What kind of resources does PF Sense take to run?  Just wondering if you could just use the free version of unRAID on a small old junker PC and run the entire thing off a VM living on the USB device (pfsense).  Thoughts?  Use case analysis anyone?

 

I'm running pfSense on with a 10 year old dell computer (P4 2.6 GHz processor, 1 GB of ram). I also send all my internet traffic through a VPN which is CPU intensive. I have 30 Mbps download and if I do a speed test the CPU gets used around 50%. So unless you want to send all your data through a VPN using Google Fiber, you don't really need a good computer...

 

I am not sure what happens if you run pfSense as a VM however.

 

Nice!  That's awesome!!  I doubt that process would support being a virtualization host, but I have an old AMD 1GHz Atom Processor that would blow the pants off your P4 and has 4GB of RAM in the system right now.  More than enough to run pfsense it sounds like.

 

As far as running it in a VM, in theory, there shouldn't be any issues.  You don't really suffer much of a performance hit for passing things through a dom0.  There are obviously limitations in networking right now because of how we're doing bridging as opposed to full virtualized switching.  Those limitations shouldn't really affect anything with pfsense though because, like in your case, you're only pushing 30mbps of WAN traffic through at peak.  That's really light in terms of the load it would put on a firewall.

 

I'm not a network guy by trade as much as a virtualization guy, but would love to heard some network-heads thoughts on this idea.  What's the difference between PFsense in a VM on any commodity hardware vs. your best Palo Alto or Cisco Firewall?

 

trying to install pfsense on my rig now but cant get the cfg right. could any of you guys who already have it running post the contents of your cfg up?

 

here's what I'm trying... and yeah :'( not working tried hvm as well... no good

 

name="pfsense"
bootloader='pygrub'
memory=512
vcpus=2
disk=['phy:/mnt/cache/domains/pfsense/pfsense.img,hda,w','phy:/mnt/cache/domains/pfsense/pfsense.iso,hdc:cdrom,r']
vif=['mac=00:16:3e:35:4t:88,bridge=xenbr1','mac=00:16:3e:36:3t:87,bridge=xenbr2']
boot="ncd"
vnc='1'
vnclisten='0.0.0.0'
vncpassword=''

 

I did this:

#kernel = '/usr/lib/xen/boot/hvmloader'
kernel = 'hvmloader'
#firmware_override = "/usr/lib64/xen/boot/hvmloader"

builder='hvm'

#device_model = '/usr/xen/bin/qemu-dm'
#device_model_override = '/usr/lib64/xen/bin/qemu-dm'
device_model_version = "qemu-xen-traditional"

memory = 1024
name = 'pfsense'
#vif = [ 'mac=00:16:3e:00:00:02,bridge=xenbr0']
disk = [ 'phy:/dev/mapper/vg_arch-lv_pfsense,hda,w',
         'file:/home/pfsense.iso,hdc:cdrom,r']

vcpus = 1

vnc=1
vnclisten='0.0.0.0'
vncpasswd=''
vncdisplay=1

acpi = 1
apic = 1

serial='pty'
pci = ['01:00.0','01:00.1']

on_poweroff = 'destroy'
on_reboot = 'restart'
on_shutdown = 'destroy'
on_crash = 'destroy'

 

There was a bit of playing around to make it finally work, hence the stuff commented out.

@ smakovits That did it! Thanks :-)

 

Sent from my SCH-I605 using Tapatalk

 

 

@ smakovits That did it! Thanks :-)

 

Sent from my SCH-I605 using Tapatalk

 

Not a problem.  Just curious if you want to share if it was one thing specifically you found or a combination of missing lines.

 

I know when I first set it up I had no clue, went through like 20 postings and recommendations before this one finally worked.

There was a bit of playing around to make it finally work, hence the stuff commented out.

 

Do you have pfSense running as a domU? Also, what do you have your pfsense box setup to do? I'm just wondering if you have any routing rules setup.

I have it setup as domu as my router.  Then my wireless router is just in bridge mode. I have 2 dedicated network cards using pass-through

 

Sent from my SCH-I535 using Tapatalk

 

 

@Smakovits I pieced together what you had and ended up with this

 

builder = 'hvm'
vcpus = '2'
memory = '1024'
device_model_version="qemu-xen-traditional"
disk = [
'file:/mnt/cache/domains/pfsense/pfsense.img,hda,w',
#	'file:/mnt/cache/domains/pfsense/pfsense.iso,hdc:cdrom,r'
]
name = 'pfsense'
vif = [
 'mac=00:16:3E:51:20:4C,bridge=xenbr1,model=e1000',
	 'mac=00:16:3E:52:21:4C,bridge=xenbr2,model=e1000' ]
on_poweroff = 'destroy'
on_reboot = 'restart'
on_crash = 'restart'
boot = 'cd'
acpi = '1'
apic = '1'
viridian = '1'
xen_platform_pci='1'
sdl = '0'
vnc = '1'
vnclisten = '0.0.0.0'
vncpasswd = ''
stdvga = '0'
serial= 'pty'
usb = '1'
usbdevice = 'tablet'

 

