How to Create a pfSense lab environment with proper routing using Virtual Network Editor -- Part 1

hello everybody welcome back to my channel today's video we're going to be installing pfsense and we're actually going to replicate one of the products that they have on their website for an appliance I've seen a plenty of videos on the internet that show you how to install PF sans how to put the install it put the weigh in on there and land and then that's about it they kind of end it there they'll show you like all this how you do a firewall say I do this you know they may add another NIC to it you know but they really don't go in the detail on how to first off do a nice vm workstation installation of it so that everything kind of works off the router and how it's route is supposed to work they also don't really go into much detail pretty much outside of just the wind and land setup there's a few that do and I give them credit but they usually say oh you need to have your like you need to have done an appliance to follow along with them so I decided that I'm actually go ahead and skip all that for people and I'm actually to build you a PF sense in VMware Workstation with multiple NICs and we're going to pretend that it's actually a real appliance now if you look over here I have obviously a bunch of operating systems but if you can see here are my PF sense Irie actually have it and you can see I have four network adapters attached to it and that we all work in harmony with each other I also have Windows Server 2008 Hat Linux Debian my dual boot which is Windows 10 and Linux another Linux raspbian and every one of these actually does run off my pfsense router if I run them without the router they don't actually function because they actually are running the internet does connect directly to them so if I run my raspbian it's going to look for my network adapter here under my DMZ because that's what it's under if it doesn't see this it doesn't know what to do and it doesn't connect now there are ways around it with you know VMware you know workstation obviously but the whole point of it was to mirror and mimic exactly what would happen if you decided to do things on a PSX router all right so first thing is first I we're gonna go over here and I'm going to show you which product that we're actually doing so you have a couple of websites to look at you have the pfSense basic website if you don't know anything about pfSense I do recommend you going here and you know reading up a little bit on their websites and training products they do their cloud software capabilities now through pfSense so you can actually host the virtual in there the installation guide that we're going to go through today and how to set everything up is all going to be done through here so this pretty much tells you if you actually purchase one of the products how to set everything up well if you just downloaded their um you know their software and you want to be able to do this stuff you can do it without you know having an appliance it's just easier and then you have these systems here now net gate is the authorized dealer for pfSense they are the only authorized dealer for pfSense so have you ever bought a product I had pfSense on there and net gates name wasn't on it it's not a legitimate authorized installation now that saying that people can sell pfSense on their products it is allowed because it's open its open source software but if you want the best support and the best guarantee that everything's gonna work properly purchase it through net gate alright so they have seven different products here and what we're gonna do is the most common that probably most people are going to use for standard home and small business when you get to like the XG seven seventy one hundred and above the extra information XG series these are for enterprise 10 gigabit network connections and a lot more involved into a more memory more power basically in house up to like you know five hundred plus users you know hallway up til I say I think five thousand this one can do it's ridiculous but for most home users you're going to either pick this one or this one this one only gives you two network ports as this one gives you five so in our case because where you can go extreme you know as well go with the bigger one so we're gonna be able to build a win a four lands an op connection and everything like that so we're gonna bunch I'm actually gonna make four connections not six because I'm kind of running out of you know things that do with all these extra network ports and everything but realistically like if you had this at home like when like these two would be your win so you have win one win two or at the business so you have failover and load balancing and then you have your networks here so you have your basic land you'll have this one which will call like your camera network port and then you'll have this one over here which could be like your DMZ and then this one could be like your wireless network its ability separate from everything else to kinda like the DMZ or you can make this anything else you want like your servers and actually make this nothing but servers and then this one connects over to it all I've done a company where I made this we had a virtual farm and we hosted a lot of stuff for them so actually we had this one which was the virtual farm Nick and then this one was our camera Nick our DMZ for anybody came to the building and then our regular land poor for our actual office and workers so there's a bunch of different things you can do with this