FSociety.pt

Infraestrutura Empresarial Segura | Four-Legged Firewall

View on GitHub

šŸ“¦ InstalaĆ§Ć£o do pfSense

Guia completo de instalaĆ§Ć£o do pfSense 2.8.1 no Proxmox VE, incluindo criaĆ§Ć£o da VM e configuraĆ§Ć£o inicial.

šŸ“‹ PrĆ©-requisitos

Item EspecificaĆ§Ć£o
Hypervisor Proxmox VE 8.x
ISO pfSense pfSense-CE-2.8.1-RELEASE-amd64.iso
RAM MĆ­nima 2 GB (recomendado: 2-4 GB)
Disco MĆ­nimo 20 GB (recomendado: 40+ GB)
NICs NecessƔrias 3 (WAN, LAN, DMZ)

šŸ–„ļø CriaĆ§Ć£o da VM no Proxmox

1. ConfiguraĆ§Ć£o Geral

# Na interface web do Proxmox VE
# BotĆ£o: Create VM
ParĆ¢metro Valor
Node Seu node Proxmox
VM ID 100 (ou disponĆ­vel)
Name pfSense
Resource Pool (opcional)

2. Sistema Operativo

ParĆ¢metro Valor
ISO Image pfSense-CE-2.8.1-RELEASE-amd64.iso
Type Other
Guest OS Other

3. Sistema

ParĆ¢metro Valor
Graphic card Default
Machine Default (i440fx)
SCSI Controller VirtIO SCSI
BIOS Default (SeaBIOS)
Add TPM āŒ NĆ£o
Qemu Agent āœ… Sim

4. Discos

ParĆ¢metro Valor
Bus/Device VirtIO Block / 0
Storage local-lvm (ou seu storage)
Disk size 42 GB
Cache Write back
Discard āœ… Ativado
SSD emulation āœ… Ativado (se aplicĆ”vel)

5. CPU

ParĆ¢metro Valor
Sockets 1
Cores 2
Type host (ou kvm64)

6. MemĆ³ria

ParĆ¢metro Valor
Memory (MiB) 2048
Minimum memory 512
Ballooning āœ… Ativado

7. Rede - IMPORTANTE: 3 Interfaces

Interface 1 - WAN (vtnet0)

ParĆ¢metro Valor
Bridge vmbr0 (bridge com acesso Ć  Internet)
Model VirtIO (paravirtualized)
Firewall āŒ Desativado
MAC address (auto)

Interface 2 - LAN (vtnet1)

ParĆ¢metro Valor
Bridge vmbr1 (bridge LAN isolada)
Model VirtIO (paravirtualized)
Firewall āŒ Desativado
MAC address (auto)

Interface 3 - DMZ (vtnet2)

ParĆ¢metro Valor
Bridge vmbr2 (bridge DMZ isolada)
Model VirtIO (paravirtualized)
Firewall āŒ Desativado
MAC address (auto)

šŸ’” Nota: As bridges devem ser criadas previamente no Proxmox em Datacenter ā†’ Node ā†’ Network

8. Confirmar CriaĆ§Ć£o

Revisar todas as configuraƧƵes e clicar em Finish.

šŸš€ InstalaĆ§Ć£o do pfSense

1. Iniciar a VM

# Via CLI do Proxmox
qm start 100

# Ou via Web UI
# VM ā†’ Start

2. Boot e InstalaĆ§Ć£o

  1. Boot Screen
    • Aguardar o boot automĆ”tico ou pressionar Enter
  2. Accept License
    • Ler e aceitar a licenƧa Apache 2.0
    • Pressionar Accept
  3. Install pfSense
    • Selecionar: Install pfSense
    • Pressionar Enter
  4. Keymap Selection
    • Selecionar keymap apropriado (ex: US ou Portuguese)
    • Pressionar Enter para continuar
  5. Partitioning
    • Selecionar: Auto (ZFS) - Recomendado
    • Pressionar Enter

  6. ZFS Configuration

    OpĆ§Ć£o Valor
    ZFS Pool Type stripe (para single disk)
    Disk vtbd0 (42GB)
    • Confirmar com Yes para destruir dados existentes
  7. InstalaĆ§Ć£o
    • Aguardar a cĆ³pia dos ficheiros (2-5 minutos)
  8. Manual Configuration
    • Selecionar: No (faremos via web)
    • Pressionar Enter
  9. Reboot
    • Selecionar: Reboot
    • Importante: Desconectar o ISO do CD-ROM no Proxmox

āš™ļø ConfiguraĆ§Ć£o Inicial (Console)

ApĆ³s o reboot, o pfSense iniciarĆ” e mostrarĆ” o menu de console:

*** Welcome to pfSense 2.8.1-RELEASE (amd64) on pfSense ***

 WAN (wan)       -> vtnet0     -> DHCP
 LAN (lan)       -> vtnet1     -> 192.168.1.1

