WEBVTT 00:00:01.340 --> 00:00:03.830 What we'll do is we'll jump into our Windows host now, 00:00:03.830 --> 00:00:08.150 our jump host, and our goal in here is going to be to finish the configuration. 00:00:09.440 --> 00:00:13.490 All right, so we'll navigate to our internal address, 00:00:13.490 --> 00:00:16.910 so the LAN address that we created, 30.1, 00:00:16.910 --> 00:00:19.920 and we'll prompt it with a warning because we 00:00:19.920 --> 00:00:21.660 haven't added our certificates to it. 00:00:22.230 --> 00:00:24.960 We'll accept the risks and continue, and we have a prompt. 00:00:25.340 --> 00:00:25.710 All right. 00:00:25.710 --> 00:00:27.760 So we'll log in with the default credentials, 00:00:27.760 --> 00:00:29.770 which was admin and pfSense, 00:00:29.770 --> 00:00:32.850 and then it's going to prompt me to change the password. 00:00:33.740 --> 00:00:36.460 We'll go into the User Manager and do that in a little bit. 00:00:37.240 --> 00:00:38.590 Let's finish the setup, though. 00:00:38.710 --> 00:00:42.960 Our host name is going to be globofw.globomantics dot com. 00:00:44.540 --> 00:00:46.460 Have our time zone settings as well. 00:00:49.840 --> 00:00:51.740 Our WAN interface settings, 00:00:51.740 --> 00:00:54.710 we're not going to change the MTU or the MSS or anything like that. 00:00:54.710 --> 00:00:56.050 We're going to leave it like this for now. 00:00:56.840 --> 00:01:02.990 And then we're going to go ahead and uncheck the block and the RFC1918 networks. 00:01:02.990 --> 00:01:05.830 Since our WAN interface is on a private network, 00:01:05.830 --> 00:01:07.960 we'll want to be able to connect to that. 00:01:10.950 --> 00:01:12.930 This is having us set up the LAN interface, 00:01:12.940 --> 00:01:15.360 and then finally, the web GUI password. 00:01:17.340 --> 00:01:20.440 All right, and now that the configuration wizard is complete, 00:01:20.440 --> 00:01:23.560 we can go in and start actually configuring our firewall. 00:01:23.570 --> 00:01:25.090 Before we do that, though, 00:01:25.090 --> 00:01:28.780 I'm going to go ahead and just configure one firewall rule to allow 00:01:28.780 --> 00:01:34.430 us to RDP into our jump host so we don't have to use the vCenter web 00:01:34.430 --> 00:01:36.960 client to be able to navigate this. 00:01:38.740 --> 00:01:40.960 So we're going to navigate to Firewall Rules, 00:01:42.140 --> 00:01:44.750 and since we're already on the WAN, we're going to add one, 00:01:45.140 --> 00:01:46.450 we're going to make it pass. 00:01:47.740 --> 00:01:49.590 And then for the destination port range, 00:01:49.590 --> 00:01:52.860 we'll leave it any for now and just make it 3389, 00:01:52.860 --> 00:01:57.500 so that what this is saying is any traffic on 3389, 00:01:57.500 --> 00:02:03.160 which is my RDP port, that is coming from the WAN interface into the network, 00:02:03.640 --> 00:02:04.980 we're going to allow. 00:02:04.980 --> 00:02:06.580 And we'll save that. 00:02:06.580 --> 00:02:11.280 And then before we can actually use that rule, we'll hit Apply changes. 00:02:11.280 --> 00:02:16.460 And to test that out, let's try to RDP into our jump box, 00:02:16.840 --> 00:02:19.230 and as you can see, we're already good to go. 00:02:19.230 --> 00:02:23.560 We'll go ahead and kick that other user off, and then we could get configuring. 00:02:25.140 --> 00:02:25.800 All right. 