PfSense VirtualBox Appliance as Personal Firewall on Linux

The tutorial explains how to set up pfSense VirtualBox appliance in order to use it as a personal firewall on Linux. It shows Linux network configuration to support this scenario and provides an installation script that automatically builds a VirtualBox virtual machine ready for pfSense installation. It also describes pfSense installation and shows minimal web configuration needed for successful connection to the Internet.

pfSense Live CD ISO disk can be downloaded from here.

1. Linux Network Configuration

We are going to install pfSsense from live CD ISO image on a VirtualBox virtual machine. To do so we must reconfigure an existing network interface, create a new one and configure new static default routes. A network topology consists of Linux Fedora with installed VirtualBox virtualizer. is shown below.

Picture1-Network_Topology

Picture 1 - Network Topology

A wireless network card is installed in Linux and presented as an interface wlp3s0. The interface wlp3s0 is the interface that connects Pfsense virtual machine to the outside world. This interface will be bridged with a first network adapter (em0) of the Pfsense virtual machine. Bridging host adapter wlp3s0 with the guest adapter em0 (WAN interface of Pfsense) will be done using vboxmanage utility and shown later in the tutorial.

As the Pfsense appliance is Continue reading

CoreOS overview

This blog is part of my ongoing series on Docker containers. In this blog, I will cover basics of CoreOS and some hands-on stuff I tried with CoreOS. As mentioned in my other blog on Docker  orchestration, CoreOS falls in the category of specialized Linux distributions that can host Containers and are suitable for massive server deployments. … Continue reading CoreOS overview →

Welcome to MovingPackets.NET!

John Herbert

Welcome to my new home! If you’ve come over here because you used to read my drivel on LameJournal, then thank you! If you’re a new visitor, you are very welcome and I hope you choose to subscribe by RSS or Email so you can get notified of new posts.

MovingPackets.net is the new name for LameJournal. All the networking and computer-related content from LameJournal has been duplicated here at MovingPackets, but the photography content is gone and I’ll attempt to stay focused on things related to moving packets around as I post here going forward.

I have a new site theme, and with the new name as well, things are still likely to change a bit here visually (I have no logo yet for example). Still, there’s no time like the present so I decided to launch the site and I’ll tweak things as we go along with the aim of making the content more easily accessible. I hope you like my new home; it’s going to take a while before it feels comfortable!

Thanks for stopping in at MovingPackets.

John.

If you liked this post, please do click through to the source at Welcome to MovingPackets.NET! and give me a share/like. Thank you!

MovingPackets.NET – The New Name for LameJournal

I’ve been quiet lately, mostly because I’ve been horribly busy but also in part because I’ve been thinking that it’s about time to rebrand LameJournal to something that better reflects the content. And to that end, MovingPackets.net has been born. All the … Continue reading →

If you liked this post, please do click through to the source at MovingPackets.NET – The New Name for LameJournal and give me a share/like. Thank you!

QoS Design Notes for CCDE

Trying to get my CCDE studies going again. I’ve finished the End to End QoS Design book (relevant parts) and here are my notes on QoS design.

Basic QoS

Different applications require different treatment, the most important parameters are:

  • Delay: The time it takes from the sending endpoint to reach the receiving endpoint
  • Jitter: The variation in end to end delay between sequential packets
  • Packet loss: The number of packets sent compared to the number of received as a percentage

Characteristics of voice traffic:

  • Smooth
  • Benign
  • Drop sensitive
  • Delay sensitive
  • UDP priority

One-way requirements for voice:

  • Latency ≤ 150 ms
  • Jitter ≤ 30 ms
  • Loss ≤ 1%
  • Bandwidth (30-128Kbps)

Characteristics for video traffic:

  • Bursty
  • Greedy
  • Drop sensitive
  • Delay sensitive
  • UDP priority

One-way requirements for video:

  • Latency ≤ 200-400 ms
  • Jitter ≤ 30-50 ms
  • Loss ≤ 0.1-1%
  • Bandwidth (384Kbps-20+ Mbps)