 0) Logout (SSH only)                  9) pfTop
 1) Assign Interfaces                 10) Filter Logs
 2) Set interface(s) IP address       11) Restart webConfigurator
 3) Reset webConfigurator password    12) PHP shell + pfSense tools
 4) Reset to factory defaults         13) Update from console
 5) Reboot system                     14) Disable Secure Shell (sshd)
 6) Halt system                       15) Restore recent configuration
 7) Ping host                         16) Restart PHP-FPM
 8) Shell

Enter an option:

1. Atribuir Interfaces

Escolher opĆ§Ć£o 1 (Assign Interfaces)

Should VLANs be set up now? [y|n]: n

Enter the WAN interface name: vtnet0
Enter the LAN interface name: vtnet1
Enter the Optional 1 interface name: vtnet2

Do you want to proceed? [y|n]: y

2. Configurar IP da WAN

Escolher opĆ§Ć£o 2 (Set interface(s) IP address)

Available interfaces:
1 - WAN (vtnet0)
2 - LAN (vtnet1)
3 - OPT1 (vtnet2)

Enter the number of the interface: 1

Configure IPv4 address WAN interface via DHCP? [y|n]: n

Enter the new WAN IPv4 address: 192.168.31.100
Enter the new WAN IPv4 subnet bit count: 24
Enter the new WAN IPv4 upstream gateway address: 192.168.31.1

Configure IPv6 address WAN interface via DHCP6? [y|n]: n

Do you want to revert to HTTP as the webConfigurator protocol? [y|n]: n

3. Configurar IP da LAN

Escolher opĆ§Ć£o 2 novamente

Available interfaces:
1 - WAN (vtnet0)
2 - LAN (vtnet1)
3 - OPT1 (vtnet2)

Enter the number of the interface: 2

Enter the new LAN IPv4 address: 192.168.1.1
Enter the new LAN IPv4 subnet bit count: 24

For a WAN, enter the new LAN IPv4 upstream gateway address: [Enter]

Configure IPv6 address LAN interface via DHCP6? [y|n]: n

Do you want to enable the DHCP server on LAN? [y|n]: y
Enter the start address of the DHCP range: 192.168.1.100
Enter the end address of the DHCP range: 192.168.1.200

Do you want to revert to HTTP as the webConfigurator protocol? [y|n]: n

4. Configurar IP da DMZ (OPT1)

Escolher opĆ§Ć£o 2 novamente

Available interfaces:
1 - WAN (vtnet0)
2 - LAN (vtnet1)
3 - OPT1 (vtnet2)

Enter the number of the interface: 3

Enter the new OPT1 IPv4 address: 10.0.0.1
Enter the new OPT1 IPv4 subnet bit count: 24

For a WAN, enter the new OPT1 IPv4 upstream gateway address: [Enter]

Configure IPv6 address OPT1 interface via DHCP6? [y|n]: n

Do you want to enable the DHCP server on OPT1? [y|n]: n

Do you want to revert to HTTP as the webConfigurator protocol? [y|n]: n

šŸŒ Acesso Ć  Interface Web

1. Conectar Ć  Interface Web

De uma mƔquina na rede LAN (192.168.1.0/24):

URL: https://192.168.1.1
Username: admin
Password: pfsense

āš ļø Aviso de Certificado: O browser mostrarĆ” um aviso de certificado auto-assinado. Aceitar e continuar.

2. Setup Wizard

Passo 1: Netgate Global Support

Passo 2: General Information

Campo Valor
Hostname pfSense
Domain fsociety.pt
Primary DNS Server 1.1.1.1 (Cloudflare)
Secondary DNS Server 1.0.0.1
DNS Server Override āŒ Desativado

Passo 3: Time Server Information

Campo Valor
Time server hostname pool.ntp.org
Timezone Europe/Lisbon

Passo 4: Configure WAN Interface

Campo Valor
SelectedType Static
IP Address 192.168.31.100
Subnet Mask 24
Upstream Gateway 192.168.31.1
Block RFC1918 Private Networks āŒ Desativado
Block bogon networks āœ… Ativado

Passo 5: Configure LAN Interface

Campo Valor
LAN IP Address 192.168.1.1
Subnet Mask 24

Passo 6: Set Admin Password

Passo 7: Reload

Passo 8: Wizard Completed

šŸ”§ ConfiguraĆ§Ć£o PĆ³s-InstalaĆ§Ć£o

1. Renomear Interface OPT1 para DMZ

System ā†’ Assignments ā†’ Interface Assignments

OPT1:
- Description: DMZ
- Clicar em "Save"

2. Ativar Interface DMZ

Interfaces ā†’ DMZ

General Configuration:
- Enable: āœ… Enable interface
- Description: DMZ
- IPv4 Configuration Type: Static IPv4
- IPv4 Address: 10.0.0.1 / 24

Clicar em "Save" e depois "Apply Changes"

