You should be able to configure of all of the services listed previously with the computer hardware listed under the Technical requirements for Chapter 1, Revisiting pfSense Basics. Having internet access on the other side of your pfSense firewall is useful for testing Dynamic DNS; often the easiest way to do this is with a mobile connection that provides internet access via a network separate from your home/office broadband connection. A wireless access point or router can be useful if you want to set up DHCP or captive portal on a wireless network. Just remember to disable DHCP if you are using a wireless router (put the router in wireless access point mode and let pfSense act as the DHCP server).

In the previous chapter, we referred several times to configurations that can be done at the pfSense console. The same functionality is available via remote SSH login, if you enable it.

1. To do so, navigate to System | Advanced. Make sure the Admin Access tab is selected and scroll down to the Secure Shell section of the page.
2. Check the Secure Shell Server checkbox to enable SSH login.
3. If all you want to do is enable traditional login via the standard SSH port (22), then you can click on the Save button at the bottom of the page.
4. If you want to change the login port, you can do so by entering a port number other than 22 in the SSH port edit box. Changing the SSH port is a good additional security measure, especially if you plan on making SSH login accessible from the WAN side of the firewall.
5. If you set a strong password, SSH login should be pretty secure, but you can...

If you only have a few devices on your network, you could easily configure them with static IP addresses and not use a DHCP server at all. In such cases, internet connectivity will be established more quickly, since computers on the network won't have to go through the DHCP discovery-offer-request-acknowledge process. As the size of your network grows, however, a DHCP server becomes essential, as keeping track of statically assigned IP addresses will become far too cumbersome. Fortunately, configuring pfSense to act as a DHCP server is relatively easy, and can be done from either the console or the web GUI.

DHCP configuration at the console can be done with the following steps:

...

It seems only appropriate that we should follow up a lengthy discussion on how to configure pfSense to handle the task of granting hosts IP addresses with a discussion on how to configure pfSense to handle the service that maps hostnames to IP addresses, thus making the internet much more user friendly. You may never have the occasion to set up your own DNS server, but there are compelling reasons to do so. Having your own DNS server can reduce administrative overhead and improve the speed of DNS queries, especially as your network grows. Moreover, the ease with which a DNS server can be set up with pfSense makes it that much more appealing.

It should be noted that pfSense has two separate services for DNS. Prior to version 2.2, DNS services were configurable via Services | DNS Forwarder, which invokes the dnsmasq daemon. For version 2.2 and later, unbound is the default DNS...

Although DNS changes propagate through networks relatively quickly, the distributed nature of DNS and the fact that it is not fully automated means that it may take several hours to distribute a DNS change. While this is adequate for a service that only changes its IP address infrequently, it can be a problem if your IP address changes more often. For example, if you are running a server on an ISP that assigns IP addresses via DHCP, your public IP address will likely change more frequently. This is where DDNS, which provides a means of rapidly updating DNS information, comes in handy.

DDNS actually refers to two separate services. The first involves using a client to push the DNS change out to a remote DNS server. The second involves updating traditional DNS records without manually editing them (this mechanism is specified by the IETF's RFC 2136). pfSense provides the...

Businesses providing internet access for customers (usually via a wireless connection) is something that has become ubiquitous. Consequently, network administrators need a form of access control that covers such scenarios. You may want to redirect users to a login page to control access. Even if you don't want to require authentication, you may still want to redirect users to a page containing your terms of service. In such cases, you can utilize pfSense's captive portal service. Captive portal can be used to redirect wireless users to a login page, and it can also be used for wired users. Earlier versions of pfSense were limited to use of one interface on your firewall, but the current version allows you to enable captive portal on multiple interfaces.

NTP is an application layer protocol that controls the synchronization of various devices over the internet to within a few milliseconds of Coordinated Universal Time (CUT). NTP is hierarchical, with servers organized into different strata. At stratum 0 are high-precision time devices such as atomic clocks. At stratum 1 are computers that are synchronized within a few microseconds to their directly connected stratum 0 devices. At stratum 2 are computers that are directly connected to stratum 1 computers, and so on. Synchronization is achieved by adjusting the system time based on an offset. The offset is calculated by taking an average of the differences of the timestamps on request and response packets between the client and the server. The clock frequency is then adjusted to reduce the offset gradually, and the newly adjusted clock provides timestamps for the next request...

SNMP is another application layer protocol supported by pfSense. SNMP collects and organizes information about managed devices, and is often used for monitoring network devices. SNMP-managed networks consist of managed devices, software running on the managed devices (known as agents), and software running on the manager, known as a network management station (NMS). The management data is organized hierarchically in structures known as management information bases (MIBs).

Enabling SNMP in pfSense will allow it to act as a network management station, and this in turn will enable you to monitor network traffic and flows, pfSense queues, as well as system information (for example, CPU, memory, and disk usage). It is also capable of running traps on managed devices that are triggered by certain events. SNMP is implemented under pfSense with the bsnmpd service. It contains the...

In this chapter, we covered several useful services that are available with pfSense. SSH login, DHCP, DDNS, and DNS are four services that you will probably want to implement at some point, even if you are using pfSense in a home or SOHO environment. The remaining services—captive portal, NTP, and SNMP—are services you might not be likely to implement unless you are using pfSense in a corporate environment. Nonetheless, it's a good idea to have a working knowledge of these services.

In the upcoming chapters, you will learn how to further unleash the power of pfSense, with an eye towards making our networks more robust and scalable. One of the ways we can make our networks more scalable is by implementing VLANs, and we will examine that in the next chapter.

Answer the following questions:

1. (a) What transport layer protocol does DHCP use? (b) What ports does DHCP use? (c) What transport layer protocol does BOOTP use? (d) What ports does BOOTP use?
2. What are the Router Advertisement (RA) flag settings that correspond to enabling Stateless DHCP (also known as SLAAC)?
3. What are the two services pfSense has for DNS?
4. (a) What transport layer protocol does DNS use? (b) What port does DNS use?
5. What advantage does DDNS have over traditional DNS services?
6. What are the three types of authentication that pfSense's captive portal service supports?
7. What field must exist in the captive portal login page if voucher authentication is supported?
8. Name a device that can be connected to the serial port to attain greater time accuracy than NTP normally would provide.
9. What are management information bases (MIBs)?
10. What is the default port for...