MINISTRY OF EDUCATION AND TRAINING

UNIVERSITY OF ECONOMICS AND FINANCE

PROJECT REPORT
COMPUTER NETWORK SECURITY
Major: Information Technology
Minor: Information Security

TOPIC
FIREWALL PFSENSE

Supervisor: Nguyen Son Lam, MSc

Student:
Name: Nguyen Gia Phat ID: 215050101
Name: Nguyen Dang Tai ID: 215051972
Name: Pham Hoang Tuan ID: 215051955
Name: Duong Kim Tuyen ID: 215051642
Name: Duong Vu Ky Duyen ID: 215052069

Ho Chi Minh City, 2024

 MINISTRY OF EDUCATION AND TRAINING
UNIVERSITY OF ECONOMICS AND FINANCE

PROJECT REPORT
COMPUTER NETWORK SECURITY
Major: Information Technology
Minor: Information Security

TOPIC
FIREWALL PFSENSE

Supervisor: Nguyen Son Lam, MSc

Student:
Name: Nguyen Gia Phat ID: 215050101
Name: Nguyen Dang Tai ID: 215051972
Name: Pham Hoang Tuan ID: 215051955
Name: Duong Kim Tuyen ID: 215051642
Name: Duong Vu Ky Duyen ID: 215052069

Ho Chi Minh City, 2024

 TABLE OF CONTENTS

Contents
TABLE OF CONTENTS...................................................................i
LIST OF IMAGES...........................................................................iii
ABSTRACTS...................................................................................iv
CHAPTER 1 . INTRODUCTION...................................................1
1.1 OVERVIEW OF THE TOPIC..............................................................1
1.2 REASONS FOR CHOOSING THE TOPIC........................................1
1.3 OBJECTIVES OF THE RESEARCH..................................................1
1.4 RESEARCH OBJECTS........................................................................2
1.5 RESEARCH METHODS.....................................................................2

CHAPTER 2 . THEORETICAL BASIS.........................................3

2.1 OVERVIEW OF FIREWALL PFSENSE............................................3
2.2 DEVELOPMENT HISTORY...............................................................3
2.3 CHARACTERISTIC............................................................................3
2.3.1 Advantage......................................................................................4
2.3.2 Disadvantage.................................................................................4
2.4 FUNCTION..........................................................................................4
2.4.1 NAT ( Network Address Translation )..........................................4

CHAPTER 3 . IMPLEMENT PFSENSE........................................6

3.1 INSTALLING PFSENSE.....................................................................6
3.1.1 Overview of the pfSense implement environment........................6
3.1.2 Basisc requirements for implementation.......................................6
3.1.3 Configure pfSense through CLI....................................................7
3.1.4 Server Configuration.....................................................................7
3.1.5 Client.............................................................................................8

-i-
 3.1.6 Common errors and how to fix them.............................................8
3.2 EXPLORE THE PFSENSE IMPLEMENT TOOL..............................9
3.2.1 Virtualization Tools.......................................................................9
3.2.2 pfSense Installing Tool..................................................................9
3.2.3 pfSense Admin Tools....................................................................9
3.2.4 Tools to support network deployment.........................................10
3.2.5 Backup and recovery tools..........................................................10
3.3 IMPLEMENT PFSENSE...................................................................11

CHAPTER 4 . CONCLUSION AND DEVELOPMENT.............18

4.1 CONCLUSION...................................................................................18
4.2 DEVELOPMENT...............................................................................18

REFERENCES................................................................................20

- ii -
 LIST OF IMAGES

Figure 3-1: : Virtual network configuration..............................................................11

Figure 3-2: : Virtual Machine Configuration............................................................11
Figure 3-3: IP Configuration for 3 Network Cards...................................................12
Figure 3-4: pfSense system information...................................................................12
Figure 3-5: Network Interface Configuration...........................................................13
Figure 3-6: List of Network Interfaces.....................................................................13
Figure 3-7: Setup Rules for the 1st card (LANnet)...................................................14
Figure 3-8: Setup for the 2nd card (OPT1)...............................................................14
Figure 3-9: Setup cho card thứ 3 (OTP2).................................................................14
Figure 3-10: Aliases IP in pfSense............................................................................14
Figure 3-11: LAN Rules in pfSense..........................................................................15
Figure 3-12: Setup OPT1 in Firewall........................................................................15
Figure 3-13: Setup OPT2 in Firewall........................................................................16
Figure 3-14: Page connection error...........................................................................16