I'm depending on what you want to work with all right so first thing is first we're going to go to PSN store work backslash download and we got to download the software now it's very simple I'll go ahead and reload this speech okay so all you gotta do is you go down to here to select image to download now we obviously are using four to four for if it is later on it might be different but again the concept and principles are still the same whether we do in this video or we use an older version and even if any vanilla version if you have like say 2.4 2.0 and everything like that this will actually still work for you because what the virtual is doing is it's just mirroring and mimicking what this is doing alright so we're going to click on amd64 and then the Installer is going to be a CD image if you're actually going to do this at a live environment like you're gonna actually put this on a old computer and you want to test it that way because you got this old server and you want to do all this cool stuff with it then you're gonna want the memory stick installer it just makes it easier I mean but you can still down the CD if you want pick which ones closest to you and then you're gonna click on download now I've already went ahead did this to save time in the video so we took care of all that so what's going on here with this is that like I said we're going to mirror this so I'm going to put four instead of six I mean I can make the extra Nick's I just don't really you know worry too much about that storage you can have a choice between an 8 gig or a 32 it's up to you if you're gonna buy it I usually just go big and you get 32 but again you need to m dot 2 SATA SSD so in no reality you can buy any m 2 SATA SSD for it to plug into it so they're charging you $43 if you found one that you think is reliable for less than that you're more than welcome to use it just remember there could always be some kind of compatibility issue with it or reliability they do test these things out so it's a reliable scenario the other thing you gotta do is you gotta take a quick look down here at the specs now I do recommend to going to this website this will be down in the description below to see what we're actually building a little more information about it but I just need a couple of specs real quickly from it alright so on the spec sheet here it is a 1.6 dual-core CPU alright now it tells you right here what kind of networking it has which we don't have to worry about so we can't really configure anything more than that the onboard storage and the memory now it also tells you here - you can Wi-Fi and Bluetooth em - socket now that is actually different these m2 sockets here the EB keys and everything else they're actually different so they actually have multiples inside that that boards you can install your your SSD in there as well as putting a Wi-Fi adapter as well in there me personally I don't really put a Wi-Fi in there and less than put in my home I'll put a good Wi-Fi chip in there if it's at my house but a lot of times I'll use like ubiquitous um you know network connectors or network connectors um access points you know little domes or you know tp-link has the same ones too around my house I'm not gonna bother you know trying to use a Wi-Fi chip for my PS sense I kind of want my PS ends to be just a you know enterprising gateway slash router or as they like to call now a security appliance so now that we got this information here we're gonna be able to actually now build the virtual alright so over here I do have a little word document that I'm actually going to post down below in the description so it's going to sit here explain to us how to set everything up read that all right so what's gonna do here is we gotta set up vmware to begin with now we gotta set up the virtual NICs alright so we're gonna have one that's already pre-configured which is the bridge network and we got add three more exactly as i put here alright so to go ahead and do that we gotta go to edit you can go to virtual network editor now down here in the bottom where my mouse is you would normally see a apply changes button the reason why you don't seen on mine is because I run my VMware Workstation as administrator so I don't have to worry about always hitting these buttons here when I'm changing network NICs and everything like that but if you don't run your player your workstation as administrator you're not going to see this down here below but there is a button down here for you to actually start changing anything and you will be prompted for it so here we go so to start off with you're giving you would probably see vm vm NetZero 1 & 8 these three down here you more likely do not have yet this is where you have to add them now via net zero is the first one we're going to edit it's gonna say VM net zero bridge and internet connect and internal connections will probably be Auto bridging I like to set mine directly to what it's bridge to so I run a hardwire link on this tutorial and at my house so for this case being here I'm going to bridge it to my hardwire Lake that's exactly what I want to look for if you do auto bridging what it does it just shuffles through them all until it finds an actual connection so if I actually unplug my you know Ethernet adapter it will say wow we lost it you know just jump over to my wireless to see if that connected and then it was you know try to pick up from there alright so we first thing is that we're gonna leave VM that one and eight alone ok we can go ahead and change them but I don't want to bother so the next