Virtualizing pfSense - Pros and Cons to Consider

[@kevinthomas7478]

I've been running a firewall virtually on ESXi similar to this for years now. I ran IPfire virtually for years but just recently switched to pfSense. I like running it virtually and it's great for a home network. I have the ability to quickly provision and test new firewall distros if I want to.

[@RicardoPetrazzi]

I like the way you describe pfsense as the swiss army knife of networking! thats great! BTW - If you are use Microsoft Hyper-V Server (Hypervisor only) you can use 10GbE Nics, if there is driver support. That hypervisor has no GUI unfortunately but can be setup to be managed using the standard mstoolset from a Win10Pro machine. If Hyper-V see the 10GbE Nics and the drivers work, you got 10gig networking - setup a virtual switch (external) linked directly to the Nic, then attcah to VM, boot pfsense and you are good to go. pfsense will only see what ever virtual network adapters the hypervisor presents to it, so for this sceanrio, no issues. If there are no linux drivers for the NIC for example and you load pfsense direct on to physical box, then this matters! I selected a Broadcom 57xx series SFP+ Dual port PCI-e card for my setup as there are drivers for Windows Server 2008 R2 + 2012, 2012 R2, 2016 and 2019 that also work with the free Microsoft Hyper-V Server hypervisor only version. In to that I plugged my 2 x 10GbE Direct Attcah Copper cable, the in to a UniFi XG-16 switch - there you are 20GbbE aggregated LCAP Link to the switch. Also, used in this setup is a QNAP NAS with sane dual port SFP+ NICs also bonded and connected to said switch. Server is used was and old DELL T320 with a pair of SSDs for the OS only. iSCSI link to the NAS -where the VMs (VHDs) reside and run from. Hyper-V server just sees the NAS volume as a Local (iSCSI) Disk. data transfer rates are awsome! All networking is done with VLANS through the UniFi XG-16 Switch. Finally, my WAN link to the cable modem is made via 1Gig Ethernet to same XG-16 switch. VLANs used - VLAN 0 (Default) & VLAN 10 (iSCSI) & VLAN 20 (WAN) Server is VLAN Member of ALL VLANS NAS see VLANs 10 only VM running PFSense has 2 virtual NICs - one connected to VLAN 0, the other VLAN 20 for the WAN VM Running UniFi controller has one virtual NIC on VLAN 0 (Default) I could add another VLAN for a Guest Wi-Fi network if needed to very easily with this setup. Granted this setup cost a fair few bucks, but it kicks ass! :-)

[@Taylordtech]

Well now that I have a virtualization server its time to use it! I probably jumped a bit in the deep end by starting out learning networking by virtualizing my router, but it was a great learning experience and I had fun with it. Best of all the performance difference is pretty noticeable and having all machines on the same network finally is oh so very nice.

[@LakeGreen]

Thanks for sharing your experience. I virtualized pFSense a year ago, distracted with a--now--ex-girlfriend, and was left with a network that was beautiful...until it went down and I couldn't recover it. Gotta love those distractions. The experience left a not-as-good taste in my mouth for the better part of the year. For the time pFSense was up and functioning, it was absolutely amazing, to be honest. You're being slightly modest regarding the performance improvement over a conventional router. In my case, my pFSense installation was in lieu of my presently running EdgeRouter Lite (an amazing router for the uninitiated). Regardless, pFSense was noticeably faster (given the hardware, it isn't surprising, I'm sure, but for me it still was exciting to see as I didn't quite believe it could get faster...it's still Comcast...I'm still running an old Motorola DOCSIS 3 modem)--although it did require just a bit more configuration and planning... Now that I'm getting around to installing it again, it's great to see a video of a similarly skilled specialist to encourage the voyage. I would like to have a Hyper-V Server for VMs--exclusively--wherein pFSense will be installed with other chosen network VMs. Is there anything I should look out for that you didn't mention in the video (mistakenly or purposefully) that I might want to look out for? Your note of how the NICs are listed in H-V vs pF was unknown by me. Quite helpful (and likely part the reason my last installation was so short-lived). Additionally, is your Hyper-V Server attached to a domain or standing alone? This problem alone has authorized much kicking of the can down the road for me as my AD experience is loathesome, but looking forward to learning it all under WS2016. Thanks for your time, and yet another awesome, down-to-earth video.

