Recommended Posts

I am new to networking, although I have a Sonicwall firewall, their tech suspport mostly helped me set that up long time ago.
 
I installed Ubuntu Desktop 12.04 64bit with VMware and Installed pfSense 2.1 64bit inside of it.
 
Having a difficult time figuring out how to set it up though, the 2 NIC cards and the WAN/LAN settings in pfSense.
 
I wanted to use pfSense for GEO-IP Blocking / Snort(IPS/ids) / squid-dansguardian / antivirus.
 
I wanted to use sonicwall TZ 210 for NAT/ rules, since its already setup for it.
 
From what I have read, I would need to set up pfSense in Transparent Mode ??
 
I am guesing I would need to disable NAT in the pfSense firewall?
 
A setup like this: Comcast Business SMC Modem > pfSense Box > Sonicwall -  with the pfSense box having a static ip for GUI login
 
 
 
The Comcast SMC modem settings:
1-to1 NAT > Disable all
Disable firewall for true static ip subnet only
Disable Gateway smart packet detection
 
The static ip block is: 171.7.45.246/29
The WAN Internet IP Address is: 171.7.45.246
The SMC modem has an assigned static ip, and I have 5 others for use, One is assigned to the Sonicwall: 171.7.45.245
 
 
The Sonicwall x1 WAN ip address is: 171.7.45.245
Subnet Mask: 255.255.255.248
 
Would like the pfSense box to have static ip of: 171.7.45.244 so I can access the GUI from there.
 
Not sure what to set the two VMware Network Adapter Settings(WAN and LAN)? Bridged, NAT, Host-only ? or what ip's to assign them.
 
Setting up the LAN/WAN interface ip's in pfSense: 
 
Config the ipv4 address WAN interface for DHCP? y/n
Enter the new WAN ipv4 address:
Enter the new WAN ipv4 subnet bit count:
Enter the new WAN ipv4 gateway address:
 
Just to say, the sonicwall TZ 210 will have no paid security services on it, but I still want to keep it in there.
 
 
 
Please Help

 

 

"y services on it, but I still want to keep it in there."

Why - completely and utterly pointless to double nat. Why would you think you need pfsense even if in transparent mode with sonicwall there.. Pick One and move forward you don't need both.

"I wanted to use pfSense for GEO-IP Blocking / Snort(IPS/ids) / squid-dansguardian / antivirus."

So your going to do all this fancy stuff, but a couple port forwards/NATs are beyond your scope? How many services do you have running behind sonicwall now? That you have Nats setup. Do you serve your own email, web, what? What Nats do you have in place currently? It should be all of click click to get those working on pfsense.

"nstalled pfSense 2.1 64bit inside of it."

Why 64bit? Does your VM have more than 4GB of ram given to it? Wby do you think your router needs more than 4GB if it does? Are you going to be running squid and such for hundreds of users?

If you want to use pfsense - great, love the product. If you want to run it as VM, great I do the same thing lots of advantages this way. But it is pointless to double nat, it is pointless to use 64bit unless your over 4GB of ram, and actually have a need for that much ram? If you read the pfsense forums, I assure you the 64bit version has way more issues with it than the 32bit ;)

So I would suggest you pull sonicwall out, or just don't use pfsense at all. And if you want to go with it then unless you have a great reason for that much ram on a VM, I would go 32bit..

  • Like 2

One of the main reasons I wanted pfsense was for the country ip blocking.  The sonicwall only has geo-ip blocking for paid services.  I do not want to sit at a keyboard and enter in 100 thousand ip ranges to block and have to update them regularly.  pfsense has a country ip blocking package.  

 

I said I was new to networking.  Why 64bit.. Why 4gb ram for VM..  That's just the way I configured it and I had enough ram for it.

 

Why can't I set it up like I explained and disable nat within pfsense? then there would be no double nat.

 

This is the only free thing I could come up with.  I am not going to use some peerblock or software junk on every computer I have and have to still enter an endless amount of ip ranges.

 

Is there a way to configure it using both pfsense and sonicwall?

I use the pfblocker package in pfsense as well - it is very simple, click and pick the countries you dont want, etc.

Yes you can setup pfsense as transparent firewall - but WHY?? If you are tired of paying for sonicwall features, then dump it. There is just no point in running 2, there just is not. Be it you don't nat on one of them or not.

I would suggest you go to the pfsense forums for help on setting it up transparent. I am there quite a bit, and prob will help you set it up.. But it is the wrong direction.

Pfsense is great product, and used in enterprises all the time. And you wanting to go with it is great, but why are you trying to hold on to sonicwall -- for a couple of nats? That is just nuts!

I would like to use both.  Not everybody wants the same thing, nor does everybody agree with the same thing, nor does something somebody wants have to make sense to everybody else.  Everybody is different and wants what they want. Thats just people.  I want to be different and make no sense at all  :)

Why - completely and utterly pointless to double nat. Why would you think you need pfsense even if in transparent mode with sonicwall there.. Pick One and move forward you don't need both.