3. Configurar Hostname Completo

System ā†’ General Setup

System:
- Hostname: pfSense
- Domain: fsociety.pt

4. Ativar SSH (Opcional mas Recomendado)

System ā†’ Advanced ā†’ Admin Access

Secure Shell:
- Enable Secure Shell: āœ… Ativado
- SSH port: 22
- Authentication Method: Public Key and Password
- Login Protection: āœ… Ativado

Clicar em "Save"

5. Desativar Regras de Bloqueio PadrĆ£o (Se NecessĆ”rio)

Para permitir comunicaĆ§Ć£o inicial entre redes durante configuraĆ§Ć£o:

Interfaces ā†’ WAN ā†’ Edit

Reserved Networks:
- Block private networks and loopback addresses: āŒ Desativado

Clicar em "Save" e "Apply Changes"

āœ… VerificaĆ§Ć£o da InstalaĆ§Ć£o

1. Verificar Interfaces

Status ā†’ Interfaces

Verificar:
- WAN: UP - 192.168.31.100/24
- LAN: UP - 192.168.1.1/24
- DMZ: UP - 10.0.0.1/24

2. Verificar Conectividade

Diagnostics ā†’ Ping

Testar:
- 192.168.31.1 (Gateway WAN) āœ…
- 1.1.1.1 (DNS Cloudflare) āœ…
- 8.8.8.8 (DNS Google) āœ…

3. Verificar ServiƧos

Status ā†’ Services

Verificar serviƧos ativos:
- dhcpd (DHCP Server)
- dpinger (Gateway Monitoring)
- ntpd (NTP Server)
- sshd (SSH Daemon)
- syslogd (System Logger)
- unbound (DNS Resolver)

4. Testar Acesso Ć  Internet

De uma mƔquina cliente na LAN:

# Testar DNS
nslookup google.com

# Testar conectividade
ping 8.8.8.8
ping google.com

šŸ” Hardening Inicial

1. Alterar Porta de Acesso Web (Opcional)

System ā†’ Advanced ā†’ Admin Access

Protocol: HTTPS
TCP port: 8009  # Porta personalizada

2. Ativar Auto-Update Check

System ā†’ Update Settings

Dashboard check: āœ… Enable
Check Interval: 1 day

3. Configurar Firewall Logging

Status ā†’ System Logs ā†’ Settings

General Logging Options:
- Firewall Log Entries: 100000
- Show log entries in reverse order: āœ…

šŸ“ø Screenshots da InstalaĆ§Ć£o

Dashboard ApĆ³s InstalaĆ§Ć£o

Status: pfSense 2.8.1-RELEASE (amd64) - FreeBSD 15.0-CURRENT

Interfaces:
āœ… WAN  - 192.168.31.100/24
āœ… LAN  - 192.168.1.1/24
āœ… DMZ  - 10.0.0.1/24

System Information:
- Uptime: 1 hour
- CPU usage: 5%
- Memory usage: 12% (245 MiB)
- Disk usage: 2% (900 MiB)

šŸ› Troubleshooting

Problema: NĆ£o consigo aceder Ć  interface web

SoluĆ§Ć£o:

  1. Verificar que estĆ” ligado Ć  rede LAN (192.168.1.0/24)
  2. Verificar IP do cliente: ipconfig ou ip addr
  3. Fazer ping ao gateway: ping 192.168.1.1
  4. Limpar cache do browser ou usar modo privado

Problema: Interface nĆ£o aparece

SoluĆ§Ć£o:

# No console do pfSense
1) Assign Interfaces
# Reatribuir interfaces corretamente

Problema: Sem conectividade Ć  Internet

SoluĆ§Ć£o:

  1. Verificar gateway WAN: ping 192.168.31.1
  2. Verificar DNS: Diagnostics ā†’ DNS Lookup
  3. Verificar regras WAN: Firewall ā†’ Rules ā†’ WAN

šŸ“– PrĆ³ximos Passos

ApĆ³s a instalaĆ§Ć£o, prosseguir com:

  1. āœ… InstalaĆ§Ć£o ConcluĆ­da
  2. āž”ļø ConfiguraĆ§Ć£o de Interfaces
  3. āž”ļø CriaĆ§Ć£o de Aliases
  4. āž”ļø Regras de Firewall

šŸŽ“ InformaĆ§Ć£o AcadĆ©mica

Campo InformaĆ§Ć£o
InstituiĆ§Ć£o ESTG - Instituto PolitĆ©cnico do Porto
Unidade Curricular AdministraĆ§Ć£o de Sistemas II
Ano Letivo 2025/2026
Autores Ryan Barbosa, Hugo Correia, Igor AraĆŗjo

šŸ“„ LicenƧa

Este projeto estĆ” licenciado sob a MIT License.

šŸ“– ReferĆŖncias

**[ā¬…ļø Voltar ao ƍndice](/fsociety-infrastructure/03-pfsense/)** | **[PrĆ³ximo: Interfaces āž”ļø](/fsociety-infrastructure/03-pfsense/02-interfaces.html)**

ƚltima atualizaĆ§Ć£o: Dezembro 2025