pfSense in this configuration?

[ZeusXI]

So I have my Modem then it goes to my home router. Is it a good idea to put a pfSense box behind the router, so its Modem > Router > pfSense? Or does this not make much sense? 

 

Reason why I am wondering about this method, is I do not want to mess with my families router settings, and I want have pfSense for my personal stuff like servers.

[LIGISTX]

2 hours ago, ZeusXI said:

So I have my Modem then it goes to my home router. Is it a good idea to put a pfSense box behind the router, so its Modem > Router > pfSense? Or does this not make much sense? 

 

Reason why I am wondering about this method, is I do not want to mess with my families router settings, and I want have pfSense for my personal stuff like servers.

You can do this, it’ll just put pfSense devices in double NAT, and you won’t be able to connect to pfSense or the devices from the normal home LAN unless you either enable port forwarding rules or allow access from WAN into pfSense, which if you then ever plug pfSense into a modem directly, make sure you remember to change those settings back to default because you’d be fully exposing everything to WAN…. 

[E-waste]

LIGISTX answered it well.

 

I would like to provide some ideas for your pfsense box:

 

Enable the NTP server and redirect any domains for "time" to the pfsense box IP address.  This will take away some device tracking and reduce server use for redundant time request from every one of your devices.

 

Change the unbound dns resolver cache settings to keep dns IP resolutions for 259,200 seconds (because by default, websevers online set it to 175 seconds, so the setting is also in seconds).

 

This is three full days, and will not only help reduce the delay between dns resolution and connecting to a resolved IP address, but also reduces outbound network use, and reduces the load on dns servers, thus, possibly reducing energy use, maybe.

 

Setup a pi-hole (not directly UNIX compatible, so an alternative is pfblocker-ng) in a debian vm would not use much resources (less than 250MB of memory, and half that once booted into debian at the command line with pi-hole active) but I'm completely clueless how to run a virtual machine on pfsense, so if you are interested, I hope it's easy, or just use yet another device.

 

Here's why you may want to run pi-hole, online tracking is comoletely off the rails:

 

https://pi-hole.net/blog/2017/02/22/what-really-happens-on-your-network-find-out-with-pi-hole/

 

Even large organizations are now recommending adblockers to prevent malware!

[TubsAlwaysWins]

1 minute ago, E-waste said:

even large organizations are now recommending adblockers to prevent malware!

Are they using Pi-Hole or is there some other appliance they are using? Or just installing on each workstation? 

[E-waste]

No idea, but here is more information, from the forum tech news section, page 9.

 

https://linustechtips.com/topic/1480218-fbi-recomends-adblock/

[ZeusXI]

4 hours ago, E-waste said:

 

 

Setup a pi-hole (not directly UNIX compatible, so an alternative is pfblocker-ng) in a debian vm would not use much resources (less than 250MB of memory, and half that once booted into debian at the command line with pi-hole active) but I'm completely clueless how to run a virtual machine on pfsense, so if you are interested, I hope it's easy, or just use yet another device.

 

Here's why you may want to run pi-hole, online tracking is comoletely off the rails:

 

https://pi-hole.net/blog/2017/02/22/what-really-happens-on-your-network-find-out-with-pi-hole/

 

Even large organizations are now recommending adblockers to prevent malware!

personally I have been using Adguard over PiHole.

[leadeater]

22 hours ago, TubsAlwaysWins said:

Are they using Pi-Hole or is there some other appliance they are using? Or just installing on each workstation? 

Enterprise firewalls have URL, DNS and Domain blocking features with category lists updated by the vendor so on your outbound internet access rule you just enable the feature set and choose 'advertising' category to block.

 

Each firewall vendor is slightly different but that's the generic steps.

 

Do note however that the advertising category doesn't typically block Google Ads or other "legitimate" advertising services, which have had malicious ads services through them before. You can block Google Ads etc, it's just that on the enterprise side of things trying not to break things and also play nice with legitimate services and maintaining relationships is the typical chosen path, unlike Pi-hole etc.

[TubsAlwaysWins]

On 8/12/2023 at 9:40 AM, leadeater said:

Enterprise firewalls have URL, DNS and Domain blocking features with category lists updated by the vendor so on your outbound internet access rule you just enable the feature set and choose 'advertising' category to block.

 

Each firewall vendor is slightly different but that's the generic steps.

 

Do note however that the advertising category doesn't typically block Google Ads or other "legitimate" advertising services, which have had malicious ads services through them before. You can block Google Ads etc, it's just that on the enterprise side of things trying not to break things and also play nice with legitimate services and maintaining relationships is the typical chosen path, unlike Pi-hole etc.

Yeah for sure. I work with alot of Sophos XG firewalls, just wasnt sure if we were talking on a scale larger than what I use. I dont see alot of malicious ads but I also have adblock installed. 

I have seen malicious Google advertising links. Example is a user searched "Home Depot" and clicked the first result (A google ad) with a legitimate URL shown, that redirected to a malicious site. I dont know how Google is letting stuff like this through. Seen it a few times too

[LAwLz]

What do you hope to achieve with this setup? What is the end goal? 

[E-waste]

On 8/11/2023 at 4:40 PM, ZeusXI said:

personally I have been using Adguard over PiHole.

Pfsense comes with unbound dns I believe, have you changed the caching settings, or redirected NTP requests locally back to pfsense?  Not only would that reduce outbound server equipment use, but it would also be far more accurate, especially combined with NTPd or chrony.  You can even set it to use your Ethernet hardware clock instead of the motherboard clock, for more accuracy and network timestamping, increasing accuracy even further!