thing is we're going to start adding our next three so this one right here is on our document here VM net 11 so when you go to add Network it's going to ask you select Network you're gonna scroll down to VM net 11 now as you can see mine goes from 10 to 14 because it's already enabled what I ended up doing here too is I renamed them to LAN LAN 2 and DMZ to match everything on here reason being it makes a little bit easier to remember which ones which when we're actually setting everything up with the virtual so I know that I remember that ok VM then 11 because it'll only come up as being an 11 12 and 13 you're like well I don't matter which one I made which so it makes a little bit easier if you just go them exactly as they are supposed to be in your network okay so down below here we're gonna have to make sure that we turn DHCP services off and then we're going to have to change this subnet IP to 10.0.0.0 okay so I'm going to go ahead and leave this screen off for a few seconds so make sure that your land is the exact same setup as my land okay so the next thing we're going to do is going to go to land - now the thing is with these three they're all going to be the same so however so they're all going to be host only connect to a host virtual adapter and then use local DHCP services okay so they're all gonna be head and do this now you can go ahead and disconnect it from a host connected adapter and that's fine because what they'll also do is that'll also be that the reason why I leave is connected to a host virtual host network adapter it's because I want to guarantee that the subnet IP is and everything that are functioning also I'm able to actually use it to connect other things together and ping them together there's a few reasons why I keep that on but in some instances you may want to turn that off if you're having problems with your network alright so for land two we're going to go ahead I'm going to leave this up for a few seconds I'm gonna make sure you copy it as you see here on the screen so you're gonna have to go ahead and click add network rename your network click host only connect to a virtual adapter and then change the subnet IP okay and now for the last one again ad network this one's number 13 hit renamed Network the DMZ VM that information is host only connect to a virtual adapter and then we're going to do with the subnet IP at 170 2.16 0.0 and we're actually going to change the subnet mask to a slash 16 which is 255.255.0.0 we're doing this for dmz because i want to give you a much broader IP range to work with if you also have a notice to the three most common IP private IPS you'll ever see is a 10.0 number a 1/9 a 192 168 3.0 and a 172 16 on that number these are considered private IPs and I made a mistake on that so when you're ever in an actual environment you're gonna find people are gonna have a you know a IP usually starts with you know 10 10 10.1 something like that nature another one starts with 192 dot whatever and 172.16.0.0 networking tutorial as well with this so as long as everything everything that's on this screen is the exact same way you see on yours hit OK if not go back and just try to see the Edit which ones are which so you have to make sure your VM net zero is bridged and bridge to your active connection your land is set up with host only it is also at 10.0.0.0 your land to which is host only it's a 192 once eight 3.0 and your DMZ which is a host only and a 170 2.16 dot 0 dot 0 and each one of these has DHCP disabled as you can see the negative you know hash mark in here hey hit OK then go ahead and start adding and fixing the setup now it's time to go ahead and create the pfsense network so we're gonna go with typical we're gonna choose an operating system later we're gonna select other and it's gonna be FreeBSD 11 64-bit we're going to name it pfSense 2 dot 4.4 but you can call a PF sense if you want I already have a PF sense so I don't want any kind of conflicts next now you can make an 8 if you want but because again the highest that's the highest at the hg 3100 here gives us is 32 so I'm gonna give it 32 and with store is a single file because it's not big enough to worry I mean in all reality you're probably looking at about I don't know less than a gig really of all stuff on the initial install when you start installing other packages and everything that's where the extra memory needs to come in from and it's hard drive space and everything else so from here we're gonna click on finish ok so now we got to do some editing so we're gonna click Edit virtual machine go to memory and again it takes 2 gigs of memory so I'm going to give it allocate this thing for 2 gigs of max a memory the processor is going to be a single processor with 2 cores hard drive is gonna be left alone now we got to mount our ISO so cd/dvd hit browse I'm gonna go to my ISO folder and mount the pfsense 2.4 to 0.4 release p3 AMD 64 I so that we download at the beginning of the video okay now we're gonna come back to network adapters I just want to finish the rest of this USB controllers this is up to you I usually remove it and the reason why I remove the USB controller is because honestly there is no need for it in our in our situation there's not we're not gonna plug in a USB devices into it or change anything everything that we can deal with is actually done via remote so I can go ahead and you know attach an ass box to this setup here and you know download everything directly to it so I don't really don't need it same thing with the sound card don't really need it display we leave is