- iii -
 ABSTRACTS

Nowadays, information technology is being strongly developed, popularized

and integrated globally. Information technology is divided into many majors, most
of which are linked to each other. This widespread spread also poses many potential
security risks, not only from external attacks but also from internal factors.
Configuration errors or malware are spread from unprotected devices. Therefore,
the implementation of effective network security solutions, especially firewalls.
Firewalls have become the preferred choice of businesses, schools, organizations,
and individual users.
pfSense is one of the popular open-source firewall solutions. Developed based
on the FreeBSD operating system, pfSense is designed to provide advanced security
functions and flexible network management, pfSense not only serves as a traditional
firewall but also a comprehensive network management system. Besides, pfSense
also stands out for its extensibility and customization through packages and plugins.
This makes it easy for users to add new features, flexibly meeting complex security
needs.
However, the implementation and configuration of pfSense also presents many
difficulties, especially for new users or complex network systems. Therefore,
research on the features, how it works, and the actual implementation model of
pfSense not only helps people better understand this tool but also provides
directions for effective application in practice. This report will help users analyze
the key features of pfSense so that they can have a detailed view of how pfSense is
used to protect the network from modern security threats, and optimize the
performance and stability of the system.
Thank you very much to Mr. Nguyen Son Lam for supporting and helping our
team complete this report. However, with limited knowledge, we hope that he can
make suggestions and edits to help us complete 100% of this report. His advice will
be a great source of motivation for us to improve the quality of our work and
knowledge.

-4-
 CHAPTER 1 . INTRODUCTION

1.1 OVERVIEW OF THE TOPIC

This research topic focuses on the application of techniques to protect network

systems for school devices using the pfSense tool. Cyber attacks are one of the
common forms of attack, in which an attacker can disrupt systems that affect
computer network operations and systems, causing the loss of important data,
affecting the property and reputation of the school.

1.2 REASONS FOR CHOOSING THE TOPIC

Today's status quo speaks to the importance of computer network security.

With this topic, we hope to help schools understand the situation and how to prevent
things that harm their systems. For the purpose of protecting information and assets
for the university, including senior managers, lecturers and students. Ensure that
management, teaching and learning activities take place normally and achieve high
performance.

1.3 OBJECTIVES OF THE RESEARCH

With the requirement to monitor all connections in/out of the network system
to have an overview of the system's network connection activities, preventing
potential threats affecting the school's network system.
Understanding the function of pfSense: Studying and analyzing the
operability of pfSense
Prevent attacks: Detect and prevent attacks through website paths that may
contain malicious data packets.
Traffic Management and Monitoring: Manage and optimize network traffic
to ensure performance.
Configure and deploy pfSense in the school environment: Research and
analyze the configuration of security rules and policies to protect the network to
prevent threats to the school.

-1-
 Testing and Evaluation: Testing the capabilities of pfSense and reviewing
security vulnerabilities and evaluating pfSense's preventability.

1.4 RESEARCH OBJECTS

Schools: Educational institutions from primary to university.

IT Manager: Technical staff and network management at schools.
Teachers and students: People who use the network during teaching and
learning.

1.5 RESEARCH METHODS

Build a test network model in a school with pfSense to test features and
protection.
Monitor the performance and stability of the network for a certain period of
time to assess the impact of pfSense.
Summarize the findings and propose specific solutions for the implementation
of pfSense in schools.

-2-
 CHAPTER 2 . THEORETICAL BASIS

2.1 OVERVIEW OF FIREWALL PFSENSE

pfSense is an open-source operating system used to build firewalls and

network routers. It was developed based on FreeBSD, a Unix-like operating system
known for its high stability and security.
pfSense provides a web management interface, allowing users to easily
configure and administer the network without using multiple command lines.
pfSense is designed to meet the security, routing, and network management
needs of individuals, small businesses, and large organizations.

2.2 DEVELOPMENT HISTORY

2004: pfSense was developed by Chris Buechler and Scott Ullrich, starting as
a fork of the m0n0wall project, a lightweight firewall software.
2006: The first official version (1.0) of pfSense is released.
2014: m0n0wall stopped developing, and pfSense became the most popular
alternative.
2015: Netgate, the company that developed pfSense, takes over the project and
accelerates development.
At present: pfSense has become one of the leading open-source firewall
solutions in the world, widely used in various network environments.

2.3 CHARACTERISTIC

Open Source: Free to use with open source code, allowing for customization
and extensibility.
User-friendly web interface: Users can configure and manage via the web
interface, without the need for high command line expertise.
Diverse features:
Firewall and NAT (Network Address Translation)
VPN (OpenVPN, IPsec, WireGuard)
IDS/IPS (Snort, Suricata)

-3-
 QoS (Quality of Service) bandwidth management
Load Balancing, Failover
Captive Portal (for public client networks)
Multi-platform support: Can be installed on PC computers, dedicated servers,
or embedded network devices.

