direct access to my media files, which means that if someone exploits Subsonic (or whatever app you use), then he might gain access to files I don't want him to see.

 

A possible solution to this might be to create a very lightweight VM that runs only those audio/video services and has read-only access only to the relevant media folders. In this case, if this VM is compromised, the attacker only has read-only access to some elementary media files and nothing else.

 

But how do you share files from one VM to the other? Is there an efficient way of sharing folders this way, other than using NFS/Samba?

Share this post


Link to post
Share on other sites

Posted

What's interesting to me about this whole setup is that if any of the non-pfSense VMs need to access the Internet, the ESXi server needs to do a context-switch and load up the pfSense VM to service the request first, and then switch back to the original VM and so on and so forth.

I guess if you have a multi-core CPU this performs well (given that internet speeds aren't all that nowdays).

 

Here's another scenario: I was thinking that if I had a FreeNAS VM and I would want to have the ability to stream my media when I'm away from home, I could install Subsonic for music (or something equivalent), and something else for video. But then the FreeNAS VM would be running Internet services and have direct access to my media files, which means that if someone exploits Subsonic (or whatever app you use), then he might gain access to files I don't want him to see.

 

A possible solution to this might be to create a very lightweight VM that runs only those audio/video services and has read-only access only to the relevant media folders. In this case, if this VM is compromised, the attacker only has read-only access to some elementary media files and nothing else.

 

But how do you share files from one VM to the other? Is there an efficient way of sharing folders this way, other than using NFS/Samba?

 

Such context-switching is what ESXi is good at.  I am using a dual-core CPU in my server but not a very powerful one.

 

You certainly don't want to be putting your FreeNAS VM on the internet.

 

A better idea would be to create a DMZ and have your internet facing VM living there, connecting to your FreeNAS VM through the firewall with only the appropriate ports open.

 

As for protocols, I don't really know - but I guess it would be a choice of NFS or iSCSI.  I don't know enough about iSCSI to know if it would work.

Share this post


Link to post
Share on other sites

Posted

"ESXi server needs to do a context-switch and load up the pfSense VM to service the request first, and then switch back to the original VM and so on and so forth."

 

I don't really think you understand how esxi works to be honest..  You do understand this is run in enterprise with hundreds of VM running on 1 piece of hardware in some setups.  We are not running on 386s or something  ;)

 

This is not a single threaded sort of application - context switching??  Your trying to oversimplify what is going on.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.