Im attempting to use bridges though in place of passthrough since my test rig doesnt have vt-d

@Smakovits I pieced together what you had and ended up with this

 

builder = 'hvm'
vcpus = '2'
memory = '1024'
device_model_version="qemu-xen-traditional"
disk = [
'file:/mnt/cache/domains/pfsense/pfsense.img,hda,w',
#	'file:/mnt/cache/domains/pfsense/pfsense.iso,hdc:cdrom,r'
]
name = 'pfsense'
vif = [
 'mac=00:16:3E:51:20:4C,bridge=xenbr1,model=e1000',
	 'mac=00:16:3E:52:21:4C,bridge=xenbr2,model=e1000' ]
on_poweroff = 'destroy'
on_reboot = 'restart'
on_crash = 'restart'
boot = 'cd'
acpi = '1'
apic = '1'
viridian = '1'
xen_platform_pci='1'
sdl = '0'
vnc = '1'
vnclisten = '0.0.0.0'
vncpasswd = ''
stdvga = '0'
serial= 'pty'
usb = '1'
usbdevice = 'tablet'

 

Im attempting to use bridges though in place of passthrough since my test rig doesnt have vt-d

 

That I don't know, I did pass through all the way

@Smakovits I pieced together what you had and ended up with this

 

builder = 'hvm'
vcpus = '2'
memory = '1024'
device_model_version="qemu-xen-traditional"
disk = [
'file:/mnt/cache/domains/pfsense/pfsense.img,hda,w',
#	'file:/mnt/cache/domains/pfsense/pfsense.iso,hdc:cdrom,r'
]
name = 'pfsense'
vif = [
 'mac=00:16:3E:51:20:4C,bridge=xenbr1,model=e1000',
	 'mac=00:16:3E:52:21:4C,bridge=xenbr2,model=e1000' ]
on_poweroff = 'destroy'
on_reboot = 'restart'
on_crash = 'restart'
boot = 'cd'
acpi = '1'
apic = '1'
viridian = '1'
xen_platform_pci='1'
sdl = '0'
vnc = '1'
vnclisten = '0.0.0.0'
vncpasswd = ''
stdvga = '0'
serial= 'pty'
usb = '1'
usbdevice = 'tablet'

 

Im attempting to use bridges though in place of passthrough since my test rig doesnt have vt-d

 

Hi deionmann, did you manage to setup pfSense using the bridges? Can you post the steps you followed?

Looking to install pfsense on my ven/unraid 6b4. I have a tretflix appliance running really well so I know that xen is working!

 

(noob alert!)

My motherboard has 2 ethernet controllers but only one is physically connected. I guess that I can pass through the 2nd ethernet to use for pfsense. How do I know which card is the second from the PCI list? (at 4 or 7 in the pci list)

 

00:00.0 Host bridge: Intel Corporation 5520/5500/X58 I/O Hub to ESI Port (rev 12)
00:01.0 PCI bridge: Intel Corporation 5520/5500/X58 I/O Hub PCI Express Root Port 1 (rev 12)
00:03.0 PCI bridge: Intel Corporation 5520/5500/X58 I/O Hub PCI Express Root Port 3 (rev 12)
00:07.0 PCI bridge: Intel Corporation 5520/5500/X58 I/O Hub PCI Express Root Port 7 (rev 12)
00:14.0 PIC: Intel Corporation 7500/5520/5500/X58 I/O Hub System Management Registers (rev 12)
00:14.1 PIC: Intel Corporation 7500/5520/5500/X58 I/O Hub GPIO and Scratch Pad Registers (rev 12)
00:14.2 PIC: Intel Corporation 7500/5520/5500/X58 I/O Hub Control Status and RAS Registers (rev 12)
00:14.3 PIC: Intel Corporation 7500/5520/5500/X58 I/O Hub Throttle Registers (rev 12)
00:1a.0 USB controller: Intel Corporation 82801JI (ICH10 Family) USB UHCI Controller #4
00:1a.1 USB controller: Intel Corporation 82801JI (ICH10 Family) USB UHCI Controller #5
00:1a.2 USB controller: Intel Corporation 82801JI (ICH10 Family) USB UHCI Controller #6
00:1a.7 USB controller: Intel Corporation 82801JI (ICH10 Family) USB2 EHCI Controller #2
00:1c.0 PCI bridge: Intel Corporation 82801JI (ICH10 Family) PCI Express Root Port 1
00:1c.2 PCI bridge: Intel Corporation 82801JI (ICH10 Family) PCI Express Root Port 3
00:1c.3 PCI bridge: Intel Corporation 82801JI (ICH10 Family) PCI Express Root Port 4
00:1c.4 PCI bridge: Intel Corporation 82801JI (ICH10 Family) PCI Express Root Port 5
00:1c.5 PCI bridge: Intel Corporation 82801JI (ICH10 Family) PCI Express Root Port 6
00:1d.0 USB controller: Intel Corporation 82801JI (ICH10 Family) USB UHCI Controller #1
00:1d.1 USB controller: Intel Corporation 82801JI (ICH10 Family) USB UHCI Controller #2
00:1d.2 USB controller: Intel Corporation 82801JI (ICH10 Family) USB UHCI Controller #3
00:1d.7 USB controller: Intel Corporation 82801JI (ICH10 Family) USB2 EHCI Controller #1
00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev 90)
00:1f.0 ISA bridge: Intel Corporation 82801JIR (ICH10R) LPC Interface Controller
00:1f.2 SATA controller: Intel Corporation 82801JI (ICH10 Family) SATA AHCI Controller
00:1f.3 SMBus: Intel Corporation 82801JI (ICH10 Family) SMBus Controller
02:00.0 Serial Attached SCSI controller: LSI Logic / Symbios Logic SAS2008 PCI-Express Fusion-MPT SAS-2 [Falcon] (rev 02)
03:00.0 Serial Attached SCSI controller: LSI Logic / Symbios Logic SAS2008 PCI-Express Fusion-MPT SAS-2 [Falcon] (rev 03)
04:00.0 Ethernet controller: Marvell Technology Group Ltd. 88E8056 PCI-E Gigabit Ethernet Controller (rev 12)
05:00.0 IDE interface: Marvell Technology Group Ltd. 88SE6121 SATA II / PATA Controller (rev b2)
06:00.0 RAID bus controller: Marvell Technology Group Ltd. 88SE6440 SAS/SATA PCIe controller (rev 02)
07:00.0 Ethernet controller: Marvell Technology Group Ltd. 88E8056 PCI-E Gigabit Ethernet Controller (rev 12)
09:00.0 VGA compatible controller: NVIDIA Corporation NV44A [GeForce 6200] (rev a1)
09:01.0 Multimedia controller: Philips Semiconductors SAA7146 (rev 01)

