What we'll do is we'll jump into our Windows host now,
our jump host, and our goal in here is going to be to finish the configuration.
All right, so we'll navigate to our internal address,
so the LAN address that we created, 30.1,
and we'll prompt it with a warning because we
haven't added our certificates to it.
We'll accept the risks and continue, and we have a prompt.
All right.
So we'll log in with the default credentials,
which was admin and pfSense,
and then it's going to prompt me to change the password.
We'll go into the User Manager and do that in a little bit.
Let's finish the setup, though.
Our host name is going to be globofw.globomantics dot com.
Have our time zone settings as well.
Our WAN interface settings,
we're not going to change the MTU or the MSS or anything like that.
We're going to leave it like this for now.
And then we're going to go ahead and uncheck the block and the RFC1918 networks.
Since our WAN interface is on a private network,
we'll want to be able to connect to that.
This is having us set up the LAN interface,
and then finally, the web GUI password.
All right, and now that the configuration wizard is complete,
we can go in and start actually configuring our firewall.
Before we do that, though,
I'm going to go ahead and just configure one firewall rule to allow
us to RDP into our jump host so we don't have to use the vCenter web
client to be able to navigate this.
So we're going to navigate to Firewall Rules,
and since we're already on the WAN, we're going to add one,
we're going to make it pass.
And then for the destination port range,
we'll leave it any for now and just make it 3389,
so that what this is saying is any traffic on 3389,
which is my RDP port, that is coming from the WAN interface into the network,
we're going to allow.
And we'll save that.
And then before we can actually use that rule, we'll hit Apply changes.
And to test that out, let's try to RDP into our jump box,
and as you can see, we're already good to go.
We'll go ahead and kick that other user off, and then we could get configuring.
All right.
And now that we're here, we can go ahead and hop into the firewall from this box,
which is the same box, but it was a different user that was logged in.
So we'll go ahead and go through the rest of the initial setup.
All right, now where do we go from here?
Let's first go to the General Setup screen.
And as you can see,
this is a lot of the information that we've already configured.
Now, I'm not going to change any of this information because we don't need to.
pfSense has a lot of different settings that you can configure to customize how
you interact with it and how the traffic interacts with it.
There's a lot of packages that you can install as well,
but we're not going to get into a lot of that during this course.
In the Advanced Settings,
we have a lot of different options that we can configure as well,
and we'll go back to change some of these later on,
but we can customize this TLS certificate that's being presented,
the port that we're going to interface with the configuration GUI on.
And then if we wanted to create logon messages or
alternate host names and so on and so forth,
one thing that I'd like to do is making sure SSH is turned on for us.
So we'll make sure we enable that.
We can define our login protections or ACLs that allow
us to restrict the logins to the GUI, and we'll save that.
All right, now let's go finish setting up those interfaces.
So looking at the WAN interface,
we have all of our information that we saw earlier.
We're going to leave it like this.
For the LAN interface, we're going to want to change the name,
though. I just want to designate that this is my MGMT 30 network.
And then we already have the IP address and everything,
and as you can see,
we don't have an upstream gateway for this network because it is our LAN.
So we'll save that and apply the changes,
and then let's go over to the third interface now,
and we're going to enable that.
It's going to be designated the user interface.
We'll give it a static IPv4 address.
And again, this one is not going to have an upstream gateway as well.
All right.
And now that those are good, we have our interface assignments,
we're not using VLANs right now,
and we don't need to configure any other interface information.
We have our RDP already set up.
We only have a couple more things to set up.
First thing is going to be a DHCP relay,
and we'll set it up on both the management and the user interfaces,
and the destination server is going to be our domain controller.
So this is how we can make sure that we pass that DHCP traffic to our
domain controller so our host can get the IP addresses.
And then we'll need to go over and set up the logging as well.
So, we navigate to the System Logs,
and then we can see all of these different logs.
We'll be using the firewall and VPN logs quite a bit.
But if we go over to the Settings, then we can choose the log format.
So let's use the actual syslog log format.
And then we can configure our log settings for the default rules.
We're automatically logging anything that's matched in the default block.
We're not logging anything in the default paths.
And we'll leave it like this.
We'll make sure we turn on the logging for the rules that we
want to in the actual rules that we build.
And then we have information about how to do the log compression,
what log retention and rotation sizes are as well.
And then we can also send it over to a remote
syslog server if we wanted to here,
which would be useful if we wanted to send it to the
Elastic Stack or Splunk or any of those.
And then finally, we have to do the certificate setup.
So we're going to go over to our Start Manager,
and we don't have a CA in here yet,
so let's go ahead and navigate to our CA so we can download
that certificate and the information.
All right, first we'll download the CA certificate, and Base 64,
and just download it.
I don't have to download the chain,
since we don't have more than a root CA and our signed certificates.
So we'll go ahead and upload that CA certificate then.
And we're going to select Import an existing Certificate Authority.
We'll add it to the Trust Store,
and then we need to copy paste the certificate data.
So here's the certificate.
We will open it with Notepad so we can copy paste the certificate data.
Now that the certificate data is copied into there,
we don't need to do the private key or anything,
and we can save it.
All right, so we have our custom Globomantics CA in here,
and we'll need this for both integrating with LDAP so we can do the
authentication on the back end to Active Directory.
And we'll also need it to trust our VPN users and also to be able
to get a certificate for the firewall itself,
which we're going to go do right now.
So the CA is in there, it's not internal.
We're going to go request a certificate now.
This one that's shown is the default self‑signed
certificate that comes with pfSense,
and we can replace that for both the web configurator and for the VPN
termination and any other services that it provides.
So we'll hit Add/Sign and then we'll create a CSR, and we'll name it GloboFW.
Keep the key types the same.
We'll keep the algorithms and everything.
We'd like sha256, and then for the common name,
we'll do globofw.globomantics.com.
Country code is going to be US,
and then we'll go through and fill out the rest of the information.
All right.
And the certificate type is going to be a Server Certificate.
We're going to put the IP address in the Alternate Names.
Now, I'm doing both of these.
That way we can present it both on the LAN and the WAN for the same certificate.
You can also alternatively create multiple certificates
for the different purposes if you wanted to terminate the
VPN on the WAN with this one,
and then you can create another one for the configuration if you wanted to.
But we're going to leave it like this for now and hit Save.
And then as you can see, the CSR is created, we just need to export it.
And then we're going to copy paste that into our
actual CA and request a certificate.
So we'll request a custom certificate, paste that CSR data into there,
and we'll make this certificate a Web Server.
Hit Submit.
And then download the Base 64 version again.
All right, now that that's done, we'll pull it up,
open with Notepad, and then copy paste that data back into here.
So to be able to actually add the certificate now,
we have to update the CSR, and then paste the final certificate data into here.
And then hit Update.
And now the CSR is signed and it's fully in here.
So what's really cool now is we can actually modify the
configuration to use that certificate.
So do you remember in our configurations right here in the Advanced Setup,
we can now choose the certificate that's presented when we log
in to administer the firewall via the GUI.