PFSense, Static IPs etc

[+Fahim S. MVC]

Would totally agree with you if my router wasn't such a piece of junk.

 

Even though it is now only an AP, I have had to reboot it twice already in 24 hours, because it has been misbehaving.

My reasoning for getting a 'business class' AP, is because of this and no other reason.

[+BudMan MVC]

Take a look here, When I finally getting around to replacing my aging wrt54g as my AP I think I will go with this

http://www.ubnt.com/unifi

You can pick them on up Amazon

http://www.amazon.com/dp/B004XXMUCQ

[+Fahim S. MVC]

Looks really interesting.. any particular model?

[+BudMan MVC]

The one I linked too would be the model, unless your looking for the Long Range model?

[+Fahim S. MVC]

My apologies - only clicked the first link. That's the one I liked the look of too, although slightly more expensive than the Cisco model I was looking at.

 

For the sake of completeness, I drew my network in Visio so you can see what you helped implement.

 

 

[+BudMan MVC]

Nice -- what cisco AP are you looking at?

Keep meaning to update my layout.. Maybe I can find some time at work tmrw ;)

[+Fahim S. MVC]

Was looking at the Cisco WAP121-E-K9-G5.

 

http://www.cisco.com/en/US/products/ps12236/index.html

http://www.amazon.co.uk/gp/product/B007VKMNLQ/ref=ox_sc_sfl_title_2?ie=UTF8&psc=1&smid=A3P5ROKL5A1OLE

 

Would be great to see yours, really interested how a networking expert does it.

[Caleb]

@fahim: Why do you have a FreeNAS VM and a separate QNAP NAS box? Isn't QNAP supposed to take care of everything?

 

I've been thinking about a home server set up, where the virtualized server will both serve as a router, NAS, and run whatever else I need (development VMs, web server, etc...), but I'm not sure whether putting all of that on the same machine is a good idea.

 

Wouldn't the NAS be hitting the disks very hard when you're streaming HD movies (say, from multiple home computers), and therefore slow down whatever other services you have running on the same server?

 

I guess I just don't fully understand how the disk management and space allocation would work on such a server. Would you separate the NAS RAID-array from the other VMs or do you use the same RAID-array for everything?

[+BudMan MVC]

In my setup the nas VM has raw access to the disks it uses to serve up files, no other vm uses those. The only shared disk is the datastore where their OS lives -- os drive is not really a heavy IO hitter, etc.

[+Fahim S. MVC]

@fahim: Why do you have a FreeNAS VM and a separate QNAP NAS box? Isn't QNAP supposed to take care of everything?

 

I've been thinking about a home server set up, where the virtualized server will both serve as a router, NAS, and run whatever else I need (development VMs, web server, etc...), but I'm not sure whether putting all of that on the same machine is a good idea.

 

Wouldn't the NAS be hitting the disks very hard when you're streaming HD movies (say, from multiple home computers), and therefore slow down whatever other services you have running on the same server?

 

I guess I just don't fully understand how the disk management and space allocation would work on such a server. Would you separate the NAS RAID-array from the other VMs or do you use the same RAID-array for everything?

 

The QNAP is a TS109 Pro II single bay NAS - it's about 7 years old, has had a single Samsung F1 1TB drive in it since I bought it and I kind of expect it to die soon (although it shows no indication of doing so).  I seldom stream to multiple locations in my home at the same time.  I also don't use a large RAID array in my server.

 

I have a total of 9 drives in my server (I have ports for another 3 but not enough physical space for that many without some serious changes):

• a 'recycled' 64GB SSD for the OS drives for my VMs under ESXi (ESXi itself is also installed here - This is used via a VMFS datastore.  My VMs have always been very quick - although I have no idea how much slower (if at all) they would be if they weren't on a SSD.
• 4 large drives (3.5") mapped raw to my FreeNAS VM and used as ZFS array.
• 4 smaller drives (2.5") mapped raw to a NexentaStor Community Edition VM again as a ZFS array - this is mainly to play with.

I will likely add another SSD (possibly 2) at some point I think for more OS storage as I have run out and am nowhere near hitting my CPU or RAM ceilings.  I have a 96GB SSD in my laptop that will likely get recycled at some point :-)

 

I've not experienced a performance hit so far.  If I do, I'll have to carefully consider my next move!

[Caleb]

What's interesting to me about this whole setup is that if any of the non-pfSense VMs need to access the Internet, the ESXi server needs to do a context-switch and load up the pfSense VM to service the request first, and then switch back to the original VM and so on and so forth.

I guess if you have a multi-core CPU this performs well (given that internet speeds aren't all that nowdays).

 

Here's another scenario: I was thinking that if I had a FreeNAS VM and I would want to have the ability to stream my media when I'm away from home, I could install Subsonic for music (or something equivalent), and something else for video. But then the FreeNAS VM would be running Internet services and have direct access to my media files, which means that if someone exploits Subsonic (or whatever app you use), then he might gain access to files I don't want him to see.

 

A possible solution to this might be to create a very lightweight VM that runs only those audio/video services and has read-only access only to the relevant media folders. In this case, if this VM is compromised, the attacker only has read-only access to some elementary media files and nothing else.

 

But how do you share files from one VM to the other? Is there an efficient way of sharing folders this way, other than using NFS/Samba?

[+Fahim S. MVC]

What's interesting to me about this whole setup is that if any of the non-pfSense VMs need to access the Internet, the ESXi server needs to do a context-switch and load up the pfSense VM to service the request first, and then switch back to the original VM and so on and so forth.

I guess if you have a multi-core CPU this performs well (given that internet speeds aren't all that nowdays).

 

Here's another scenario: I was thinking that if I had a FreeNAS VM and I would want to have the ability to stream my media when I'm away from home, I could install Subsonic for music (or something equivalent), and something else for video. But then the FreeNAS VM would be running Internet services and have direct access to my media files, which means that if someone exploits Subsonic (or whatever app you use), then he might gain access to files I don't want him to see.

 

A possible solution to this might be to create a very lightweight VM that runs only those audio/video services and has read-only access only to the relevant media folders. In this case, if this VM is compromised, the attacker only has read-only access to some elementary media files and nothing else.

 

But how do you share files from one VM to the other? Is there an efficient way of sharing folders this way, other than using NFS/Samba?

 

Such context-switching is what ESXi is good at.  I am using a dual-core CPU in my server but not a very powerful one.

 

You certainly don't want to be putting your FreeNAS VM on the internet.

 

A better idea would be to create a DMZ and have your internet facing VM living there, connecting to your FreeNAS VM through the firewall with only the appropriate ports open.

 

As for protocols, I don't really know - but I guess it would be a choice of NFS or iSCSI.  I don't know enough about iSCSI to know if it would work.

[+BudMan MVC]

"ESXi server needs to do a context-switch and load up the pfSense VM to service the request first, and then switch back to the original VM and so on and so forth."

 

I don't really think you understand how esxi works to be honest..  You do understand this is run in enterprise with hundreds of VM running on 1 piece of hardware in some setups.  We are not running on 386s or something  ;)

 

This is not a single threaded sort of application - context switching??  Your trying to oversimplify what is going on.

[papotz22]

HI! Farim S. can you teach how you do it!? seems we almost has same setup., and the config on Access Point wireless router how did you configure it? 

[+Fahim S. MVC]

On 28/01/2016 at 6:45 AM, papotz22 said:

HI! Farim S. can you teach how you do it!? seems we almost has same setup., and the config on Access Point wireless router how did you configure it? 

Wow, network doesn't look completely like this anymore.  However:

 

I am not entirely clear what you are asking, but if you want to take a wireless router and use it as an access point, you need to switch off all of the routing functions.

 

If the router you want to use as an AP has a dedicated WAN port, then put some tape over it and make sure you *DON'T* use it.

Next choose an IP Address that is within the subnet that your actual router is in, but outside its DHCP scope.

Configure the router you want to use as an AP to:

- give it the IP Address you chose.

- switch off its DHCP function

 

Pretty simple really.