A firewall is a hardware or software based network security system that uses rules to control incoming and outgoing network traffic. It basically acts as a barrier between a trusted network and an untrusted network. A firewall controls access to the resources of a network through a positive control model. What this means is that only the traffic defined in the firewall policy is allowed onto the network, and all other traffic is denied. It filters traffic by source and destination IP, protocols, source, and destination ports for both TCP and UDP traffic. It also limits simultaneous connection on a rule basis.

Now, let's take a look at the following diagram and see how pfSense can act as a firewall:

Consider that there is an external cloud network, which represents the Internet. Next, you have an ISP connection device, such as a cable modem, an ADSL modem...

Let's connect to the pfSense server via a browser:

1. Navigate to 192.168.1.1, which is the internal LAN IP address for the pfSense server.
2. Enter the credentials to log in to the pfSense server. Here, the admin user has logged in successfully.

We allocated an additional network interface to the virtual machine, but have not configured it yet. So, let's take care of that now.

3. Click Interfaces on the top toolbar, and select LAN2. There you can configure the LAN2 with a static IP address as you did for earlier LAN interface we configured previously.
4. After setting the configurations for LAN2, let's click the Apply Changes button to save the configuration. You can see that the changes have been successfully saved. Let's go back to the main pfSense Dashboard:

And you will see that LAN2 is up and running with an IP address of...

In the previous section, we enabled the firewall functionality within pfSense. Now it is time to configure firewall rules:

1. Back in the pfSense WebGUI console, to set up rules for the firewall go to the Firewall menu and then click Rules. Firewall rules are configured for each network interface. The following screenshot shows the WAN tab:

As you can see, pfSense is flexible enough to allow for firewall rules for each individual network, rather than enforcing these rules globally. Moreover, the rules follow a specific order. The rules on these tabs process traffic in an inbound direction and are processed from the top down, stopping at the first match. Where no user-configured firewall rules match, the traffic is denied. The firewall rules on the LAN interface, allowing the LAN subnet to access any destination, are implemented by pfSense by default....

You have configured firewall rules for LAN1 and LAN2. Now, let's see how you can manage these rules. Now that you have created many rules for the firewall, you need to understand how to manage all of these rules efficiently and effectively.

If you want to add a new rule that is very similar to an existing rule, you can copy the existing rule.

1. Click the LAN2 tab and try to create some new rules by copying existing rules. Here, we have only created ICMP and DNS rules. Let's create some more standard rules.
2. Click the copy icon under Actions for the DNS (53) rule. You can now make modifications to the rule as required. All the fields are copied from the original rule. For this instance, let's change the Source port range to HTTP(80) and leave the other fields as they are.
3. Click the Save button. And this is the quickest way to create new rules...

Let's recap some of the key points covered in this chapter. You learned all about what firewalls are, their key functions, and importance. Next, you learned all about configuring pfSense as a firewall. You also learned how to set up firewall rules for multiple LANs, as well as how to manage these firewall rules using pfSense.

In the next chapter, you will learn about the load balancing and failover functionality provided by pfSense to work with multiple WAN connections.