 

Also, do I just passthrough the 2nd card and the traffic through pfsense uses the first card or should I install a third card?

My bandwidth is only 14mbit adsl at the moment

 

Do I use the livecd for pfsense from the website? Im not sure where the pfsense.img and .iso files come from on other people's configs

 

If anyone has some pointers on setting this up I would be grateful!.....

cheers

Tony

I plan to build a Unraid host with xen and have a VM for pfsense, can all traffic Go thru Pfsense? My server will be connected directly to internet and want to secure it.

 

I have 2 gigabit port + a dedicated ipmi port to secure...

 

I plan to build a Unraid host with xen and have a VM for pfsense, can all traffic Go thru Pfsense? My server will be connected directly to internet and want to secure it.

 

I have 2 gigabit port + a dedicated ipmi port to secure...

 

I would like to second this question. Has anyone been able to send all of the unRAID internet data thru pfsense even though pfsense is a domU?

 

I plan to build a Unraid host with xen and have a VM for pfsense, can all traffic Go thru Pfsense? My server will be connected directly to internet and want to secure it.

 

I have 2 gigabit port + a dedicated ipmi port to secure...

 

I would like to second this question. Has anyone been able to send all of the unRAID internet data thru pfsense even though pfsense is a domU?

 

I'm gonna try soon with a Sophos UTM Personnal (Free) VM Appliance (seem easier to configure than PFsense).  I'm just waiting on lots of parts to build the Server

@ luca2

 

I got it to work using bridges (no passthrough), but it's not exactly stable... unRAID has a tendency to switch ID's for nic's on the system. So doing it this way you'd have to pay close attn during reboot to make sure that the right ID (eth0,eth1,ect) is on the right nic.

 

this is what I did to make the bridged setup work for pfsense

 

1. disable bonding in unRAID gui

2. unplug all but one nic from your unraid machine

3. reboot server

4. after reboot run

ifconfig

from terminal or at physical machine, note that you have just identified eth0 as the nic that is currently connected, this will be your LAN.

5. repeat steps 2-4 after plugging in the second nic, this will be identified as eth1

6.

nano /boot/config/go

7. add this to your go file BEFORE the /usr/local/sbin/emhttp &

# xen bridge config
brctl delif br0 eth1
# setup for eth0 & br1
brctl addbr br1
brctl stp br1 on
brctl addif br1 eth1
ifconfig xenbr1 192.168.1.55 netmask 255.255.255.0 up

 

now as long as your .cfg has 2 vif lines, one pointing to br0 and the other to br1 this should work.

here's mine.

vif = ['vifname=UT_LAN,mac=00:16:3E:51:20:4C,bridge=br0,model=e1000','vifname=UT_WAN,mac=00:16:3E:52:21:4C,bridge=br1,model=e1000' ]

 

 

I would like to install pfSense on my test computer. I am sort of lost on how to install pfsense as a VM. I recently followed another guide to install an Ubuntu Server that involved setting up Ubuntu with the kernel = "vmlinuz" and ramdisk = "initrd.gz" and commenting out the bootloader = "pygrub". After the install was done you commented out the kernel and ramdisk and uncommented the bootloader. Is installing pfSense to a pfsense.img the same process or is each VM going to have a different install method?

I am still trying to figure out what initial files I need to start a pfsense domu. I was reading old freebsb xen guides that have you build custom kernels... Have you guys been building your own pfsense kernels to get this started or am I way in left field?