Characteristics for data traffic:

  • Smooth/bursty
  • Benign/greedy
  • Drop insensitive
  • Delay insensitive
  • TCP retransmits

Quality of Service (QoS) – Managed unfairness, measured numerically in latency, jitter and packetloss

Quality of Experience (QoE) – End user perception of network performance, subjective and can’t be measured

Tools

Classification and marking tools: Session, or flows, are analyzed to determine what class the packets belong to Continue reading

NFD9 Prep: NetBeez

I’m reviewing the presenters for Network Field Day 9, in particular looking at those I’m not familiar with. NetBeez is one of those making their first Tech Field Day appearance.

NetBeez

We all know that our users and the applications they access are incredibly distributed. We don’t control all the network elements, but the network team still gets the blame if things go wrong. You need greater visibility to prove it’s not the network, but getting that visibility is tough. Current options for probes aren’t always cost-effective to deploy across many sites. Many sites don’t have any local server infrastructure.

That’s where NetBeez comes in. They have developed Raspberry Pi-based agents that can easily be deployed to many locations. Plug in power, plug in a network cable, and it phones home. Go to the NetBeez dashboard, and from there you can configure the tests you want the agent to run.

Since the devices are so small, they can easily be deployed to a range of small sites, and can simulate a range of user traffic. Tests include Ping, HTTP, Traceroute, DNS. A particularly nice feature is the ability to run an ad-hoc iPerf test with custom parameters.

The dashboard shows you how the Continue reading

It’s About Application Delivery, Not Networking

Send to Kindle@DrDust tweets: @packetpushers – at the beginning you appeared very Cisco centric. Now not so much. What do you guys “like” working on? Be warned, @DrDust. This is probably not the post you’re looking for. But it’s where my mind went after reading your question. ;-) On Early Cisco-centrism I don’t especially remember that […]

Looking Ahead: My 2015 Projects

In this post, I’m going to discuss some projects that I’ve set out for myself in the upcoming year. I’ve done this in years past, and the feedback that I’ve gotten from readers is that they found these posts to be quite helpful.

I first started posting annual project lists in January 2012, when I posted a list of some projects for 2012. In January 2013, I graded myself on my progress (spoiler alert: I didn’t do very well), followed by a new 2013 project list in early February. The series of posts ends in January 2014 when I assessed my 2013 performance.

Here’s what I’m seeing for myself with regard to 2015 projects:

  1. Complete a new book. Having successfully transitioned the “Mastering VMware vSphere” series to Nick Marshall (who did an astounding job with the 5.5 release of the book), it’s time for me to get back into the book writing saddle. One of my projects for this coming year will be to complete a new book before the end of the year. This is a pretty significant effort, and it will absorb a large portion of my time and attention (as those who have written books can Continue reading

PlexxiPulse—Interested in joining our team?

If you’ve been following our blog and/or keeping up with Plexxi on social media, you may have noticed that there is a lot going on here. We recently introduced new product starter kits, began construction on our new office expansion, are working on some exciting projects, and have grown by 20 percent in the past two months. Are you interested in being a part of the Plexxi team? If so, we would love to hear from you. Check out our careers page for more information.

Below you will find our top picks for stories in the networking space this week. Have a great weekend!

In this week’s PlexxiTube video of the week, Dan Backman explains how Plexxi’s datacenter transport fabric works with optical transport gear.

Light Reading: New Plexxi Chief Makes His Mark
By Mitch Wagner
As he enters his third month in the big chair, new Plexxi CEO Rich Napolitano is retooling the company’s messaging to focus more on the benefits of software networks — using Plexxi technology, of course — and less on the abstract benefits of SDN. Napolitano took over as CEO in November after 30 years in the technology industry, most recently at EMC Continue reading

Sizing up the three popular Internet TV streaming sticks

If you’re like most folks, the back of your home entertainment center is a hive of HDMI cables, USB cords and power adaptors, not to mention the HDMI switchers necessary to cope with this cornucopia of entertainment providers. Thankfully, there is a solution: The increasingly popular streaming stick.

