Virtualizing pfSense - Pros and Cons to Consider 

I've been running a firewall virtually on ESXi similar to this for years now. I ran IPfire virtually for years but just recently switched to pfSense. I like running it virtually and it's great for a home network. I have the ability to quickly provision and test new firewall distros if I want to.

Excellent video for a networking beginner, I learnt a lot. Thanks!

I like the way you describe pfsense as the swiss army knife of networking! thats great! BTW - If you are use Microsoft Hyper-V Server (Hypervisor only) you can use 10GbE Nics, if there is driver support. That hypervisor has no GUI unfortunately but can be setup to be managed using the standard mstoolset from a Win10Pro machine. If Hyper-V see the 10GbE Nics and the drivers work, you got 10gig networking - setup a virtual switch (external) linked directly to the Nic, then attcah to VM, boot pfsense and you are good to go. pfsense will only see what ever virtual network adapters the hypervisor presents to it, so for this sceanrio, no issues. If there are no linux drivers for the NIC for example and you load pfsense direct on to physical box, then this matters! I selected a Broadcom 57xx series SFP+ Dual port PCI-e card for my setup as there are drivers for Windows Server 2008 R2 + 2012, 2012 R2, 2016 and 2019 that also work with the free Microsoft Hyper-V Server hypervisor only version. In to that I plugged my 2 x 10GbE Direct Attcah Copper cable, the in to a UniFi XG-16 switch - there you are 20GbbE aggregated LCAP Link to the switch. Also, used in this setup is a QNAP NAS with sane dual port SFP+ NICs also bonded and connected to said switch. Server is used was and old DELL T320 with a pair of SSDs for the OS only. iSCSI link to the NAS -where the VMs (VHDs) reside and run from. Hyper-V server just sees the NAS volume as a Local (iSCSI) Disk. data transfer rates are awsome! All networking is done with VLANS through the UniFi XG-16 Switch. Finally, my WAN link to the cable modem is made via 1Gig Ethernet to same XG-16 switch. VLANs used - VLAN 0 (Default) & VLAN 10 (iSCSI) & VLAN 20 (WAN) Server is VLAN Member of ALL VLANS NAS see VLANs 10 only VM running PFSense has 2 virtual NICs - one connected to VLAN 0, the other VLAN 20 for the WAN VM Running UniFi controller has one virtual NIC on VLAN 0 (Default) I could add another VLAN for a Guest Wi-Fi network if needed to very easily with this setup. Granted this setup cost a fair few bucks, but it kicks ass! :-)

I've got pretty much the same setup/networking running under ESXi. Works like a charm. ESXi has a free version btw. It's fine for this. Nice video.

Pfsense is a great tool to learn on. I use it at work for VPN, firewall, IDS, proxy

Many thanks for that ! Great work!

Good video . I am in the process of building an pfsense box

Hi, I can see where you put the links for information that you refer in video

Wow, so well done! Thanks for posting, man! Very helpful.

im weary of running a firewall/router virtualized. im more old school and prefer (at least) my router to be hardware. firewall maybe acceptable as virtualized imo. however you did go over the cons of a virtualized firewall/router.

Thanks dude.

Can you do 10GBE on ipcop instead of pfsense?

Can we create virtual instances or domains in pfsense

So after 2 years, what would you change? And would OpenBox be a better solution if you were using a Linus server and didn’t want to dedicate the whole box to PF? - great video. Thanks for the tips!

Well now that I have a virtualization server its time to use it! I probably jumped a bit in the deep end by starting out learning networking by virtualizing my router, but it was a great learning experience and I had fun with it. Best of all the performance difference is pretty noticeable and having all machines on the same network finally is oh so very nice.

pfSense is definitely a go-to option. I have really taken a liking to Untangle. There’s some hate for it online, but it has been incredibly solid for me and very feature rich.

Great Channel, definitely in my boat, subbing

How did you create the LAN virtual switch for pfSense? Is it on the Internal network or external network virtual swithch?

good thing I found your channel

Hi, Taylor Tech. Can i ask what network drawing tool/software you are using on 8:60?