00:02:25.830 --> 00:02:29.850 And now that we're here, we can go ahead and hop into the firewall from this box, 00:02:29.850 --> 00:02:32.660 which is the same box, but it was a different user that was logged in. 00:02:33.540 --> 00:02:36.560 So we'll go ahead and go through the rest of the initial setup. 00:02:37.840 --> 00:02:39.760 All right, now where do we go from here? 00:02:40.340 --> 00:02:43.800 Let's first go to the General Setup screen. 00:02:43.800 --> 00:02:45.310 And as you can see, 00:02:45.310 --> 00:02:49.440 this is a lot of the information that we've already configured. 00:02:49.440 --> 00:02:53.930 Now, I'm not going to change any of this information because we don't need to. 00:02:53.940 --> 00:02:58.900 pfSense has a lot of different settings that you can configure to customize how 00:02:58.900 --> 00:03:02.060 you interact with it and how the traffic interacts with it. 00:03:03.140 --> 00:03:05.520 There's a lot of packages that you can install as well, 00:03:05.620 --> 00:03:08.490 but we're not going to get into a lot of that during this course. 00:03:10.540 --> 00:03:11.950 In the Advanced Settings, 00:03:12.440 --> 00:03:15.900 we have a lot of different options that we can configure as well, 00:03:15.900 --> 00:03:18.730 and we'll go back to change some of these later on, 00:03:18.740 --> 00:03:22.390 but we can customize this TLS certificate that's being presented, 00:03:22.390 --> 00:03:26.970 the port that we're going to interface with the configuration GUI on. 00:03:26.970 --> 00:03:29.980 And then if we wanted to create logon messages or 00:03:29.980 --> 00:03:32.280 alternate host names and so on and so forth, 00:03:32.280 --> 00:03:36.500 one thing that I'd like to do is making sure SSH is turned on for us. 00:03:36.540 --> 00:03:38.910 So we'll make sure we enable that. 00:03:38.910 --> 00:03:44.010 We can define our login protections or ACLs that allow 00:03:44.010 --> 00:03:49.960 us to restrict the logins to the GUI, and we'll save that. 00:03:51.240 --> 00:03:53.660 All right, now let's go finish setting up those interfaces. 00:03:55.340 --> 00:03:56.790 So looking at the WAN interface, 00:03:56.790 --> 00:03:59.730 we have all of our information that we saw earlier. 00:03:59.730 --> 00:04:01.080 We're going to leave it like this. 00:04:01.080 --> 00:04:04.010 For the LAN interface, we're going to want to change the name, 00:04:04.010 --> 00:04:09.440 though. I just want to designate that this is my MGMT 30 network. 00:04:09.440 --> 00:04:12.970 And then we already have the IP address and everything, 00:04:12.970 --> 00:04:13.710 and as you can see, 00:04:13.710 --> 00:04:17.260 we don't have an upstream gateway for this network because it is our LAN. 00:04:18.740 --> 00:04:22.120 So we'll save that and apply the changes, 00:04:23.340 --> 00:04:25.930 and then let's go over to the third interface now, 00:04:25.930 --> 00:04:27.360 and we're going to enable that. 00:04:27.790 --> 00:04:30.590 It's going to be designated the user interface. 00:04:30.590 --> 00:04:33.910 We'll give it a static IPv4 address. 00:04:33.910 --> 00:04:37.660 And again, this one is not going to have an upstream gateway as well. 00:04:39.440 --> 00:04:39.890 All right. 00:04:39.900 --> 00:04:44.200 And now that those are good, we have our interface assignments, 00:04:44.830 --> 00:04:46.700 we're not using VLANs right now, 00:04:46.720 --> 00:04:49.680 and we don't need to configure any other interface information. 