These Internet TV streaming devices will be the savior of every gadget-obsessed, cable-cluttered geek out there. These chewing gum-sized streaming devices can pipe the whole wide, weird and wonderful Internet into your television, with a lot less of the cable mess than you’re dealing with now.

Currently available in one of three flavors—Roku's Stick ($50), Google's Chromecast ($35), and Amazon's Fire Stick ($39)— these three devices can deliver pretty much any online content you could wish for directly to your living room. Here's a look at what these sticks have to offer:

To read this article in full or to leave a comment, please click here

How can router decide so fast?

How does Internet work - We know what is networking

Cisco created all sorts of different magic inside their boxes that optimize forwarding processing of packets. Main router function is fairly self-explanatory. Router performs IP forwarding more often called IP routing. IP routing is process of deciding where to send the packet after it was received.       IP Routing explained in detail Logic behind IP forwarding is listed in steps here with the assumption it will be an IPv4 packet that was received. This is process switching explained in 11 steps: A frame enters the one of router’s interface First thing that router does is to check frame

How can router decide so fast?

27 – Bis-Bis – Stateful Firewall devices and DCI challenges – Part 1 (cont)

Back to the recent comments on  what is “officially” supported or not ?

First of all, let’s review the different Firewall forwarding mode officially supported

ASA cluster  deployed inside a single data center:

Firewall forwarding mode within single DCFig.1 Firewall forwarding mode within a single DC. Please note the firewall routed mode supported with the Layer 2 load balancing (LACP) Spanned Interface mode.

When configured in Routed mode (e.g. default gateway for the machines), the same ASA identifiers IP/MAC are distributed among all ASA members of the cluster. When the ASA cluster is stretched across different locations, the Layer 2 distribution mechanism facing the ASA devices is achieved locally using pair of switches (usually leveraged the a Multi-chassis EthernetChannel technique such as VSS or vPC).

Subsequently the same virtual MAC address (ASA vMAC) of the ASA cluster is duplicated on both sites and as the result it hits the upward switch from different interfaces.

 

 

 

 

 

 

 

 

 

 

Fig.2 ASA and duplicate vMAC address

When the ASA cluster runs the firewall routed mode with Spanned interface method, it breaks the Ethernet rules due to the duplicate MAC address, with risks of affecting the whole network operation. Consequently Continue reading

SDN Router @ Spotify on Software Gone Wild

Imagine you need a data center WAN edge router with multiple 10GE uplinks. You’d probably go for an ASR or a MX-series router, right? How about using a 2 Tbps ToR switch and an SDN solution to make it work with full Internet routing table?

If you happen to have iTunes on your computer, please spend 10 seconds rating the podcast before you start listening to it. Thank you!

Read more ...

The Importance of Product Education

brainI learned something new this afternoon. While other users of this product were already aware of it, I was not. This is something that is specific to the Wi-Fi community, but there is a larger point affecting all practitioners of technology that I will attempt to illustrate in this post.

The Problem

I have been doing a lot of wireless surveys lately. These particular surveys have been large enough to require two engineers to be on site. We’ll divide up the location by floors or sections in order to get the job done in less time. These particular surveys are in place assessments, so we aren’t putting survey AP’s up on poles and measuring signal strength, determining attenuation of walls, etc. We’re simply measuring the signal of all AP’s in place and making recommendations based on the requirements of the business(e.g. moving to support voice at 5GHz or location based services). In addition to using a survey tool, which in our case is Ekahau’s Site Survey, we are also doing spectrum analysis at various points within the given facility with Metageek’s Wi-Spy DBx hardware and Chanalyzer software.

The spectrum analysis portion is where my problem resided. I happen to have a pair Continue reading

1 … 3,560 3,561 3,562 3,563 3,564 … 3,751