[@Taylordtech]

+Lake Green Bit to unpack with this one. - I may be underselling the performance difference a bit, but Ive found its better to not oversell something that takes a lot of configuration to get right. A basic no-frills pfSense install isnt going to be much improvement over a home router. Its not till you add on some of the plugins that you really see the boost. - There will definitely be more coming on doing a virtualized home environment. working out some of the details on the next one now (Zentyal as DNS and domain controller). - I think I covered the big ones, biggest of course being dont let your hypervisor have access to the NIC that is your WAN. - I am now attached to a domain, but was not when I first installed pfSense. Now everything BUT pfSense in joined to the domain (for some reason it just refuses to join. FreeNAS had no issues though). Being on the same domain makes it sooooooo much easier to use Hyper-V Manager. Its really the best way to go. Thanks for the kind words!

[@ReadZead]

Hi taylord could you make a video or a guide on how to do the wan and lan switches?

[@Taylordtech]

Even better: I'm working on using a single switch for both WAN and LAN using vlan segregation.

[@jerryadams1720]

im weary of running a firewall/router virtualized. im more old school and prefer (at least) my router to be hardware. firewall maybe acceptable as virtualized imo. however you did go over the cons of a virtualized firewall/router.

[@berk427]

Wow, so well done! Thanks for posting, man! Very helpful.

[@JensHove]

I've got pretty much the same setup/networking running under ESXi. Works like a charm. ESXi has a free version btw. It's fine for this. Nice video.

[@Taylordtech]

So does Hyper-V: kzbin.info/www/bejne/a2ism6Ftp8prjpo

[@TedCorriveau]

So after 2 years, what would you change? And would OpenBox be a better solution if you were using a Linus server and didn’t want to dedicate the whole box to PF? - great video. Thanks for the tips!

[@samanbalal824]

How did you create the LAN virtual switch for pfSense? Is it on the Internal network or external network virtual swithch?

[@DannyLyriCa]

Hey question, are you still visualizing pfsense? im thinking of the same right now

[@mdd1963]

Wasn't sure PFSsense would work in HyperV...it does. :)

[@itsathejoey]

Can you run it in this config? Internet > Router > PFSense VM > Rest of network

[@bentheguru4986]

Not a bad video. I used a lot of PF in my earlier days but moved to Endian Community as it was faster and smoother (PF went to shit when it was commercialised). Since then, I have been using UniFi with a USG Pro but as these go, they are still just a firewall greatly becoming over complicated and confusing. Don't stress over the power draw, the negative comments I can see are those who come close to whats being wanted in current state and then future. Start running a few heavy plug-ins like Snort IDS/IPS, caching and AV, having a little more grunt is great. As the machine is a R710 (older but great bang-for-buck), you can do a lot with them, especially with add-on storage and NIC's. I would suggest giving the PF VM say 2-4 cores along with say 4GB RAM would be better. Plenty of both in the host, why not? I will be moving back to this style setup in the coming month or so, just a smaller platform (Dell R310) that will be a pure SSD Hyper-V host but just for network security platforms as I can run/test a few different flavours in quick fashion as well as build VM's for clients.

[@Taylordtech]

+Ben TheGuru thanks for the tip about Endian. I'll have to give that a go. I don't let the power draw comments bother me. Half the people making them probably still use incandescent bulbs. Having a workhorse that you can virtualize all the things with is useful...as my next video kinda proves. I think I'm only giving PF 2c/2gb right now, but I'm only running a few plugins. It hasn't slowed down on me yet and ram usage hovers around 30%. I thought about doing an R210 as a dedicated router, but I think I prefer the virtualized setup. Figure I'll save my pennies for building a 20c/40t monster in a C240 chassis as my new remote workstation. I hear you can do some amazing things with Steam in-home streaming these days...

[@juliodusablon2470]

Endian ships your data off to their "cloud" for processing. Not really the same thing as an on-prem solution.

[@maximumwoof8662]

you might want to look at "Lawrence Technology Solutions" channel a viewing, searching on PF Sense.. this guy IS a Linux guru, installs PF Sense for his clients and came from a Fortune 500 Corporate IT background some 15 years ago, knows Enterprise software well, I'm not calling you out or anything but just saying it's worth a look !

[@Maisonier]

Do you recommend virtualizing pfsense AND Freenas in the same computer? is of pfsense slower on a virtual machine???

[@alexisr.diazmartinez5900]

I recommended FreeNAS virtualization, pfSense, i have my reserves

[@BinarySounds]

SR-IOV allows your hypervisor to passthrough VMs to virtual NICs that are presented directly by your NIC. The assumption is that your NIC does support SR-IOV but if you can get it, the performance is far better than switching as you describe. You can also passthrough NICs without SR-IOV but you are effectively passing through the entire PCIE device to the VM so you would need as many NICs as you have VMs.

