3

Our office is using a multi-wan router as dhcp/router/firewall. but now I want to put a pc with pfsense between that router and switch, so I can do more advanced firewall task like traffic monitor and content filtering.

after reading I found that pfsense can be a ip-less transparent firewall, so I just have to plug the cables to both NIC and done.

this solution looks easy and I dont have to change my actual network settings. but is there any disadvantage or reason not to use as transparent firewall? in transparent mode would I still be able to create rules?

and when should I use pfsense as a normal firewall with routing, ip etc?

2
  • What is your existing router? Is there any complex configuration of the original router? What hardware are you intending to run pfSense on? Using VPN? Purpose of these questions is to see whether you would be better off using pfSense for routing or your existing router. Also would be very grateful for a link to your info about transparent firewall, but I suspect some packages will not work correctly if the firewall has no IP address-this you may need to try. I would finally note I have found pfSense to be ultra stable (and cheap) and I normally replace any router I am allowed to with a pfSense
    – Robin Gill
    Apr 27, 2012 at 17:57
  • 1
    the router it's a TL-ER6120, there are no complex configurations, no vpn yet but very probably in the no far future. here explain the theory I read goo.gl/VnNoa
    – Yichaoz
    Apr 27, 2012 at 20:19

2 Answers 2

1

I don't think this is a bad idea, at least to try out for a day or two, but I'll give you a few reasons not to, since you asked.

  1. One more point of failure
  2. Misconfiguration can cause problems.
  3. If you start adding firewall rules here, it can be harder to troubleshoot, especially for a junior sys admin. Is traffic being blocked here? Or at our normal firewall?
  4. You still might want to add a 3rd NIC for out-of-band management; SSH, Syslog, etc.
0

I would ditch the TP Link. I would consider having both as having an unnecessary single point of failure. If running on adaquate hardware, I would put money on pfSense being the more stable/reliable solution. I also greatly prefer the pfSense GUI over anything I've seen from TP Link although this is only my opinion.

I was also mentioning in another question yesterday that many lower end routers fail miserably to deliver quote VPN throughput while I have found pfSense on commodity x86/x64 hardware to be easily up to the task.

Thanks for the link regarding transparent firewalls but I didn't see any mention of pfSense.

If you do get it working, as my previous comment, I suspect some packages may not work which would limit the effectiveness anyway, you would need to test your desired packages in your desired configuration to actually determine which you are able to use.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .