Summary System requirements Web...
Transcript of Summary System requirements Web...
TLN – Wireless Statistics Subcommittee
October, 2013
pfSense
Summary pfSense is a distribution of FreeBSD that has been tailored for user as a firewall/router. It offers many
features that would be useful for public wifi. It is a free, open source application that can be used as a
wireless gateway to provide your public wifi network with a customizable captive portal, and stat
collection capabilities that will satisfy state collection requirements.
System requirements The minimum system requirements for a gateway with less than 10Mbps of throughput are:
• CPU – 100MHz
• RAM – 128MB
• CD-ROM Drive for initial install
• 1GB hard drive
Hardware specs should be scaled up to manage higher throughput loads. But generally speaking, any PC
built within the last five years should be more than adequate.
Web interface Everything configurable in
pfSense can be done from the
web interface. After an initial
setup wizard you will be sent to a
dashboard page that can be
customized with various widgets
that show different kinds of
various information. Some of the
more useful include traffic
graphs, firewall logs, and the
captive portal status.
A number of the configuration
pages deal with lists of items, list
of firewall rules, aliases,
schedules, routes, etc. and they generally have the same icon set for manipulating these lists.
adds a new item, deletes an item, and edits an item. Most of the buttons in the web
interface can be hovered over for a brief explanation.
Console interface
TLN – Wireless Statistics Subcommittee
October, 2013
Low level operations can be done from the
console interface. Console access via secure
shell can be enabled in the System >
Advanced page of the web interface to
allow remote access to the command
console. Shell commands can be run
through the Diagnostics > command prompt
page on the web interface, but this
functionality is still experimental, and SSH is
generally more convenient. Log in via SSH
as root with the admin password set for the
web console.
Network Configuration
PfSense PC
Access Point(s)
Public Network switch or VLAN
LAN interface
Wireless netowrk
Access Point(s)
Firewall/Router
WAN Interface
Internet
Systems running pfSense should have at least two NICs, and can replace the existing gateway for your
wireless network. The pfSense PC will act as the primary DHCP and DNS servers to wifi clients, and the
WAN interface will connect to your greater network. An initial setup wizard is available to guide users
through new installations. Assuming there is an existing wireless network on site that is structured
similarly to the diagram above, replacing the existing wireless gateway with a pfSense system should
only require a minimal working knowledge of computer networks, DHCP, and DNS.
Firewall rules Like most other firewalls, pfSense’s rules are applied per-interface. Packets matching a rule can be
allowed, blocked or dropped. Basic match criteria include: Protocol, the source and destination address
these can be scaled to include a single host or entire network source and destination port range.
TLN – Wireless Statistics Subcommittee
October, 2013
Advanced firewall rule features • Source OS – match rules based on Operating system
• TCP flags – match based on flags TCP flags that are set or cleared
• Schedule – Match rule to a time schedule, (can be used to set hours)
• Gateway – if multiple WAN interfaces exist, this option will send packets matching the rule to a
specific gateway.
• In/out – Sets a limiter to use for inbound and outbound traffic.
• Ackqueue/queue – Used to place matched packets into traffic shaping queues.
• Layer7 – performs deep packet inspection for matching rule
Floating rules Normally, firewall rules are set to a specific interface. Floating rules can apply to any interface, going in
any direction. These are primarily used to put packets in the appropriate shaping queues.
TLN – Wireless Statistics Subcommittee
October, 2013
Schedules Schedules can be used to define a set of times in which a firewall rule should be active. Each schedule
consists of one or more time ranges which can be set to specific days or a weekly recurrence.
To make a schedule click the new button, then set the days of the week or the calendar date you want
the schedule to be in effect using the calendar in the month section, then a time. Then, select a time
range using the start and stop time fields. Click add time to save the time rage to the schedule. Add as
many time ranges as are needed to the schedule and click save.
These schedules can be easily used to limit
wireless access to hours when the library is
open and to keep wireless inaccessible during
scheduled closures. Since the firewall rules are
evaluated on a first match basis, a rule
blocking for closed days, should be placed
above a rule setting weekly hours.
TLN – Wireless Statistics Subcommittee
October, 2013
Traffic Shaping The pfSense traffic shaper comes with a handful of wizards for configuring traffic shaping. The wizard
will allow you to set link bandwidth, select a queue scheduling algorithm, and prioritize common
protocols. The wizard will generate a set of queues and ACKqueues for each interface, as well as a set of
floating firewall rules for each protocol prioritized.
Limiters Limiters are used to simulate lower bandwidth or
lower quality connections over an interface. In
most cases simply setting the bandwidth limits
are sufficient, but you can also set a delay for the
connection, and simulate a certain percentage of
packet loss. Traffic is assigned to a limiter using
the in/out option in the firewall rules editor.
Layer 7 Layer 7 uses deep packet inspection to adjust
the behavior of the firewall. A layer 7 rule
group can be set to block traffic, place it in a
shaping queue, or place it through a limiter.
Captive portal The captive portal allows you to set up an authenticated or unauthenticated splash screen. The captive
portal will need to be configured in order to track usage statistics with pfSense.
Captive portal settings
TLN – Wireless Statistics Subcommittee
October, 2013
• Max concurrent connections – sets the number of users that can load the captive portal page at
the same time. This can probably be left alone.
• Idle timeout – sets the amount of time a session can be inactive before it is logged off.
• Hard timeout – sets maximum time limit on sessions
• Logout popup – opens a popup window with a logout button, useful for ending sessions.