you know auto and then we leave everything alone in here except for possibly snapshots so what I'll do is I'm gonna set mine snapshots to ask me so every time I power it off its gonna ask me do I want to take a snapshot do I want to revert the snapshot with it and the reason why I do this because I do a lot of demos and testing with this program and I really sometimes forget you know that I didn't take a snapshot and I did a lot of work to it I'm like oh man this is broken now I don't want to have to reinstall so you can either leave it just power off or ask me I usually say it for ask me now to the fun part the network adapters now we're gonna need four of them so go down to the bottom and hit add click on network adapters and finish and we're going to keep doing that until we see four network adapters now you can see they're all set as net and that's not what we want all right because as we look over here in our little lab environment setup type of guest FreeBSD 11 processor 1 processor 2 cores 2 gigs of RAM anywhere from 8 to 32 gigs of hard drive and network is for we need a bridge LAN LAN 2 and DMZ very simple to do network adapter one-click bridge okay network adapter that's a little weird but okay I remove that that is very odd how that set up but okay nice if I get this back in order okay so now it's back in order I don't know how it why or how it did that but okay alright network adapter to now you don't need them in number water but to me I'm a little OCD problem with that also I want to make sure that everything works the way I have it written down and expecting it to so network adapter to click custom click on land host-only adapter 3 same thing LAN 2 and the fourth one will be our DMZ now they don't have to be in order this way but for you to follow along and understand what I'm doing I recommend you doing it this way otherwise most of the numbers here that we're working on and later on we start doing the ports and the configuring of the interfaces are going to be different for you than it is for me but in this case we're ready to go so I can go ahead click OK because now that we have everything set up I recommend you just pause in the video and just making sure that everything on the screen you see here is how it is on your screen if it's not make any Corrections you need right now all right so now we're gonna go ahead and power it on go and make this full screen now the nice thing about this is that it is a very quick install you will get this done within five minutes even on an actual appliance that you're installing is going to take a few minutes it does not take long at all to do any of these installs for this it actually takes most of your time as configuring the interfaces and moving from there okay so we're gonna hit accept on the welcome screen we're gonna click install PS sense we'll go over this stuff at another video but the quicken the quickly information rescue shell self-explanatory your PS sensitive isn't working properly this will go ahead and create a shell that you can log into and correct anything you can and the recover that config.xml when you backup your config file and you make a really bad error in here you can't recover it through the shell you can recover to the config file I always recommend backup your config file because it's a very good thing to do now in case you ever make a whoopsie in your installation process or configuring process which I've done in the past a few times so go ahead and install first thing is key mapping if you have any other decides American please select everything below as you can see they have a laundry list alright I am just gonna go back up and just click default cuz it's just going to read whatever my default is we're going to click on Auto ufs because it is a empty hard drug that we're putting on here so we don't worry about changing or adding things or partitioning anything off and we're just going to watch it quickly install and that's it now if you want to do any manual configurations or adding everything we can but because we're new to this we're gonna hit no because we don't need to do any modifications and we want to reboot so we can start using our PSX and that's it that's the actual installation process so now what it's going to do it's going to reboot and it's my rebooted right into our interfacing and there we go so we're now at the at the login screen we're able to now go ahead and look at everything now the first thing we always do is change these and the reason why we change this is because obviously these two can't match that's not going to be a good scenario for anybody also because this is actually set for a ten dot whatever number so we can't keep that first things first we're going to press two that's going to set the IP and we're going to press two again because it's our land and to the new land 10 dot 0 dot 0 it to 54 but you can make it dot 1 ok our new subnet bit count is 24 that is that you can see above 255 255 255 dot 0 with the other ones and later on the video will be 255 255 0 dot 0 which is 16-bit but you cannot type in the full amount you have to just type in the bit count between 1 and 31 which is actually 1 to 30 so in our case it's going to be 24 this is a LAN so we do not need to set up a gateway address because it's going to automatically default to our win ok I don't use ipv6 for this tutorial so we're gonna go ahead and hit enter for none I do want to enable DHCP and then I got type in the the range address so I'm going to do 10 dot 0 dot 0 that's 2 10.0.0.0 we'll say it could be anywhere between one to 253 I usually always make it like 6 to whatever or a hundred to whatever but for this video you're gonna make it very simple because it only going to connect a couple items here and then do I want to revert back - HTTP for the web configure I do not I want to keep it as HTTPS so I'm gonna hit the letter n for no and then hit enter okay and that's the simplest thing now so what we went ahead did here is we installed pfSense we configured all the virtuals for everything we needed to and now we're able to go ahead and log into our PSN's virtual to finish the configuration so I'm gonna go ahead just minimize this I'm going to open up web browser now even though let me just go back here even though that I'm running a 192 168 1 163 on here because we have the enabled virtual NIC everything on our pfSense I'm now able to log into this otherwise I'd have to boot up another OS to go do all this configuration so I'm now able to do 1.0025 4 and you can see it finds it if I go to command and I type in ping it sees it and that's because we have the virtual NIC enabled if we turn the virtual NIC off I would need to do this all in the virtual environment so the username password is admin passwords pfSense and now we're gonna go through the basic install to get us to the directory here first page just to welcome this is why you know that nikki has global support with this so hostname we can change this to whatever we want I usually leave this as pfsense now the domain again is up to you on how you want to run your domain so if you actually only domain I'm going to type in a domain so that's my domain I own this so when I type in the actual of my to get to my router it will be pfSense dot VMware Advisor calm all right now for here we're gonna go ahead and change up a few things so eight eight eight and the reason why we're setting these up now for Google you can pick open cloud or open hope and fair cloud whatever you want I'm just doing this because I want to guarantee I can see the internet with it while we're setting up our DHCP servers later in network configurations any actual enterprise environment you probably will not do this you may put like cloud on there or some of that CD able to ping it but for the most part your primary DNS would usually be this pfSense router so ba1 27.0 we have 127.0.0.1 the actual IP address of the PSN strauder so ours will be one 92168 1.1 13 in my case are 163 sorry but just for this i want to make sure that the pfSense router has seen the internet with no problem it's able to ping the internet and everything so having these external DNS is does help out okay select your time zone now you can see here we have a lot to choose from so right now i am located actually out in europe so I'm going to pick out this because this is my time zone for where I'm at now you have your way in interface now it's set for DHCP if you're doing this at home you're gonna leave this alone you're gonna set for DHCP okay if you're not at home and you're running a business you have a static IP which we're going to do you're gonna click static ok so what we're gonna do here is we're going to type in the IP address that was given to us by our eye by our ISP so my ISP told me it's 192 168 1 dot 240 yours will be different but you have to get it from your ISP all right they're going to give you all this information same thing your subnet masking and everything else your ISP will give you all this ok then you have your upstream gate 192 168 1 1 this is the gateway they're going to give you ok so pretty much as of right now I have a static ready to go DHCP client configuration we can blunt leave that and we're not using any Triple P AE configuration so we can skip all that same thing with the with pee-pee teepee not using it and then you got your block your bogans and your RFC 1918 we're gonna leave these on ok now we've already configured our land IP address and subnet so we're gonna click Next on this just skip past it now by default you've got to change your password um you can't leave it as pfSense you got to pick something different um they don't have restrictions or requirements you know the how strong your password can be but making it password is not a very good idea so pick a very strong password to set up and then go ahead and click Next ok then we hit reload and if everything worked out you will go ahead and be greeted with D congratulations you're configured in Scenario hit finish at the bottom ok we're going to accept the noncommercial agreement license that you're going to go with and there we go so we are right now set up with pfSense and we are good to go you have your system information over here explaining everything as you can see here here's our DNS servers so don't imagine configured the straight up you know pfSense then it looks at your router and then it look to your two externals if you have a DNS server built-in which we're going to show later on in another video these numbers will actually change out to something different now we go over to diagnostics and when I click on pain type in Google I want to try when first as you see here everything came back ok then we do the same thing with LAN and again everything came back ok so this right here lets me know that pfSense is seeing the internet on both interfaces I'm gonna go ahead and close out of that screen so here you have your way in your land and it does see that they're both configured and they are connecting to the internet then we see over here as I will go ahead and enter on the screen it went ahead and updated so from previously it said 163 now