00:04:51.440 --> 00:04:53.920 We have our RDP already set up. 00:04:53.920 --> 00:04:56.530 We only have a couple more things to set up. 00:04:56.600 --> 00:04:59.560 First thing is going to be a DHCP relay, 00:05:01.440 --> 00:05:05.010 and we'll set it up on both the management and the user interfaces, 00:05:05.040 --> 00:05:07.700 and the destination server is going to be our domain controller. 00:05:07.730 --> 00:05:11.720 So this is how we can make sure that we pass that DHCP traffic to our 00:05:11.720 --> 00:05:14.960 domain controller so our host can get the IP addresses. 00:05:14.960 --> 00:05:19.650 And then we'll need to go over and set up the logging as well. 00:05:22.240 --> 00:05:24.980 So, we navigate to the System Logs, 00:05:24.990 --> 00:05:26.890 and then we can see all of these different logs. 00:05:26.890 --> 00:05:30.300 We'll be using the firewall and VPN logs quite a bit. 00:05:30.310 --> 00:05:34.160 But if we go over to the Settings, then we can choose the log format. 00:05:34.170 --> 00:05:37.420 So let's use the actual syslog log format. 00:05:37.420 --> 00:05:42.200 And then we can configure our log settings for the default rules. 00:05:42.200 --> 00:05:46.750 We're automatically logging anything that's matched in the default block. 00:05:46.760 --> 00:05:48.810 We're not logging anything in the default paths. 00:05:48.810 --> 00:05:49.990 And we'll leave it like this. 00:05:49.990 --> 00:05:52.540 We'll make sure we turn on the logging for the rules that we 00:05:52.540 --> 00:05:55.490 want to in the actual rules that we build. 00:05:55.490 --> 00:06:00.190 And then we have information about how to do the log compression, 00:06:00.190 --> 00:06:03.350 what log retention and rotation sizes are as well. 00:06:04.440 --> 00:06:06.400 And then we can also send it over to a remote 00:06:06.400 --> 00:06:08.250 syslog server if we wanted to here, 00:06:08.740 --> 00:06:10.720 which would be useful if we wanted to send it to the 00:06:10.720 --> 00:06:12.850 Elastic Stack or Splunk or any of those. 00:06:14.640 --> 00:06:18.640 And then finally, we have to do the certificate setup. 00:06:18.640 --> 00:06:21.380 So we're going to go over to our Start Manager, 00:06:21.840 --> 00:06:23.880 and we don't have a CA in here yet, 00:06:23.880 --> 00:06:26.520 so let's go ahead and navigate to our CA so we can download 00:06:26.520 --> 00:06:28.460 that certificate and the information. 00:06:30.040 --> 00:06:35.880 All right, first we'll download the CA certificate, and Base 64, 00:06:36.440 --> 00:06:37.550 and just download it. 00:06:38.240 --> 00:06:39.380 I don't have to download the chain, 00:06:39.380 --> 00:06:43.850 since we don't have more than a root CA and our signed certificates. 00:06:45.140 --> 00:06:48.350 So we'll go ahead and upload that CA certificate then. 00:06:50.840 --> 00:06:54.260 And we're going to select Import an existing Certificate Authority. 00:06:55.440 --> 00:06:57.150 We'll add it to the Trust Store, 00:06:57.640 --> 00:07:00.560 and then we need to copy paste the certificate data. 00:07:04.640 --> 00:07:05.640 So here's the certificate. 00:07:05.640 --> 00:07:12.490 We will open it with Notepad so we can copy paste the certificate data. 00:07:12.490 --> 00:07:16.520 Now that the certificate data is copied into there, 00:07:16.520 --> 00:07:18.640 we don't need to do the private key or anything, 00:07:18.640 --> 00:07:20.080 and we can save it. 00:07:21.440 --> 00:07:25.140 All right, so we have our custom Globomantics CA in here, 00:07:25.150 --> 00:07:28.710 and we'll need this for both integrating with LDAP so we can do the 00:07:28.710 --> 00:07:31.650 authentication on the back end to Active Directory. 