 

Triple NAT really. The SMC modem/router from Comcast does one too.

 

My other piece of advice is to make sure you reboot the SMC after you make any changes. Sometimes they don't 'take' until a reboot on those things. They are real pieces of ######.

^ good point. He says his netblock is

"The static ip block is: 171.7.45.246/29"

Which is just wrong from the getgo.. That is not a valid subnet boundary so clearly that is a host address. Which would fall in the block 171.7.45.240/29 which I doubt is his actual address block anyway.. Since that is owned by

3BB Broadband Internet service provider in Thailand

So he says his sonicwall wan has .245? So is the smc have the 246 address? On its wan or lan inteface? Sounds like he already has a convoluted mess and is just trying to make it more of a mess.

Didn't notice this before

" VMware Network Adapter Settings(WAN and LAN)? Bridged, NAT, Host-only"

So your wanting to run your pfsense on workstation or player? Is this a production setup? You have business connection and sonicwall that is not cheap.

I am all for being different and freedom to express yourself.. You can do that at burning man every year ;) This is a Network!! Not an art project made of trash ;)

I am more than willing to help you setup a network to the best of my ability so that it is stable, easy to understand and troubleshoot and works!! But I just don't have any desire to help someone make a mess for the sake of personal expression. But have fun!

BTW you want to run squid on a transparent bridge? Uhhh -- are you wanting squid be implicit or transparent as well? Or you going to point it at the bridge address from behind a NAT that your sonicwall is doing? Going to make it hard to filter or set policy based on ip, since your behind a nat, etc.

The point of a network is to work and be stable and perform that best it can while providing the features you require, not be a convoluted nightmare to keep up, troubleshoot or repair when there are issues...

Scum?? Really? Sorry you feel that way, your concept of rude seems to be as far fetched as your idea of how to correctly setup a network.

Have fun and good luck..

"I did post on the pfsense forums but nobody responded in 5 days so I went here."

I am on the pfsense forums pretty much every single day, what section did you put your post in. I don't recall any sort of thread like this over there. I will take a look to see how it was worded, you do understand this is a holiday week and people are most likely busy with family and such.

edit:

Ok found your thread

http://forum.pfsense.org/index.php/topic,69613.0.html

Its in the general question for starters, why would you have not put it installation help or Virtualization?

Its badly worded, and sounds like a bunch of rambling nonsense to be honest. From reading that thread, it does seem clear your over your head.. I would really suggest you rethink what your wanting to accomplish here.

