pfSense Firewall Solutions
pfSense is an open source firewall/router computer software distribution based on FreeBSD. It is installed on a physical computer or a virtual machine to make a dedicated firewall/router for a network and is noted for its reliability and offering features often only found in expensive commercial firewalls. It can be configured and upgraded through a web-based interface, and requires no knowledge of the underlying FreeBSD system to manage. pfSense is commonly deployed as a perimeter firewall, router, wireless access point, DHCP server, DNS server, and as a VPN endpoint. pfSense supports installation of third-party packages like Snort or Squid through its Package Manager.
- VPN solutions
- DHCP servers
- Load Balancing
- Network Monitoring
- Proxy Servers
- Usage Restrictions
- Reporting and Monitoring
- Support and maintenance
What We Do:
- Filtering by source and destination IP, IP protocol, source and destination port for TCP and UDP traffic
- Limit simultaneous connections on a per-rule basis
- pfSense software utilizes p0f, an advanced passive OS/network fingerprinting utility to allow you to filter by the Operating System initiating the connection. Want to allow FreeBSD and Linux machines to the Internet, but block Windows machines? pfSense software allows for that (amongst many other possibilities) by passively detecting the Operating System in use.
- Option to log or not log traffic matching each rule.
- Highly flexible policy routing possible by selecting gateway on a per-rule basis (for load balancing, failover, multiple WAN, etc.)
- Aliases allow grouping and naming of IPs, networks and ports. This helps keep your firewall ruleset clean and easy to understand, especially in environments with multiple public IPs and numerous servers.
- Transparent layer 2 firewalling capable - can bridge interfaces and filter traffic between them, even allowing for an IP-less firewall (though you probably want an IP for management purposes).
- Packet normalization - Description from the pf scrub documentation - "'Scrubbing' is the normalization of packets so there are no ambiguities in interpretation by the ultimate destination of the packet. The scrub directive also reassembles fragmented packets, protecting some operating systems from some forms of attack, and drops TCP packets that have invalid flag combinations."
- Enabled in the pfSense software by default
- Can disable if necessary. This option causes problems for some NFS implementations, but is safe and should be left enabled on most installations.
- Disable filter - you can turn off the firewall filter entirely if you wish to turn your pfSense software into a pure router.
Multi-WAN functionality enables the use of multiple Internet connections, with load balancing and/or failover, for improved Internet availability and bandwidth usage distribution.
Network Address Translation (NAT)
- Port forwards including ranges and the use of multiple public IPs
- 1:1 NAT for individual IPs or entire subnets.
- Outbound NAT
- Default settings NAT all outbound traffic to the WAN IP. In multiple WAN scenarios, the default settings NAT outbound traffic to the IP of the WAN interface being used.
- Advanced Outbound NAT allows this default behavior to be disabled, and enables the creation of very flexible NAT (or no NAT) rules.
- NAT Reflection - NAT reflection is possible so services can be accessed by public IP from internal networks.
VPN solutionsThe pfSense software offers three options for VPN connectivity, IPsec, OpenVPN, and PPTP providing organizations to have a virtual private network with security considerations.
DHCP serversUsing pfsense we can provide DHCP over network with controlled access, using the systems MAC ID's and can limit the network access according to the requirements
Load BalancingServer load balancing is used to distribute load between multiple servers. This is commonly used with web servers, mail servers, and others. Servers that fail to respond to ping requests or TCP port connections are removed from the pool.
Network MonitoringWe provide network monitoring and analyses based on the graphs from the network interfaces
Proxy ServersProxy servers helps in providing faster connections of an internet connection using caching, filtering the traffic and also helps in logging internet usage. The proxy server will store local copies of HTML pages, images, and other files in its cache.
Reporting and Monitoring
RRD GraphsThe RRD graphs in the pfSense software maintain historical information on the following.
- CPU utilization
- Total throughput
- Firewall states
- Individual throughput for all interfaces
- Packets per second rates for all interfaces
- WAN interface gateway(s) ping response times
- Traffic shaper queues on systems with traffic shaping enabled
Real Time InformationHistorical information is important, but sometimes it's more important to see real time information.
- SVG graphs are available that show real time throughput for each interface.
- For traffic shaper users, the Status -> Queues screen provides a real time display of queue usage using AJAX updated gauges.
- The front page includes AJAX gauges for display of real time CPU, memory, swap and disk usage, and state table size.