• Pre-authentication redirect – sets a redirect variable that can be used on the captive portal
page, or on error pages.
• After authentication redirect URL – Landing page, if nothing is set users will land on whatever
page they were trying to access before authenticating on the captive portal page.
• Per-user bandwidth – limit the maximum upstream or downstream bandwidth that can be used
by an individual. This is equivalent to setting up a limiter for each host that authenticates
through the captive portal.
• Authentication – set authentication method
o No authentication
o Local user manager
o RADIUS
• HTTPS – use the https fields to load a certificate, and key if you wish the captive portal to use
SSL.
• Portal page contents – use this setting to upload the html for the splash page.
• Logout page contents – used to customize the logout popup, if enabled.
• Pass-through MAC – this section allows you to add MAC addresses that can bypass the captive
portal altogether.
• Allowed IP addresses – adding addresses to this list will allows that address to be accessible to
unauthenticated wireless users.
• Allowed hostnames – the same as allowed IPs, but for DNS names
• Vouchers – For captive portals using authentication, the voucher system generates codes that
can be used to grant time limited access through the captive portal without an username and
password.
• File manager – use this section to upload any images, or other resources that will be used in the
captive portal page. Only files uploaded through this system will be accessible from the captive
portal. The uploaded version will have the prefix “captiveportal-“ (“logo.jpg” will become
“captiveportal-logo.jpg”)
Captive portal status
TLN – Wireless Statistics Subcommittee
October, 2013
The captive portal status window shows the currently active sessions on the wireless network. All
sessions will have a username of unauthenticated when the portal is not using authentication. Session
can be terminated using the delete button on the right of the list.
Traffic Graphs The traffic graph
offers a real-time
look at upstream and
downstream traffic.
RRD Graphs RRD graphs provide more long term statistics of
not only bandwidth usage bandwidth usage, but
many other system statistics as well. RRD graphs
are average shorter time samples into larger
ones, allowing it to keep statistics going back
years.
In addition to recording network bandwidth
usage, the RRD graphs also track CPU and
memory usage, state table statistic, and captive portal utilization. The captive portal graphs show both
the currently logged in users, and the total number of currently logged in users, and the total number of
users that have logged in for a given time period. This can be very helpful in tracking overall usage
trends, however the averaging on the longer term graphs may lead to results that aren’t quite what the
State is asking for.
TLN – Wireless Statistics Subcommittee
October, 2013
Stat collection The features for recording long term usage statistics are not quite ideal given the requirements set out
by the state. Recording the number of sessions that the captive portal authenticates is possible out of
the box. There are two places where this session data can be located, status > Captive portal. This show
the current active sessions. Secondly, captive portal activity is located logged in status > system logs >
portal auth. This log file is rotated frequently, so if you’re planning to pull statistics form it, it would be
best to set up a syslog server. pfSense’s syslog setting are set in status > system logs > settings. The
collection methods in this document focus on using the session table.
Collecting session stats Assuming your timeouts are set long enough so that sessions form the beginning of the day will not
timeout before closing, the captive portal db should contain every session started that day. The number
of daily users can then be recorded form the captive portal status page. The drawbacks to using the
captive portal status page as a data source are that it would have to be done manually, late in the day.
Also any changes to the portal configuration while it’s up will clear the current session DB, spoiling your
data collection for that day.
Automated stat collection This section contains scripts and sections of code that are designed to work with pfSense version 2.0.3,
later version may require modification. It is possible to automate the recording of the total number of
sessions. This snippet of php code will return the number of active sessions on the captive portal
<?php require("captiveportal.inc"); if (file_exists("{$g['vardb_path']}/captiveportal.d b")) { $captiveportallck = lock('captiveportaldb') ; $cpcontents = file("/var/db/captiveportal.d b", FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES); unlock($captiveportallck); } else $cpcontents = array(); $concurrent = count($cpcontents); echo $concurrent; ?> Save this to a php file in /usr/local/www and it should be accessible remotely. This method still won’t be
able to count captive portal sessions that were cleared due to a restart or change in the captive portal’s
settings.
Automated Stat reporting A convenient method for collecting these daily session statistics is to store them in a database. A table
with three fields is necessary; an ID, a timestamp field which defaults to the current time, and an integer
field that will record the quantity of sessions.
Schedule the recording server to run the following php script after closing;
<?php $con = mysql_connect("dbhost","dbuser","dbpassword" );
TLN – Wireless Statistics Subcommittee
October, 2013
if (!$con){die('Could not connect: ' . mysql_error( ));} mysql_select_db("statdatabase", $con); $wificount = @mysql_real_escape_string(trim(file_get_contents('h ttp://pfsense.host/statoutputmethod.php'))); mysql_query("INSERT INTO `sessioncounttable` (`quan tity`) VALUES ('$wificount')"); mysql_close($con); echo 'It worked!'; ?>
Packages A number of packages exist that can be installed to enhance the functionality of pfSense. They are
located in System > Packages. I haven’t tried any of them in production and are marked as being in alpha
or beta status, so use at your own risk. Some of the more interesting ones include:
• Mailreport – Sends more detailed mail notifications.
• NRPE v2 – Nagios monitoring plugin, useful if Nagios is used to monitor systems on your
network.
• Open-VM-Tools – Vmware tools for FreeBSD.
• pfflowd – converts packet filter status messages to cisco netflow datagrams. Could be useful in
finding hosts that consume high levels of bandwidth.
• Darkstat – offers per-host network monitoring.
• Anyterm – web based terminal access.