Router Firmware upgrade

[THE JEW (RaVeN)]

Setting up pfsense with VLAN's (particularly, with Smart Switches)

https://forum.pfsense.org/index.php?topic=28379.0
https://forum.pfsense.org/index.php/top ... l#msg78736
https://www.iceflatline.com/2013/09/how ... n-pfsense/

[THE JEW (RaVeN)]

Shibby Tomato.

Basic
->Network
1. I disable WAN and bridge to br0 for another port
2. I enable STP, but disable DHCP on ALL networks
3. Set Gateway and DNS
4. Set and configure main wireless as you see fit.

->Static DHCP/ARP/IPT
1. I have "Ignore DHCP requests from unknown devices" unchecked.

Advanced
->DHCP/DNS
1. Use internal DNS is checked
2. Prevent DNS-rebind attacks is checked
3. Reduce packet size is checked
4. All others unchecked.
5. Enable DHCP via Dnsmasq by:

Code: Select all

interface=br1
dhcp-option=br1,3,192.168.xxx.1
dhcp-range=br1,192.168.xxx.100,192.168.xxx.125,255.255.255.0,24h
interface=br2
dhcp-option=br2,3,192.168.xxx.1
dhcp-range=br2,192.168.xxx.100,192.168.xxx.10,255.255.255.0,24h

->Firewall
1. All unchecked but the Comcast fix

->Routing
1. Mode = Router
2. Efficient Multicast Forwarding is checked
3. DHCP Routes MUST be checked (lil' PITA)

->VLAN
1. VLAN and VID should both rise sequentially
2. Bridge VLAN 2 to br1, VLAN3 to br2
3. Bridge eth1 to br0
4. Bridge wl0.1 to br1
5. Bridge wl0.2 to br2
6. Trunk override not checked

->Virtual Wireless
1. Setup wl0.1 as you see fit and have it bridged to br1
2. Setup wl0.2 as you see fit and have it bridged to br2
3. I click the Overview button at the top, not the bottom, as clicking the one at the bottom seems to erase my settings.

Administration
->Scripts
1. Under Firewall put:

Code: Select all

iptables -t nat -I POSTROUTING -o `get_wanface` -j SNAT --to `nvram get wan_ipaddr`
iptables -I FORWARD -i br1 -m state --state NEW -j ACCEPT
iptables -I FORWARD -i br2 -m state --state NEW -j ACCEPT
iptables -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -I FORWARD -i br0 -o br1 -m state --state NEW -j DROP
iptables -I FORWARD -i br0 -o br2 -m state --state NEW -j DROP
iptables -I FORWARD -i br1 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -I FORWARD -i br2 -d `nvram get lan_ipaddr`/`nvram get lan_netmask` -m state --state NEW -j DROP
iptables -t nat -I POSTROUTING -o br0 -j SNAT --to `nvram get lan_ipaddr`
iptables -I INPUT -i br1 -m state --state NEW -j DROP
iptables -I INPUT -i br2 -m state --state NEW -j DROP
iptables -I INPUT -i br1 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br2 -p udp --dport 67 -j ACCEPT
iptables -I INPUT -i br1 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br2 -p udp --dport 53 -j ACCEPT
iptables -I INPUT -i br2 -p tcp --dport 53 -j ACCEPT
iptables -I INPUT -i br1 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport www -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br1 -p tcp --dport https -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport telnet -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport ssh -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport www -j REJECT --reject-with tcp-reset
iptables -I INPUT -i br2 -p tcp --dport https -j REJECT --reject-with tcp-reset

QoS and Bandwidth limiting to follow.

[THE JEW (RaVeN)]

Expresscards known to work with pfsense and laptops

TRENDnet Gigabit PC Card Card TEG-PCBUSR (used on WAN; Intel on LAN)
http://www.amazon.com/gp/product/B0007R ... rdfocom-20

StarTech.com EC1000S 1-Port ExpressCard GigaBit Laptop Ethernet NIC Network Adapter Card
http://www.amazon.ca/StarTech-com-EC100 ... B003N3G1BI


Laptop lid fix for pfsense
http://wiki.hackspherelabs.com/index.ph ... op_Lid_Fix


Traffic shaping pfsense
https://doc.pfsense.org/index.php/Traffic_Shaping_Guide
http://hubpages.com/hub/How-to-Configur ... ng-pfSense
http://elgwhoppo.com/2012/11/17/using-p ... p-traffic/

pfsense and untangle
http://theosquest.com/2011/10/09/pfsens ... -protects/

Virtual pfsense and untangle
http://everythingshouldbevirtual.com/su ... e-untangle

Guide to building pfsense box with Snort, Spamassassin, etc
http://www.smallnetbuilder.com/other/se ... nse-part-1
http://www.smallnetbuilder.com/other/se ... th-pfsense

[THE JEW (RaVeN)]

Ethernet PCMCIA cards reported to work with a laptop and pfsense:

-any Intel based one
TRENDnet Gigabit PC Card Card TEG-PCBUSR
http://www.amazon.com/gp/product/B0007R ... rdfocom-20

Other methods:
PM2-C PCI-E / Mini PCI-E Adapter
http://www.buydvb.net/pm2c-pcie-mini-pc ... r_p17.html

MPX-574D2

PCI Express mini card Gigabit Ethernet Module
http://www.commell.com.tw/Product/Perip ... -574D2.HTM

PM2C V2.1
(PCI-E / Mini PCI-E adapter)
http://www.hwtools.net/Adapter/PM2C.html

Someone running this way:
http://hardforum.com/showthread.php?t=1645336
https://forum.pfsense.org/index.php?topic=32193.0

[THE JEW (RaVeN)]

Asus router firmware:

https://github.com/RMerl/asuswrt-merlin ... ut-Asuswrt

[THE JEW (RaVeN)]

pfsense fork:

https://opnsense.org/

[THE JEW (RaVeN)]

pihole & pfsense:
https://www.reddit.com/r/pihole/comment ... h_pfsense/

pfsense & unifi:
https://forum.netgate.com/topic/125529/ ... ogeather/7

[THE JEW (RaVeN)]

Good review on the Unifi UDM-Pro
https://evanmccann.net/blog/unifi-dream ... pro-review

Overview of all the AP's
https://evanmccann.net/blog/unifi-ap-breakdown

[THE JEW (RaVeN)]

Open source, ready to go router:
https://www.applianceshop.eu/security-a ... sense.html

OpnSense (an alternative to pfSense)
https://opnsense.org/

VyOS (an alternative to pfSense)
https://en.wikipedia.org/wiki/VyOS

Great lil' 'puters to run a router:
https://fit-iot.com/web/products/fitlet2/

Great lil' 'puters to run a router:
https://protectli.com/

DNS that blocks ads:
https://nextdns.io/

Hardened BIOS replacements:
https://www.coreboot.org/users.html