This topic is now closed to further replies.
  • Posts

    • A 13 billion year old secret about our Universe's origin was revealed by Sayan Sen Image by Pascal Küffer via Pexels Researchers at the Max-Planck-Institut für Kernphysik (MPIK) in Heidelberg had recreated a key chemical reaction from the early universe, producing results that could change scientists' understanding of how the first stars formed. The study focused on the helium hydride ion (HeH⁺), which is widely regarded as the first molecule to form in the universe. Scientists believe HeH⁺ appeared around 380,000 years after the Big Bang, when the universe had cooled enough for electrons and atomic nuclei to combine into neutral atoms in a period known as recombination. This marked the beginning of chemistry in the cosmos. Immediately after the Big Bang about 13.8 billion years ago, the universe was extremely hot and dense. As it expanded and cooled, hydrogen and helium became the dominant elements. Once neutral helium atoms formed, they could react with ionised hydrogen nuclei, or protons, to create helium hydride ions. Although simple in structure, HeH⁺ played an important role in the young universe. It was the first step in a chain of reactions that eventually produced molecular hydrogen (H₂), a molecule made up of two hydrogen atoms and now the most abundant molecule in the universe. Molecular hydrogen later became a key ingredient in the formation of the first stars. At the time, the universe had entered a phase often called the cosmological "dark age." Matter had become transparent to light following recombination, but there were still no stars or galaxies producing visible light. Several hundred million years would pass before the first stars appeared. For those first stars to form, large clouds of gas had to collapse under their own gravity. To do that, the gas needed to cool by releasing energy. While hydrogen atoms can help with this process at high temperatures, they become less effective below about 10,000 degrees Celsius. Molecules can continue the cooling process by releasing energy through rotational and vibrational motions. Scientists have long considered HeH⁺ a potentially important coolant because of its comparatively large dipole moment, a property that describes how electric charge is distributed within a molecule and allows it to release energy efficiently. The amount of helium hydride present in the early universe may therefore have influenced how easily the first stars could form. At the same time, HeH⁺ was constantly being destroyed. Under primordial conditions, its main destruction mechanisms were recombination with free electrons and chemical reactions with hydrogen atoms. These reactions ultimately helped produce molecular hydrogen, linking the formation and destruction of HeH⁺ to the chemistry that shaped the early universe. For many years, theoretical studies suggested that reactions between HeH⁺ and hydrogen atoms would become much slower at low temperatures. Scientists believed there was an energy barrier along the reaction pathway that reduced the chances of the reaction taking place in the cold conditions of the early universe. The new study suggests otherwise. To investigate the process, researchers recreated a closely related reaction using deuterium, a naturally occurring isotope of hydrogen that contains one proton and one neutron in its nucleus. When HeH⁺ collides with deuterium, it forms an HD⁺ ion and a neutral helium atom. This allows scientists to study the reaction in a controlled way while closely mimicking the behaviour of the original reaction involving hydrogen. The experiments were carried out at the Cryogenic Storage Ring (CSR) at MPIK, a specialised facility designed to recreate conditions similar to those found in space. Researchers stored HeH⁺ ions in the 35-metre storage ring for up to 60 seconds at temperatures just a few kelvins above absolute zero and merged them with a beam of neutral deuterium atoms. By adjusting the speeds of the two particle beams, the team measured how the reaction rate changed with collision energy, which is directly related to temperature. The researchers found that the reaction rate remains almost constant as temperatures decrease. In other words, the reaction does not slow down at low temperatures as earlier models predicted. “Previous theories predicted a significant decrease in the reaction probability at low temperatures, but we were unable to verify this in either the experiment or new theoretical calculations by our colleagues,” explained Dr Holger Kreckel of MPIK. “The reactions of HeH⁺ with neutral hydrogen and deuterium therefore appear to have been far more important for chemistry in the early universe than previously assumed,” he continued. According to the researchers, the reaction appears to be barrierless, meaning there is no energy obstacle preventing it from taking place efficiently even at very low temperatures. The findings support recent theoretical work led by physicist Yohann Scribano, whose group identified an error in a widely used potential energy surface, a mathematical model used to describe how the energy of a system changes during a chemical reaction. The error appears to have caused previous studies to significantly underestimate reaction rates under primordial conditions. The new calculations closely match the experimental results. Together, they suggest that helium chemistry in the early universe may need to be re-evaluated. Because molecules such as HeH⁺ and molecular hydrogen played an important role in cooling primordial gas clouds, the findings could help scientists build more accurate models of how the first stars formed. By showing that helium hydride was likely destroyed more efficiently than previously thought, the study offers new insight into the chemical processes that shaped the universe during its earliest stages and helped set the conditions for the emergence of the first stars. Source: Max-Planck Institute, EDP Sciences This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "What an interesting smell you've discovered"
    • It could EASILY be 70 for the base game BUT + lots of FOMO to make it up to 100-120, like a few days Early Access, online money, pre-order bonus cars, weapons, missions, clothing, avatars or profile stuff, etc... And still WAY TOO MANY people would buy those and make Rockstar insane money.
    • Just to understand: your solution to getting rid of an online password manager is...another online password manager?
    • Cjam 2.5.0.0 by Razvan Serea Cjam is a lightweight and fast MP3 editor for Windows that lets you cut, join, and edit MP3 files without re-encoding. This means your audio quality remains untouched, and edits happen instantly. Cjam is ideal for quick, lossless edits—whether you're trimming music, combining tracks, or preparing audio for learning tools or podcasts. It features batch processing, scripting support, cue and playlist file handling, and a simple interface. Cjam is perfect for anyone who needs efficient MP3 editing without the complexity of full audio suites. Cjam requires a PC running Windows 10 or later and Microsoft .NET 6.0 or later. Key features for Cjam: No Re-encoding: Edit MP3 files without losing quality. Cut and Join MP3: Easily cut, trim, and combine MP3 tracks. Batch Processing: Edit multiple files at once for faster workflows. Scriptable Interface: Automate tasks with a custom command language. Cue and Playlist Support: Handle CUE and playlist files for seamless audio management. Fast and Lightweight: Quick processing with minimal system resources. Lossless Audio Editing: Ensure your edits don't affect audio quality. Simple User Interface: Clean, intuitive design for easy navigation. File Format Support: Works with MP3, Cjam-specific file formats (CJAMC, CJAMJ, CJAM). Cjam 2.5.0.0 changelog: Added clipboard-based import/export support for mp3DirectCut Added clipboard-based export support for REAPER Added support for naming IMP3 elements Changed the Reset behavior to preserve Undo/Redo history; use Shift key + Reset button to clear it Added a new command parameter (qcp) Added 8 new entries to lang.txt (main_c124-126, main_d150-151, main_m082, vme_c014, vme_d005) Fixed a bug where the il parameter was incorrectly applied when pasting VMP3s into the main list Fixed several other minor bugs Download: Cjam 2.5.0.0 | 1.4 MB (Freeware) Links: Cjam Home Page | Cjam Manual | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • Dedicated
      JuvenileDelinquent earned a badge
      Dedicated
    • First Post
      DrWankel earned a badge
      First Post
    • Reacting Well
      DrWankel earned a badge
      Reacting Well
    • Week One Done
      Supreme Spray LV earned a badge
      Week One Done
    • Week One Done
      Genuinetonerink- Dubai earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      504
    2. 2
      +Edouard
      163
    3. 3
      PsYcHoKiLLa
      91
    4. 4
      Steven P.
      75
    5. 5
      Michael Scrip
      72
  • Tell a friend

    Love Neowin? Tell a friend!