2.3.1 Advantage
Low Cost: It is a free, cost-effective and open-source solution compared to
commercial firewall systems such as Cisco ASA or Fortinet.
Flexible customization: Users can add plugins or expand the functionality
according to their needs.
Strong Community Support: Large user community, extensive documentation,
and timely support from Netgate.
High security: pfSense regularly updates security and supports network attack
detection/prevention tools (IDS/IPS).

2.3.2 Disadvantage
Hardware Requirements: While flexible, for large networks or complex
feature requirements (such as IDS/IPS), pfSense may require powerful hardware to
meet performance.
Initial difficulty: New users may have difficulty understanding and
configuring advanced features.
No official support for every plugin: Some plugins require manual installation
and are not officially supported, which is prone to errors if not managed properly.
Lacks some premium features: Compared to commercial solutions like Palo
Alto or Fortinet, pfSense may lack some premium features related to AI or
automation.

-4-
2.4 FUNCTION

2.4.1 NAT ( Network Address Translation )

NAT is a technique that allows one or more intradomain IP addresses to
convert to one or more external IP addresses.
NAT is responsible for transferring packets from one network layer to another
in the same system. NAT will change the IP address inside the packet and pass it
through the router and network devices
Advantage:
Save IPv4 addresses: NAT will help minimize the number of IP addresses that
need to be used.
Helps mask the IP inside the LAN.
NAT can share internet connections to many different computers and mobile
devices in a LAN with only a single public IP address.
NAT helps network administrators filter incoming packets and review access
of public IPs to any port.
Disadvantage:
Time-consuming IP changes, increasing the time during switching. Affecting
the transmission of the internet.
Capable of concealing IP addresses in LANs, technicians will have a hard time
checking IP origins and tracing traces.
If you hide your IP address, when you use some applications that need to use
IP, it will not work.

-5-
 CHAPTER 3 . IMPLEMENT PFSENSE

3.1 INSTALLING PFSENSE

3.1.1 Overview of the pfSense implement environment

pfSense can be deployed in a variety of network environments, with key
components including:
pfSense: Installed as a firewall and router.
Server: Provides network services, such as HTTP, FTP, DNS, or databases.
Client: Terminal devices (PCs, laptops, phones) connected via pfSense to
access the Internet or internal resources.
pfSense CLI: A command-line tool for managing and configuring pfSense,
especially in situations where the web interface is not accessible.

3.1.2 Basisc requirements for implementation

[Link] Hardware
 pfSense:
CPU: Supports x86-64.
RAM: Minimum 2GB
Drive: 8GB or more.
NIC (Network Card): At least 2 network ports (WAN and LAN).
 Server:
It depends on the service being deployed (e.g., a web server needs more CPU
and RAM than a file server).
 Client:
A computer or device with a network or Wi-Fi port, which supports the
TCP/IP protocol.

[Link] Software
 pfSense:

-6-
 The operating system is based on FreeBSD, the pfSense version is compatible
with the deployment environment.
 Server:
Operating System: Windows Server
 Client:
Operating System: Windows

3.1.3 Configure pfSense through CLI

pfSense's CLI allows for quick configuration in case the web interface is not
accessible or wants to perform remote administration.

[Link] Basic CLI commands in pfSense

CLI Access:
Direct access via VMware, Hyper-V, or a display connected to a hardware
device.
Sign in with the default account:
Username: admin
Password: pfsense
Basic configuration options:
1: Change the admin password.
2: Configure IP addresses for interfaces (WAN, LAN).
3: Reset the network interface (reassign the WAN/LAN port).
4: Reset the configuration to default.
5: Restart or shut down the system.
IP Manual Configuration:
Type 2 to set the IP for the interface:
For example, set the LAN IP: [Link] and subnet mask /24.

3.1.4 Server Configuration

The server is usually connected to the intranet via pfSense's LAN port, which
serves services to the client.

-7-
[Link] Server Basic Configuration
Static IP Assignment:
Set a static IP within the LAN range of pfSense (e.g., [Link]).
Configuring the firewall on pfSense:
Added a rule that allows access to the service from the client.
Example:
Allows web access: Port 80/443.
Remote connection allowed: Port 22 (SSH), 3389 (RDP).

3.1.5 Client
The client is used to test and connect to services on the server or the Internet.

[Link] Client Basic Configuration

Network Configuration:
IP: DHCP can be used from pfSense or set a static IP (e.g., [Link]).
Gateway: Set the LAN address of pfSense (e.g., [Link]).
Check the connection:
Server ping: ping <server IP address>
Check the web service: Access the [Link] IP address> via a browser.

