pfSense FW-7551 User manual

pfSense® FW-7551 with pfSense® Version 2.1.X
Basic Installation Guide

2

Table of Contents
Table of Contents................................................................................................................ 2
Introduction ........................................................................................................................ 3
Product includes ................................................................................................................. 3
Key features................................................................................................................................................ 4
Specifications.............................................................................................................................................. 4
Plugging everything in ............................................................................................................................. 5
Initial Configuration.................................................................................................................................. 5
Logging into the web interface ............................................................................................................. 5
Setup Wizard .............................................................................................................................................. 6
Hostname .................................................................................................................................................... 7
Domain......................................................................................................................................................... 7
DNS Servers................................................................................................................................................. 7
Time Zone and Server.............................................................................................................................. 7
WAN Configuration .................................................................................................................................. 8
Configure LAN Interface.......................................................................................................................... 9
Setting the password ............................................................................................................................... 9
Introduction to the web interface ..................................................................................................... 10
Backing up and restoring ...................................................................................................................... 10
What else can I do? ................................................................................................................................ 10
Console Access by Serial Interface..................................................................................................... 11
Null Modem Cable .................................................................................................................................. 11
Serial Terminal Emulation Client ........................................................................................................ 11
Accessing the Console ........................................................................................................................... 11
Configuring Serial Terminal Emulator............................................................................................... 11
Additional Support.................................................................................................................................. 13
pfSense University .................................................................................................................................. 14
Additional Support.................................................................................................................................. 14

3

Introduction
Thank you for your purchase of the pfSense FW-7551 with pfSense® 2.1.x The Lanner hardware
platform in combination with the popular open source pfSense software provides a powerful, cost-
effective solution for your network security needs.
This Quick Start Guide will help you get up and running with a basic configuration on your FW-7551.
Product includes
Figure 1
1 pfSense preloaded with pfSense 2.1
Figure 2
12VDC auto-switching power supply
Null modem cable to connect to the serial console (not pictured)
Ethernet cable to connect to modem and computer (not pictured)

4

Key features
Intel Dual-core Atom C2000 SoC CPU (codenamed "Rangeley")
Compact desktop design
4 built-in GbE LAN ports
Supports Intel QuickAssist crypto acceleration
Supports up to 8 GB ECC DDR3 Memory
Intel i210AT LAN controller
1 x system cooling fan
Specifications
CPU
2-core Intel® AtomTM processor C2000 series (Rangeley)
BIOS
AMI BIOS 16 Mb
Memory Technology
Dual-channel DDR3 1333/1600 MHz (ECC)
Memory Capacity
8 GB
Memory Socket
1 x 240-pin DIMM
IDE storage
S1 x CF card Type II
SATA storage
1 x 2.5” HDD/SSD kit (Optional)
Ethernet controller
2 x Intel i210AT, 1 x Marvell 88E1543
Ethernet
4 GbE RJ-45
Fan cooling
1 smart fan
Console
1 x RJ45 Serial
USB 2.0
2 x Type A
Processor cooling
CPU heatsink with fan duct
Operating temperature
0ºC to 40ºC

5

Plugging everything in
Figure 3 shows the location of the Reset button, power input, power button, serial console, USB, 4 x
GbE ports.
Figure 3
If you are replacing an existing firewall on a production network, you will want to go through the initial
configuration with the device not plugged into your production network. You can plug a laptop or
desktop PC into the LAN port to perform the initial configuration. For new networks, you can start by
plugging the LAN into your switch.
Note: The Lanner Ethernet ports are auto MDI/MDI-X, meaning you can use either a straight
through or crossover CAT5/6 cable regardless of the type of device you are connecting it to.
To get started, plug the LAN port into the network or system where you will perform the initial
configuration, and then plug in the power.
Initial Configuration
After powering on your Fw-7551, it will boot up and be ready for the initial configuration after
approximately two minutes. The initial boot takes longer if your WAN interface is not plugged into
something where it can receive a DHCP address, as it must wait for that to time out. Once the system is
booted, you should receive a 192.168.1.X IP address on the system(s) plugged into the LAN port from
the DHCP server.
Logging into the web interface
Browse to https://192.168.1.1 to access the web interface. In some instances, the browser will
respond with a message indicating a problem with an untrusted certificate. This is normal since the
pfSense WebGUI uses a self-signed certificate. Figure 4 is a typical example from Google Chrome. If
this message or similar message is encountered, it is safe to proceed.

6

Figure 4
You will be prompted for username and password, the default username is admin and password is
pfsense.
Figure 5
Setup Wizard
After logging in, the setup wizard will run. This will walk you through a few steps to get up and running
with a basic configuration. At the first screen, click Next. The subsequent screen allows you to
configure the hostname, domain and DNS servers to be used.
Figure 6


7

Hostname
For hostname, choose a name for the host. This does not affect functionality.
Domain
If you have an existing DNS domain in use inside your network (such as a Microsoft Active Directory
domain), use that domain here. This is the domain suffix assigned to DHCP clients, which you will want
to match your internal network. For networks without any internal DNS domains, you can fill in
anything you want here.
DNS Servers
The DNS server fields can be left blank if you have a WAN connection using DHCP, PPTP or PPPoE types
of Internet connections and the ISP automatically assigns DNS servers. When using a static IP on WAN,
you must enter DNS server IPs here for name resolution to function. You can specify DNS servers here
even if your ISP assigns different ones. Either enter the IP addresses provided by your ISP, or consider
using a service like OpenDNS (www.opendns.com) whose service will allow you to add content filtering
and phishing protection amongst other benefits to your pfSense install. Using Google’s public DNS
servers (8.8.8.8, 8.8.4.4) is another popular choice.
Figure 7
Click Next after filling in the appropriate fields.
Time Zone and Server
The next screen allows you to configure the time (NTP) server to be used to synchronize your firewall’s
time, and also specify its time zone. The default NTP server points you ntp.org’s NTP server pool. If you
have an internal time server, you should specify it here instead. You also want to select a city in your
time zone so your log timestamps are in local time (unless you have a policy to timestamp all logs in
GMT).