Nice setup but what if you want to use vlans on the LAN side of your virtual switch eg: if you have a managed switch behind your Virtual switch via the servers NIC how would the vlans comunicate ?

Thanks for your videos. I want to use pfsense with two wireless cards (1 for secondary WAN and the other as a secondary LAN AP), but Hyper-V Server 2019 refuses to allow me to add any wireless cards to virtual switches. Has anyone added wireless cards to virtual switches in the free Hyper-V 2019 server? Will any other Type 1 hypervisor allow wireless cards like what I want to do? Thanks in advance!

Hey quick question.. so my server has 2 nics its runing server 2019 and by using hyper v what am i supposed to set for the pfsense vm as network? It does not make sense to use private as than how will other devices connect to it such as host? Than again using external exposes the host to the internet? Can you clarify that please?

ONE MORE great video good job :) make my day

I am watching this now as I am thinking of doing the same thing. I was using a mini-pc type thing with a VIA CPU on it with PFSense running off a Compact Flash card for a while, but I found the RAM was the bottle neck on that as it maxed at 512MByte. It was very power efficient though as the mini-PC was originally designed as a Satallite thin client. I am looking at virtualising it all now as I am running a couple of servers now, one for BlueIris, which is Windows based and resource hungry, so it makes more sense for me to virtualise everything given the more powerful box is runnign 24/7 anyway. I was thinking of running ProxMox just for simplicity at home. What are your thoughts on this?

My experience virtualizing network appliances: set like 1-2vcpu tops, then set a reservation or set the hypervisor latency to low. When the VM is crunching lots of data the hyervisor will schedule time properly but if the network usage is low I've seen VMware & hypervisor unschedule the VM for longer causing multi millisecond latency. I especially find this on the F5 VM images

Do you recommend virtualizing pfsense AND Freenas in the same computer? is of pfsense slower on a virtual machine???

Wasn't sure PFSsense would work in HyperV...it does. :)

Hey question, are you still visualizing pfsense? im thinking of the same right now

my setup is a hardware router (netgear nighthawk) running ddwrt. and a hardware firewall micro appliance running pfsense that i just setup. esxi hypervisor running a windows domain controller vm, plex vm, nagios vm and a couple other VMs for playing around with (windows, linux, kali)

Should you have a dedicated hardware for pfSense? Otherwise, how are going ensure that you other VMs are secured?

Not a bad video. I used a lot of PF in my earlier days but moved to Endian Community as it was faster and smoother (PF went to shit when it was commercialised). Since then, I have been using UniFi with a USG Pro but as these go, they are still just a firewall greatly becoming over complicated and confusing. Don't stress over the power draw, the negative comments I can see are those who come close to whats being wanted in current state and then future. Start running a few heavy plug-ins like Snort IDS/IPS, caching and AV, having a little more grunt is great. As the machine is a R710 (older but great bang-for-buck), you can do a lot with them, especially with add-on storage and NIC's. I would suggest giving the PF VM say 2-4 cores along with say 4GB RAM would be better. Plenty of both in the host, why not? I will be moving back to this style setup in the coming month or so, just a smaller platform (Dell R310) that will be a pure SSD Hyper-V host but just for network security platforms as I can run/test a few different flavours in quick fashion as well as build VM's for clients.

i try to virtualize and i dont have enough nics!!! LOL im going to buy 2 nics, great video mate!!! grettings from mexico

Why are you creating a Virtual Switch for each physical interface instead of giving the pfSense Virtual Machine direct access to the external interface if it's the only machine using that interface? (VSwitch0 and VSwitch1)

Gday. Any chance you can list the hyper options besides Microsft hyperv in the info tab please , thanks in advance

SR-IOV allows your hypervisor to passthrough VMs to virtual NICs that are presented directly by your NIC. The assumption is that your NIC does support SR-IOV but if you can get it, the performance is far better than switching as you describe. You can also passthrough NICs without SR-IOV but you are effectively passing through the entire PCIE device to the VM so you would need as many NICs as you have VMs.