[@Taylordtech]

+BinarySounds very interesting. Looks like that is available on the Connect-x 3 and later cards. Unfortunately I only have Connect-x 2 cards. I didn't use PCIe pass through since I wanted the nic to be available to multiple VMs. If the 3s ever come down in price I'll have to get one so I can play with SR-IOV.

[@enix4141]

IIRC X2 should support SR-IOV but wont support RDMA. I doubt it would help with switching performance I would think you would more so want it for hardware offloaded encryption for vpn tech like ipsec or openvpn. SR-IOV would need to be enabled at vswitch creation btw.

[@richardwilliamjohnson8566]

Excellent video for a networking beginner, I learnt a lot. Thanks!

[@EsotericArctos]

I am watching this now as I am thinking of doing the same thing. I was using a mini-pc type thing with a VIA CPU on it with PFSense running off a Compact Flash card for a while, but I found the RAM was the bottle neck on that as it maxed at 512MByte. It was very power efficient though as the mini-PC was originally designed as a Satallite thin client. I am looking at virtualising it all now as I am running a couple of servers now, one for BlueIris, which is Windows based and resource hungry, so it makes more sense for me to virtualise everything given the more powerful box is runnign 24/7 anyway. I was thinking of running ProxMox just for simplicity at home. What are your thoughts on this?

[@marcomorosini376]

Pfsense is a great tool to learn on. I use it at work for VPN, firewall, IDS, proxy

[@davidgulbransen6801]

pfSense is definitely a go-to option. I have really taken a liking to Untangle. There’s some hate for it online, but it has been incredibly solid for me and very feature rich.

[@James5976]

My experience virtualizing network appliances: set like 1-2vcpu tops, then set a reservation or set the hypervisor latency to low. When the VM is crunching lots of data the hyervisor will schedule time properly but if the network usage is low I've seen VMware & hypervisor unschedule the VM for longer causing multi millisecond latency. I especially find this on the F5 VM images

[@cybernessful]

Should you have a dedicated hardware for pfSense? Otherwise, how are going ensure that you other VMs are secured?

[@kevinthomas7478]

There's always a risk when running a firewall virtually. If the host itself can be exploited, it puts all virtual machines at risk, including your firewall. Sometimes you have to make trade offs and you must decide for yourself if you are willing to take the risk. It's also a little different when you are talking a home network vs a medium to large business.

[@charliebrownau]

Good video . I am in the process of building an pfsense box

[@Obelixlxxvi]

Hi Taylor, great video. A tiny suggestion...if you are going speak in that low growl style then I suggest you bring the mic closer to you, else better change the low growl tone to a more clear one, as non-native English speakers will have to strain while listening.

[@StunnerAlpha]

Good point but just want to point out closed captions (auto generated) exist and are reasonably accurate.

[@funnynoodle6997]

Nice setup but what if you want to use vlans on the LAN side of your virtual switch eg: if you have a managed switch behind your Virtual switch via the servers NIC how would the vlans comunicate ?

[@CatPlanetDay]

Hi, Taylor Tech. Can i ask what network drawing tool/software you are using on 8:60?

[@Taylordtech]

Its called Gliffy and is free to use online: www.gliffy.com

[@wrcrooks]

Why are you creating a Virtual Switch for each physical interface instead of giving the pfSense Virtual Machine direct access to the external interface if it's the only machine using that interface? (VSwitch0 and VSwitch1)

[@Taylordtech]

You could do device passthrough with HyperV, but it doesnt play well with Dell's integrated NICs. Otherwise, the virtual switch is just how HyperV assigns NICs to VMs.

[@vincentpham7445]

good thing I found your channel

[@huntmining]

what is up with the high pitch chirping..... or do you have a smoke detector with a bad battery...

[@NunoSilva1975]

Hi, I can see where you put the links for information that you refer in video

[@sale666]

Hey quick question.. so my server has 2 nics its runing server 2019 and by using hyper v what am i supposed to set for the pfsense vm as network? It does not make sense to use private as than how will other devices connect to it such as host? Than again using external exposes the host to the internet? Can you clarify that please?

[@jerryadams1720]

my setup is a hardware router (netgear nighthawk) running ddwrt. and a hardware firewall micro appliance running pfsense that i just setup. esxi hypervisor running a windows domain controller vm, plex vm, nagios vm and a couple other VMs for playing around with (windows, linux, kali)

[@Fox350Karting]

Many thanks for that ! Great work!