00:07:31.650 --> 00:07:36.170 And we'll also need it to trust our VPN users and also to be able 00:07:36.170 --> 00:07:38.430 to get a certificate for the firewall itself, 00:07:38.440 --> 00:07:39.760 which we're going to go do right now. 00:07:40.340 --> 00:07:42.880 So the CA is in there, it's not internal. 00:07:42.880 --> 00:07:45.390 We're going to go request a certificate now. 00:07:45.460 --> 00:07:48.360 This one that's shown is the default self‑signed 00:07:48.360 --> 00:07:50.230 certificate that comes with pfSense, 00:07:50.300 --> 00:07:54.850 and we can replace that for both the web configurator and for the VPN 00:07:54.850 --> 00:07:57.460 termination and any other services that it provides. 00:07:58.340 --> 00:08:05.200 So we'll hit Add/Sign and then we'll create a CSR, and we'll name it GloboFW. 00:08:06.640 --> 00:08:08.650 Keep the key types the same. 00:08:09.840 --> 00:08:11.530 We'll keep the algorithms and everything. 00:08:11.530 --> 00:08:15.290 We'd like sha256, and then for the common name, 00:08:15.290 --> 00:08:18.540 we'll do globofw.globomantics.com. 00:08:18.540 --> 00:08:22.400 Country code is going to be US, 00:08:22.400 --> 00:08:24.860 and then we'll go through and fill out the rest of the information. 00:08:26.640 --> 00:08:27.360 All right. 00:08:28.910 --> 00:08:31.960 And the certificate type is going to be a Server Certificate. 00:08:32.740 --> 00:08:38.059 We're going to put the IP address in the Alternate Names. 00:08:38.059 --> 00:08:40.110 Now, I'm doing both of these. 00:08:40.110 --> 00:08:44.410 That way we can present it both on the LAN and the WAN for the same certificate. 00:08:44.410 --> 00:08:48.570 You can also alternatively create multiple certificates 00:08:48.570 --> 00:08:51.480 for the different purposes if you wanted to terminate the 00:08:51.480 --> 00:08:53.800 VPN on the WAN with this one, 00:08:53.810 --> 00:08:57.620 and then you can create another one for the configuration if you wanted to. 00:08:57.620 --> 00:09:02.000 But we're going to leave it like this for now and hit Save. 00:09:02.000 --> 00:09:06.830 And then as you can see, the CSR is created, we just need to export it. 00:09:06.830 --> 00:09:10.650 And then we're going to copy paste that into our 00:09:11.640 --> 00:09:14.570 actual CA and request a certificate. 00:09:14.570 --> 00:09:19.940 So we'll request a custom certificate, paste that CSR data into there, 00:09:19.950 --> 00:09:22.600 and we'll make this certificate a Web Server. 00:09:22.600 --> 00:09:24.520 Hit Submit. 00:09:24.520 --> 00:09:28.050 And then download the Base 64 version again. 00:09:29.340 --> 00:09:32.250 All right, now that that's done, we'll pull it up, 00:09:35.650 --> 00:09:41.680 open with Notepad, and then copy paste that data back into here. 00:09:41.680 --> 00:09:44.500 So to be able to actually add the certificate now, 00:09:44.500 --> 00:09:50.340 we have to update the CSR, and then paste the final certificate data into here. 00:09:50.340 --> 00:09:52.110 And then hit Update. 00:09:52.110 --> 00:09:55.560 And now the CSR is signed and it's fully in here. 00:09:56.640 --> 00:09:59.650 So what's really cool now is we can actually modify the 00:09:59.650 --> 00:10:01.860 configuration to use that certificate. 00:10:02.340 --> 00:10:06.990 So do you remember in our configurations right here in the Advanced Setup, 00:10:07.000 --> 00:10:11.260 we can now choose the certificate that's presented when we log 00:10:11.260 --> 00:10:13.650 in to administer the firewall via the GUI.