8

Figure 8
Click Next.
WAN Configuration
This page is where your Internet connection is configured. You will need information from your ISP to
configure this screen appropriately. A few notes to assist you:
MAC address –if replacing an existing firewall, you may want to enter the old firewall’s WAN MAC
address here, if you can easily tell what that is. This commonly avoids issues involved in switching out
firewalls, such as ARP caches, ISPs locking to single MAC addresses, etc.
If you can’t enter the MAC of your current firewall here, it probably isn’t a big deal – power cycle your
router or modem and your new MAC will usually be able to get online. For some ISPs, you have to call
when switching devices, or go through an activation process of some sort.
Static IP configurations –the subnet mask is configured in CIDR format, which is usually provided by
the ISP in addition to the 255.x.x.x subnet mask. The following table shows the most common subnet
masks and their CIDR equivalent.
Block private networks and bogons –these two options will block private, unassigned, and reserved IP
subnets for traffic initiated on your WAN connection (i.e. coming in from the Internet). These IP ranges
should never be seen on the Internet, and these should both be enabled on systems that are directly
Subnet Mask
CIDR
255.255.255.252
30
255.255.255.248
29
255.255.255.240
28
255.255.255.224
27
255.255.255.192
26
255.255.255.128
25
255.255.255.0
24
255.255.254.0
23

9

connected to the Internet. If your WAN resides on a private network, you may not want to use these
options.
Configure LAN Interface
Here you configure the IP and subnet mask to be used on your LAN. If you don’t ever plan to connect
your network to any other network via VPN, the 192.168.1.x default is fine.
If you want to be able to connect into your network using VPN from remote locations, you should
choose a private IP address range much more obscure than the very common 192.168.1.0/24. Space
within the 172.16.0.0/12 RFC1918 private address block seems to be the least frequently used, so
choose something between 172.16.x.x and 172.31.x.x for least likelihood of having VPN connectivity
difficulties. If your LAN is 192.168.1.x and you are at a wireless hotspot using 192.168.1.x (very
common), you won’t be able to communicate across the VPN – 192.168.1.x is the local network, not
your network over VPN.
Figure 9
Setting the password
Enter the admin password for your firewall and again to confirm. You should choose a strong
password, with a combination of letters, numbers and symbols. Should you forget your password, you
can reset it using a serial console on your FW-7551.
Figure 10
After entering your password and confirming it, click Next.
Then click Reload to apply your changes.

10

Introduction to the web interface
You are now at the front page of the pfSense web interface. This screen provides an overview of your
system resource utilization. The menu on the left side of the screen groups the various configuration,
status and diagnostics screens. There are also additional themes available to change the layout of the
web interface, under System -> General Setup if you prefer a different look and feel.
Note: The default theme does not function on an iPhone, iPad, or iPod Touch, but when
browsing from one of these devices it will automatically switch to a different, plainer theme
that is functional. Yes, you can configure your FW-7551 from your iOS devices. The default
theme does function properly in the Android browser, but is difficult to navigate due to the
screen size, so it also will switch to the plainer theme.
The default firewall rules can be viewed under Firewall -> Rules. If you need to forward ports, you will
configure them under Firewall -> NAT. More information on port forwarding can be found here:
http://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense%3F
You can view your real time traffic throughput under Status -> Traffic Graph. For many longer term
statistics, browse to Status -> RRD Graphs. Logs can be viewed under Diagnostics -> System logs.
Backing up and restoring
At this point your basic two interface LAN and WAN configuration is complete. Before proceeding with
additional configuration, you will want to get a backup of your configuration. To do so, browse to
Diagnostics -> Backup/Restore in the web interface. Click the Download Configuration button, and a
copy of your configuration will be downloaded. You can restore this configuration at the same screen,
by choosing your backup file under “Restore configuration”.
What else can I do?
The pfSense software provides a wide array of functionality beyond the simple configuration
documented here. See the Additional Documentation section to find information on this functionality
and more. A few of the most commonly used possibilities follow.
IPv6 –support for native IPv6 connectivity on the LAN and several variations of IPv6
connectivity on the WAN is available.
Captive portal –allows you to present a splash page to all users upon connecting to your
network, optionally with authentication. This is commonly used with wireless hot spots, or as
an additional layer of protection for wireless networks with authentication against a local user
database, or external RADIUS server such as Microsoft Active Directory.
VPN –three types of VPNs are supported, IPsec, OpenVPN and PPTP. You can use these options
to connect roaming users for remote access, or site to site connectivity to connect multiple
locations.
Multi-WAN –multiple Internet connections with failover and load balancing are supported. In
combination with a VLAN capable switch, you can connect numerous Internet connections over
a single physical interface on the firewall.