[Link] Internet access or internal resources

If pfSense has been configured with NAT or routing, the client can access the
Internet or the server via a LAN IP address.

3.1.6 Common errors and how to fix them

Unable to access the server from the client:
Check the firewall rule on pfSense (allow connection).
Make sure the server is up and has the correct IP address.
Do not access the Internet from the client:
- Check the Gateway and DNS on the client.
- Make sure pfSense has a WAN connection.

-8-
 Unable to connect the pfSense CLI:
Check the status of the pfSense device on VMware or hardware.

3.2 EXPLORE THE PFSENSE IMPLEMENT TOOL

3.2.1 Virtualization Tools

If you deploy pfSense in a virtualized environment, you need the following
virtualization enablers:

[Link] VMware Workstation/ESXi

Purpose: Create a virtualization environment to install pfSense.
Outstanding Features:
- Supports creating multiple virtual machines with custom hardware
configurations.
- Flexible network connectivity (Bridged, NAT, Host-only).
Usage:
- Create a new virtual machine, select the FreeBSD operating system, and
assign at least 2 network cards.
- Mount pfSense's ISO file for installation.

3.2.2 pfSense Installing Tool

Tools needed to install and configure pfSense:

[Link] File ISO pfSense

Load Source: Pfsense Homepage
Function:
- Provides pfSense firewall operating system.
- Supports installation on real hardware or virtual machines.

3.2.3 pfSense Admin Tools

Once installed, pfSense can be administered through:

-9-
[Link] Command-line interface (CLI)
How to access:
- Connect directly via console interface (VMware, Proxmox).
- Use an SSH app like PuTTY.
Feature:
- IP configuration, network interface, password reset.
- Check network connection, manage firewall rules.

[Link] Web interface (WebGUI)

How to access:
- Access from a browser at the LAN address (default [Link]
- Log in with your account:
Username: admin
Password: pfsense.
Feature:
Manage firewalls, NAT, VPN, and network services.
View system information and logs.

3.2.4 Tools to support network deployment

Network Monitoring Tools
Wireshark:
- Used to analyze network traffic, check firewall rules.
Ping and Traceroute:
- Check the connection between devices in the network.
- Evaluate transmission and routing.

3.2.5 Backup and recovery tools

Backup tool on pfSense
- Backup configuration through WebGUI or CLI.
- A backup file (.xml) can be used to restore the entire configuration.

- 10 -
3.3 IMPLEMENT PFSENSE

Initializing 3 Network Cards in the Virtual Network Editor

Figure 3-1: : Virtual network configuration

Vmnet1(Host-only) with Ip address [Link]
Vmnet2(Host-only) with ip address [Link]
Vmnet3(Host-only) with ip address [Link]
Vmnet8(Nat) is the default network card in pfsense

Figure 3-2: : Virtual Machine Configuration

- 11 -
 3 more network cards for pfSense.

Figure 3-3: IP Configuration for 3 Network Cards

Initialize 3 network cards corresponding to 3 levels of delegation: [Link];
[Link]; [Link]

- 12 -
 Figure 3-4: pfSense system information

Figure 3-5: Network Interface Configuration

Figure 3-6: List of Network Interfaces

General Purpose of Interfaces (LAN, OPT1, OPT2):

LAN: Usually for the local area network and is the main network of internal
users (employees, personal devices, office computers).
OPT1 and OPT2:
- Can be used as a secondary network, for example, a guest network, a
network for a specific department, or an independent system that needs to
be separated.
- Depending on your needs, these interfaces can be configured to be
VLANs, DMZ (De-Militarized Zones) networks, or connect to other
subnets.

- 13 -
 When the 3 network cards are set up, it will be displayed in the interface of
Pfsense.

Figure 3-7: Setup Rules for the 1st card (LANnet)

Figure 3-8: Setup for the 2nd card (OPT1)

Figure 3-9: Setup for the 3rd card (OTP2)

At this time, all 3 devices are connected to the internet

Figure 3-10: Aliases IP in pfSense

- 14 -
 Continue will setup Aliases:
- Aliases such as cap1, cap2, and cap3 group the IPs of each user level.
- Hethongnoibo and MangxaHoi represent specific domain groups (internal
or social media).
- When you create a firewall rule, you can use this alias to allow, block, or
restrict access.
Setup Rules in Firewall

Figure 3-11: LAN Rules in pfSense

Setup LAN trong Firewall
Allow unrestricted internet access for internal users.
Block or restrict access to other interfaces (such as OPT1, OPT2) to avoid data
leakage.