[@alexd5637]

Especially now you should be able to find plenty of used cheaper 10g or 40g switches that can do routing. Just not NAT or encrypted VPN and so on .. Pfsense can still do that part since Internet connections are waay unlikely to go over 1Gbps.

[@pv6596]

If you trust pfsense’s AV solution, you do deserve what is coming to you! (I love pfsense, but I know how *exactly* it works. You should too!).

[@John.strong]

P V better then nothing at all

[@paulvancyber1979]

i try to virtualize and i dont have enough nics!!! LOL im going to buy 2 nics, great video mate!!! grettings from mexico

[@markarca6360]

Use VLAN tagging.

[@nevoyu]

Just a heada up Proxmox is just a fancy GUI on top of KVM

[@TheRangeControl]

PFsense can't do 10Gb??? Why do they display options for 10Gbe cards during setup? I mean, why would it even recognize them?

[@VLearnIT]

This video was made in 2017, it does 10gb.

[@davidg4512]

Great Channel, definitely in my boat, subbing

[@Taylordtech]

+David G awesome to hear! I tend to put things out every 2-3 weeks because I like to do my research and make sure the steps I'm taking are repeatable.

[@mindshelfpro]

Thanks for your videos. I want to use pfsense with two wireless cards (1 for secondary WAN and the other as a secondary LAN AP), but Hyper-V Server 2019 refuses to allow me to add any wireless cards to virtual switches. Has anyone added wireless cards to virtual switches in the free Hyper-V 2019 server? Will any other Type 1 hypervisor allow wireless cards like what I want to do? Thanks in advance!

[@DrazenMarjanovic]

ONE MORE great video good job :) make my day

[@KrishnaYadav-hp2yi]

Can we create virtual instances or domains in pfsense

[@LaurentiuDumitras]

hey! just asking why you do record the sound with this low quality?

[@Dvach_Hikka]

Thanks dude.

[@aaronjameshorne]

But he's using hyper-v tho

[@charliebrownau]

Gday. Any chance you can list the hyper options besides Microsft hyperv in the info tab please , thanks in advance

[@TekNexSolutions]

charlie brownau you can use Vmware or Virtual Box, both work fine.

[@Taylordtech]

Proxmox is another good option. As a bonus it has ZFS built in as well for storage

[@JHACbiz]

wiki.freebsd.org/bhyve

[@charliebrownau]

Can you do 10GBE on ipcop instead of pfsense?

[@somebodyulove4099]

Hi Taylord, can you help me with this error message I got from Pfsense: Filter Reload There were error(s) loading the rules: /tmp/rules.debug:40: cannot define table pfB_Europe_v4: Cannot allocate memory - The line in question reads [40]: table <pfB_Europe_v4> persist file "/var/db/aliastables/pfB_Europe_v4.txt" @ 2018-09-28 11:00:11 any help will be gladly appreciated. Thanks

[@Taylordtech]

Sounds like your pfsense instance ran out of memory. How big is that rule?

[@enix4141]

Next do it with VLAN's so you only need to pass two virtual nics to your pfsense VM. one for you 1G lan and one for your 10G lan. Hint this comand will come in handy: Get-VMNetworkAdapter -VMName | Where-Object -Property MacAddress -eq "" | Set-VMNetworkAdapterVlan -Trunk -AllowedVlanIdList "x-x" -NativeVlanId x

[@glenewhittenberg]

Why can't you do 10G? BSD has 10G drivers doesn't it?

[@Taylordtech]

My understanding of the issue is that it is not about driver support or data volume, but packet volume. 10gb is throwing a lot of packets at the firewall and the BSD kernel cant handle the request volume. Apparently 10gb switching (e.g. bridging two 10gb NICs) works fine, its just trying to run that many packets through the firewall. ill have to test if this is as big an issue as people say (since im mainly going by people's reports). It also makes me wonder if jumbo packets would make a difference.

[@juliodusablon2470]

Whoever told you that is full of it. pf is perfectly capable of 10Gb. Usually what kills a pfsense box's resources is snort. That said, if you're trying to perform any kind of DPI and/or correlation on the same box that is performing routing and fw on a near-saturated 10Gb pipe, you have some architecture/planning questions to ask yourself.

[@MichaelZimmerer]

arrgghhhh hyper-vvvv i'm meltinggg i'm meltinggg

[@merdzd]

Low volume

[@Stoney_Eagle]

I love pfsense. I use it for more then 4 moths as my only router and it hasn't been offline since. My isp's router howerver..... Pfsense doesn't use much cpu and ram whahahahahaha say that when you're under a ddos attack. I got 40 gig of ddr3 ecc allocated to the pfsense vm. 40 gig will give you 2.4 million tables and the last guy struggled to even push it to 48% so I'm a happy gamer. If any guy thinks he can boot me pm me for my IP 😂🤣

[@tcc5750]

Send me ip pls

[@Taylordtech]

+TCC no

[@schusker7372]

Stoney_Eagle jj

[@triforcelink]

+TCC 127.0.0.1

[@forid200]

DDOS can and will take you offline. Doesn't matter what behemoth you're running. If your WAN connection is saturated, it's saturated.

[@pv6596]

I did the same, HA pfSense virtualized. But now I will change to educated software. Why? If you have to ask, you still don’t have enough EXPERIENCE!!

[@jakke1975]

All sysadmins who take their job seriously, should seriously consider learning and moving to Linux instead of fudging around with Hyper-V and other Mickeysoft products. I really can't take these videos seriously anymore when wannabe sysadmins think they can "learn" from messing around with Windows. You don't control your own product, you don't even own your own data and on top of that, you need to pay an arm and a leg for all the required licenses (assuming you don't crack your way into an illegal copy - which again, a pro sysadmin would never do). Oh, did I forget again that you don't even own your own HARDWARE? It's the same Mickeysoft who dictates what you can and cannot do with it, when you have to upgrade and blah blah blah... could go on for so long. Long story short... M$ is a waste of breath. At least you're choosing a very fine quality firewall/router.

[@T-H-X]

One negative point of using a virtual machine is the power consumption. If I wanna use a virtual machine i do need much more cpu, ram and hd to get a stable machine which will cost much more money if I use this 24 hours a day.

[@Taylordtech]

Not really. My virtualization server (a Dell R710) only cost me $250 and practically sips power at an average of 120w being drawn. with all VMs shut down it drops to like 115w, so its basically idling. Shopping smart makes a big difference. Had I known then what I know now about used enterprise hardware I wouldnt have custom build a NAS using desktop components and would have just bought a R510 with some low-power CPUs.

[@112Haribo]

120Watt would still be a lot for running a pfSense instance. When you're not using your homelab, and maybe want to shutdown your big ass virtualization host, it would also kill you network functionality when running virtualized pfSense.

[@Taylordtech]

Well that might be all thats on it now, but thats not all that will ever be on it. I already have a Zentyal box for DNS and DC. Plex is in the works as is Asterisk. Eventually it will be the nerve center for the house. Considering that 120w doesnt seem like much.

[@T-H-X]

My pfsense box runs 24 hours a day using suricata, squid, pfblocker and other stuff. Power consumption is about 10 Watt .if you are using 120 watt 24 hours a day, you have to be rich or using it for business....of course, if you need more than a router and a firewall like active directory, a nas Server and so on you can think about a vm. In my opinion I think it’s better to use separate client machines. Independently of power consumption, if the main vm server has a problem every vm on the machine has a problem too!....by the way. You can make a backup of pfsense. This needs about 20kb. With this backup you are able to reinstall pfsense in a few minutes and restore the backup and you are ready again. So, no need for a vm. Thx

[@Taylordtech]

+Manfred Nauer I already am using it for DNS and DC. Plex is waiting for me to get off my butt and set it up. A LAMP server will be going up soon. Once I get a POE switch I'll be setting up Asterisk as well. I think that's fair for 120w average draw.

[@Trader-CL]

Thanks for sharing! It really only starts after 7 and a half minutes: kzbin.info/www/bejne/qoq0aqKjpt2mec0m40s

[@andibiront2316]

Hyper-V, lol.

[@andrewchristiansen8311]

1 minute in and I wanna scream at you. Not everyone knows wtf words you're using. I JUST WANT TO TURN MY OLD DELL INTO A BASIC ROUTER. I shouldnt have to be a network engineer to do that! Use regular words people understand! I should be able to find a video here on YT that allows you to run PF sense as a router on a VM and everyone wants to just confuse you before you even start. t(^_^t)

[@kuulajarkkoperse]

Gaylord tech :DD

[@EvertvanIngen]

Poor audio kwality

[@KrishnaYadav-hp2yi]

can we create virtual instances in pfsense?