it says 240 and then the same thing here with the land it will see 254 has we have it configured so one more thing left to do alright before we end this up and go change out we're gonna click on interfaces and click a sign because now we gotta in sign our other two NICs that we haven't done yet now we can do them in the command over here but consider most of this stuff we're gonna be doing is actually sorry is actually through you know this interface might as well do it through here so first things first we're gonna click Add and adding it so now they're added now we have opt one and opt to now if we remember correctly this one will be land two and this one is going to be land I'm sorry DMZ so to change that we're gonna click on opt one first thing is enable the interface description land two we're now going to hit DHCP I'm sorry static cuz we're out to give this gateway a static gateway IP and then we're gonna do the same thing here so we remember this is one nine two one six a 3.1 and this is a twenty four and that is it now if you want we can make it like everything else so I'll just make it a 254 at the end of the spectrum okay hit save now you always gonna hit apply changes if you don't apply changes it's not going to save anything and you're gonna keep going over and over again so again enable interface change it to land to ipv4 configuration is static ipv6 is none the IP address we're going to be using is 192 168 3 254 and the bit counter for the subnet mask is 24 okay so now we're gonna close back up to interfaces and then at the bottom there you see it says opt to so we're going to click on that and now we're gonna do the same thing enable interface type in DMZ configure this one for a static and weird type in 172 1601 and we're gonna make this a subnet count of 16 now the reason why I pick one and say this is one its DMZ so I'm not too worried about it two is because the IP range is going from 170 to 16 0.1 all the way to 170 to 16 2 5 5 2 5 4 it's a lot of IP addresses all right so you can technically make your gateway any one of those numbers anywhere between you can make it $100 whatever I mean you're this is a large style IP range you'll see this more or less in corporations and fortune 500s and very large businesses that you know require hundreds if not a few thousand IP addresses ISPs would love to do usually like to use this but they cut them smaller - smaller subnets so but for this video to make it simple words going to keep it down below again we're gonna hit save apply changes and there we go so we're going to go back to PSN so we're gonna click on the logo right here so you can see here we have everything all ready to go so we have our win our land one land two and our DMZ now we go back over here to PF sense and we just hit enter again as you can see it went ahead and added our land - and our DMZ explaining what they are all right but if I go over here I go ahead to ping it out and there we go we are seeing network connectivity so we have network on all three of them so we know that it's actually running through the Gateway properly but we go under here real quickly under firewall rules there are none so as you see here everything is blocked so we went ahead we create our virtual lab in VMware Workstation we created all our NICs that we needed to we installed pfSense we can figure all our interfaces on pfsense so what's left to do is we're going to go ahead and in our next video actually we're gonna go ahead and start testing out these networking adapters in PF sense so what's going to end up happening is we're going to boot up a few other virtuals and we're going to connect them to these interfaces and then we're gonna see if they can communicate to each other if they can talk to if they can talk back to another client back and forth we're gonna see how not having DHCP turned on is going to go ahead and affect them all so our next video is mainly connecting and DHCP servers and then we're going to do after that will be firewall and our third video when we do the firewall video that will explain how to block connections from DMZ to land and land - so we don't have to worry about you know back chatter or somebody on your network connecting to each other and then stealing all your company data so I hope this video was very informative and help people out if you have any questions leave some comments below I do know this video was a little bit longer than it needs to be again we had to go over a lot of information so hopefully again this all worked out like always I will leave a copy of this in description below so you can download this actual VM but you will have to set the interfaces on your network if you don't do that obviously the VM will not work properly because the interfaces aren't there so no matter what you still gotta do your own interface setup but you can actually download the copy of the PF sense we just installed right now so if you liked the video like subscribe stop back later I'll upload the other two videos and I hope everybody has a great day so I'll see you guys next time

Channel: VMware Advisor

Views: 15,528

Keywords: Pfsense, pfsense firewall, pfsense 2.4.4, vmware, vmware workstation, vmware player, vmware 15, 15, 14, domain, active directory, linux AD, Debian, ubuntu, freebsd, windows server, windows client, multiple networks, multiple network, virtual network editor, private ip, multiple nics, private network, virtualization lab, host-only, NAT, home virtualization lab, Vmware advisor

Id: gi5hkNfrwOI

Length: 45min 25sec (2725 seconds)

Published: Wed Mar 18 2020