Jump to content
  • entries
    142
  • comments
    0
  • views
    83597

Custom pfSense on Azure Rm | a complete guide


proximagr

640 views

 Share

Custom pfSense on Azure Rm | a complete guide
A complete guide on how to create a pfSense VM on a local Hyper-V server, prepare it for Microsoft Azure, upload the disk to Azure and create a multi-NIC VM.
Download the latest image from https://www.pfsense.org/download/
img_5a46417942ce4.png
Open Hyper-V Manager create a Generation 1 VM. I added 4096 ram, 2 cores, use VHD, add an extra NIC (for second interface) and select the downloaded ISO. (create a fixed VHD as Azure supports only fixed VHDs for custom VMs)
img_5a4612db0c33f.png
Start the VM and at the first screen press enter.
img_5a4611c229af2.png
At all screens I accepted the default settings. Finally at the reboot prompt remove the installation ISO.
There is no need to setup VLANs, select the second interface for WAN and the first for LAN.
img_5a4614323b079.png
img_5a46147b409db.png
Once the pfSense is ready press 2 and change the LAN (hn0) interface IP to one at your network. Then select the option 14 to enable SSH.
img_5a464549bd64f.png
Now we can login with putty, with username admin password pfsense and press 8 for Shell access.
img_5a4619a436eb5.png
The first thing is to update the packages running:

pkg upgrade

Python
Then install Python, as it is requirement for the Azure Linux Agent.
Search for Python packages running:

pkg search python


img_5a46475c9ca1b.png
Install the latest Python package, setup tools and bash:

pkg install -y python27-2.7.14

pkg search setuptoolspkg install py27-setuptools-36.2.2ln -s /usr/local/bin/python /usr/local/bin/python2.7pkg install -y bash

Azure Linux Agent
ref: https://docs.microsoft.com/en-us/azure/virtual-machines/linux/classic/freebsd-create-upload-vhd

pkg install gitgit clone https://github.com/Azure/WALinuxAgent.gicd WALinuxAgentgit taggit checkout WALinuxAgent-2.1.1git checkout WALinuxAgent-2.0.16python setup.py installln -sf /usr/local/sbin/waagent /usr/sbin/waagent


check the agent is running:

waagent -Version


img_5a46540428ee9.png
One final step before uploading the VHD to Azure is to set the LAN interface as dhcp.
This can be done by the web interface, go to https://lanaddress, login using admin / pfsense, and go to interfaces / LAN and select DHCPas ipv4 configuration.
img_5a469d4f2dd21.png
Now, shutdown the pfSense and upload it to Azure Storage.
I use the Storage Explorer, https://azure.microsoft.com/en-us/features/storage-explorer/ a free and powerful tool to manage Azure Storage. Login to your Azure Account and press Upload. Select as Blob type: “Page blob”
img_5a4cc0ac27e62.png
After the upload is completed we can create a multiple NIC VM. This cannot be accomplished from GUI. We will create this using PowerShell.

$ResourceGroupName = "******"$pfresourcegroup = "*******"$StorageAccountName = "******"$vnetname = "*****"$NSGname = "******"$location = "West Europe"$vnet = Get-AzureRmVirtualNetwork -Name $vnetname -ResourceGroupName $ResourceGroupName$backendSubnet = Get-AzureRMVirtualNetworkSubnetConfig -Name default -VirtualNetwork $vnet$vmName="pfsense"$vmSize="Standard_F1"$vnet = Get-AzureRmVirtualNetwork -Name $vnetname -ResourceGroupName $ResourceGroupName$pubip = New-AzureRmPublicIpAddress -Name "PFPubIP" -ResourceGroupName $pfresourcegroup -Location $location -AllocationMethod Dynamic$nic1 = New-AzureRmNetworkInterface -Name "EXPFN1NIC1" -ResourceGroupName $pfresourcegroup -Location $location -SubnetId $vnet.Subnets[0].Id -PublicIpAddressId $pubip.Id$nic2 = New-AzureRmNetworkInterface -Name "EXPFN1NIC2" -ResourceGroupName $pfresourcegroup -Location $location -SubnetId $vnet.Subnets[0].Id$VM = New-AzureRmVMConfig -VMName $vmName -VMSize $vmSize$VM | Set-AzureRmVMOSDisk `            -VhdUri https://********.blob.core.windows.net/vhds/pfsensefix.vhd `            -Name pfsenseos -CreateOption attach -Linux -Caching ReadWrite$vm = Add-AzureRmVMNetworkInterface -VM $vm -Id $nic1.Id$vm = Add-AzureRmVMNetworkInterface -VM $vm -Id $nic2.Id$vm.NetworkProfile.NetworkInterfaces.Item(0).Primary = $trueNew-AzureRMVM -ResourceGroupName $pfresourcegroup -Location $locationName -VM $vm -Verbose


Once the VM is created, go to the VM’s blade and scroll down to “Boot diagnostics”. There you can see a screenshot of the VM’s monitor.
img_5a4cddde2157b.png
Then go to the Networking section and SSH to the Public IP.
img_5a4ce2adeacc3.png
and also we can login to the Web Interface of the pfSense
img_5a4ce3fe0353a.png
img_5a4ce85fe97a1.png
In my case I have added both NICs at the same Subnet, but at a production environment add the LAN interface to the backend subnet and the WAN interface to the DMZ (public) subnet.
Of course more NICs can be added to the VM, one for each Subnet at our environment.Route external traffic through the pfSense
We cannot change the gateway at an Azure VM, but we can use routing tables to route the traffic through the pfSense.
From the Azure Portal, select New and search for Route table.
img_5a4ce9f90f26b.png
We need to configure two things. One is to associate the Route table to a Subnet and the second is to create a Route.
img_5a4ceae539c0b.png
Open the “Route table” and click the “Routes”. Press “Add route” and in order to route all outbound traffic through the pfSense then add for Address prefix “0.0.0.0”, next hop type Virtual appliance” and Net hop address the ip address of the pfSense’s LAN interface IP.
img_5a4cec67cf571.png
Then go to the “Subnets” and associate the required subnets.
img_5a4ced5dacef4.png

 

[/url]share_save_171_16.png
The post Custom pfSense on Azure Rm | a complete guide appeared first on Apostolidis IT Corner.



Source

 Share

0 Comments


Recommended Comments

There are no comments to display.

Guest
Add a comment...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...