Figure 3-12: Setup OPT1 in Firewall

- 15 -
 Block level 2 (cap2) users from accessing social networks, but allow during
specified hours.

Figure 3-13: Setup OPT2 in Firewall

Can be used for client networks or IoT (Internet of Things) devices, with
internet access but not intranet access.
Conclude
LANs, OPT1, and OPT2 are set up to partition subnets and ensure that each
network has access to only the right resources.
Configuring rules helps to enhance security, optimize bandwidth, and control
network traffic in detail in the system.

- 16 -
 This is pfSense's flexible and robust approach to managing complex

networks.

Figure 3-14: Page connection error

When the level 3 machine ip is assigned to the Aliase of the Level 3, at the
same time, configure the level 3 user blocking policy. As a result, the level 3
machine cannot access the web that has been blocked by the server
([Link], ....)

- 17 -
 CHAPTER 4 . CONCLUSION AND DEVELOPMENT

4.1 CONCLUSION

The combination of assigning IP addresses to aliases and setting up firewall

policies is a very effective method to control network traffic, while ensuring system
security. Specifically, when we assign IP addresses to Aliases, we can manage the
group of computers or devices in the network more easily. This allows us to
implement firewall rules more accurately and flexibly, thereby improving the
security of the system.
By setting up a firewall policy to block access from level 3 users, we can
minimize the risk posed by potential threats. Computers in the network will no
longer be able to access websites that have been blocked, helping to protect the
organization's data and resources. Furthermore, the enforcement of these regulations
and policies not only helps prevent unauthorized access but also raises user
awareness about compliance with cybersecurity rules.
This not only protects the system from external attacks, but also helps create a
safer working environment for all users. When users are clearly aware of the limits
and regulations, they will tend to be more compliant and collaborative, resulting in a
more efficient and secure network system. In conclusion, the combination of IP
assignment and aliases and establishing firewall policies is an essential part of the
overall network security strategy, helping to protect the organization from risks and
threats that seek to find its identity.

4.2 DEVELOPMENT

The use of Snort available in pfSense to monitor network traffic and detect
bad access from hackers is an important step in protecting the system. Snort acts as
an intrusion detection system (IDS), allowing you to analyze and monitor network
traffic in real-time. By configuring specific rules in Snort, you can identify
suspicious traffic patterns, such as invalid packets or signs of cyberattacks, such as
denial-of-service (DDoS) attacks or network scraping attempts. When Snort detects

- 18 -
these activities, it can send alerts to administrators, helping them react in time to
prevent the threat.

In addition, using Traffic Shaper in pfSense to limit the bandwidth of client

machines is also an essential part of controlling network traffic. Traffic Shaper
allows you to set up rules to allocate bandwidth according to each type of traffic,
thereby ensuring that no single client can take up too many network resources. For
example, you can prioritize bandwidth for critical applications like video
conferencing or data streaming, while limiting bandwidth for large downloads. This
not only improves the user experience for business-critical operations, but also
protects the network from network congestion caused by clients using too many
resources.

When you combine Snort to detect bad activity and Traffic Shaper to manage
bandwidth, you create a safer and more stable network environment. This
combination not only helps protect the organization's resources from hacker attacks,
but also ensures that every user can access network services effectively. In
summary, it is a comprehensive and specific strategy for protecting and optimizing
the network, contributing to improving the performance and safety of the entire
system.

- 19 -
 REFERENCES

[1] Tran Van Quyet (2019), “NGHIÊN CỨU TRIỂN KHAI GIẢI PHÁP ĐẢM
BẢO AN NINH MẠNG TRÊN NỀN PFSENSE”, in Hai Phong Private
University, pp. 1-72.
[2] Nguyen Van Phat, Tran Cao Dang Duy, and Pham Viet Cuong (12/2021), “
TÌM HIỂU VỀ BẢO MẬT VÀ TRIỂN KHAI TƯỜNG LỬA PFSENSE CHO
MẠNG DOANH NGHIỆP”, in HUTECH, pp. 1-55.
[3] Tran Thi Tu Anh (2024), “Pfsense là gì? Tìm hiểu chi tiết từ A – Z”, in
[Link].
[4] Nguyen Hoang Anh (2016), “Tổng quan về pfSense (phần 1)”, in
[Link].
[5] (2024), “Tìm Hiểu pfSense: Giải Pháp Tường Lửa Mã Nguồn Mở Hàng Đầu
Hiện Nay”, in [Link].

- 20 -