Hi Taylord, can you help me with this error message I got from Pfsense: Filter Reload There were error(s) loading the rules: /tmp/rules.debug:40: cannot define table pfB_Europe_v4: Cannot allocate memory - The line in question reads [40]: table <pfB_Europe_v4> persist file "/var/db/aliastables/pfB_Europe_v4.txt" @ 2018-09-28 11:00:11 any help will be gladly appreciated. Thanks

PFsense can't do 10Gb??? Why do they display options for 10Gbe cards during setup? I mean, why would it even recognize them?

If you trust pfsense’s AV solution, you do deserve what is coming to you! (I love pfsense, but I know how *exactly* it works. You should too!).

what is up with the high pitch chirping..... or do you have a smoke detector with a bad battery...

Hi Taylor, great video. A tiny suggestion...if you are going speak in that low growl style then I suggest you bring the mic closer to you, else better change the low growl tone to a more clear one, as non-native English speakers will have to strain while listening.

hey! just asking why you do record the sound with this low quality?

Just a heada up Proxmox is just a fancy GUI on top of KVM

Especially now you should be able to find plenty of used cheaper 10g or 40g switches that can do routing. Just not NAT or encrypted VPN and so on .. Pfsense can still do that part since Internet connections are waay unlikely to go over 1Gbps.

can we create virtual instances in pfsense?

But he's using hyper-v tho

Next do it with VLAN's so you only need to pass two virtual nics to your pfsense VM. one for you 1G lan and one for your 10G lan. Hint this comand will come in handy: Get-VMNetworkAdapter -VMName | Where-Object -Property MacAddress -eq "" | Set-VMNetworkAdapterVlan -Trunk -AllowedVlanIdList "x-x" -NativeVlanId x

Low volume

Why can't you do 10G? BSD has 10G drivers doesn't it?

arrgghhhh hyper-vvvv i'm meltinggg i'm meltinggg

Thanks for sharing! It really only starts after 7 and a half minutes: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-tYQ9omqxsCk.htmlm40s

I love pfsense. I use it for more then 4 moths as my only router and it hasn't been offline since. My isp's router howerver..... Pfsense doesn't use much cpu and ram whahahahahaha say that when you're under a ddos attack. I got 40 gig of ddr3 ecc allocated to the pfsense vm. 40 gig will give you 2.4 million tables and the last guy struggled to even push it to 48% so I'm a happy gamer. If any guy thinks he can boot me pm me for my IP 😂🤣

I did the same, HA pfSense virtualized. But now I will change to educated software. Why? If you have to ask, you still don’t have enough EXPERIENCE!!

Gaylord tech :DD

Hyper-V, lol.

One negative point of using a virtual machine is the power consumption. If I wanna use a virtual machine i do need much more cpu, ram and hd to get a stable machine which will cost much more money if I use this 24 hours a day.

All sysadmins who take their job seriously, should seriously consider learning and moving to Linux instead of fudging around with Hyper-V and other Mickeysoft products. I really can't take these videos seriously anymore when wannabe sysadmins think they can "learn" from messing around with Windows. You don't control your own product, you don't even own your own data and on top of that, you need to pay an arm and a leg for all the required licenses (assuming you don't crack your way into an illegal copy - which again, a pro sysadmin would never do). Oh, did I forget again that you don't even own your own HARDWARE? It's the same Mickeysoft who dictates what you can and cannot do with it, when you have to upgrade and blah blah blah... could go on for so long. Long story short... M$ is a waste of breath. At least you're choosing a very fine quality firewall/router.

1 minute in and I wanna scream at you. Not everyone knows wtf words you're using. I JUST WANT TO TURN MY OLD DELL INTO A BASIC ROUTER. I shouldnt have to be a network engineer to do that! Use regular words people understand! I should be able to find a video here on YT that allows you to run PF sense as a router on a VM and everyone wants to just confuse you before you even start. t(^_^t)

Poor audio kwality