
The chain of routers that are used to route all calls from PBX out to the internet. These will be used by all servers, but k12 schools and on-prem servers. 

Normally, the PF sense external is under the Settings> Asterisk Sip settings (in the FreePBX) 

|   |   |   |
|---|---|---|
|Chicago|   |   |
|Private||External|
|10.0.81.11||198.181.166.11|
|10.0.81.12||198.181.166.12|
|10.0.81.13||198.181.166.13|
|10.0.81.14||198.181.166.14|
|10.0.81.15||198.181.166.15|
|10.0.81.16||198.181.166.16|
|10.0.81.17||198.181.166.17|
|10.0.81.19||198.181.166.19|
|10.0.81.20||198.181.166.20|
|10.0.81.22||198.181.166.22|
|10.0.81.23||198.181.166.23|
|10.0.81.24||198.181.166.125|
|10.0.81.25||198.181.166.126|

|   |   |   |
|---|---|---|
|Youngstown|   |   |
|Private||External|
|10.0.72.1||74.112.4.108|
|10.0.72.2||74.112.4.219|
|10.0.72.3||74.112.5.55|
|10.0.72.4||74.112.4.42|
|10.0.72.5||198.181.167.10|
|10.0.72.6||198.181.167.11|
|10.0.72.7||198.181.167.12|
|10.0.72.8||198.181.167.8|
|10.0.72.9||198.181.167.14|

 Accessing the PF Sense Routers:  

![[pfsense_diagram_1.png]]

- Chicago Login screen 
    
    - Username: would be your first and last name 
        
    - Password: would be the password used to log into the Chicago RDP 
        
- Youngstown PFsense Login 
    
    - Username: admin 
        
    - Password: Qu@l1ty123 
        

Once logged in, what we normally use are the following: 

![Machine generated alternative text:](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIcAAABpCAYAAAAQqTD4AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAZlSURBVHhe7Z3LbttGFIaHsmzZBmxn0S5apIGBuihQJEULNKusUqNoNt30FQqki6z9Dtl0EyAvkVfoLttsiqYoIAfwJb7BV8U3Wb5IKn+GpzggZihSoi3S/D/geGYOZ0Yk59eZMYeAvB+M6Zqc8abbNQ89LywNFzmXPJ7TINj6iPoqV/6fvBmw+XHytlTy2rRf8r3K0lb7gE7zYCB6HWkNRH3f+8KQPPr37g8YOd76nbh40Ke60aetrfjlM6WOrb6uq4/1KgvR9q56wwDnIvR7TnHXI8cqbb8wiH3j+AD4bfWTGMAJahO/pLp/IPmoD/WkPVJbWdpoA7Y0D6aRa0lrch+0yTGAdGBxwL72P0iDsq1eUgPoQ5v4darr/+tfnDagj8elYrb20TQPphnkXkfvMa4bfoB8peNnsrCv/M4BUtvxNAbi/JJqPz43avp4XAqr+zdDt5Vj0TQPJuhrzMKApOi7EuYzQW5qHngXfvsBzgtlOb9ouYgMeu76/rjIVBzDQgZbW9qbF+0jz2Qh6rh7Jse8uQyec+gO8n1bSRoGEgcaSuNoJxRJ8elLHLpBcWdtYgMLUowv/mtJveZAQwhCjNwuIIgR38bCfCooiPKQWBxcQ5QPz1dHonG/49v0xywpCYmfkI77xuhRLrxqtZpozL+4wkYuKRNerVZLJI7Pz8/DHCkL3szMTE9xdLtd88nRUVgiZcGbnZ2NFQeEARt9/z70kLLgzc/Px4qj0+mYdrtttl6/Dj3pefPhg3l4B//vkCLhLSwsxIoDwjj31xt/vnwZeuL5q9kM0u8mJ4MUwIeypKQYeK9evYoVB4RxdnZm/nj6NPTE83e4cP22VgtSAJ8uk2Lg1ev1WHG0Wi1zcnJifnv0KPS4+cf/d/d+terMR32C+IDNn6YuyQ6v2WzGigNRo9FomF/m5kKPm7f+YD0IB8mW1z5N3PGor1dfJDsqExMTppeNj+P5aG9GRrCf9xFbXvv0y7z6OMoa8SWpS7Il9a6sCxkoGUTJ24Afr8aLCVLWfQBdF6Z90bokOzITB9ADCOuXuLZRIQzyOSSeTMWRFAyofOP1YGufDHq0rvhtPpItXhePP2PAgvTg4MD8dPdu6CFlYSiRgxQDioM4oTiIE4qDOKE4iJNU4uCjpnLByEGcpBIHHzWVC0YO4oTiIE4oDuKE4iBOMhOH7JBqbGWXTxvJB0OPHNhu19vz3H7PD5mKAwPr+ubDL4PP6FAMuOYgTjIXByPD7eFGIoeIBanOk3xzLeKwRQ9Zb4iR/MM1B3HCF4yJE0YO4oTiIE4oDuKE4iBOUomDTybKBSMHcZJKHHx0VS4YOYgTioM4oTiIk6GKgzuz+SYzcch2vBgpPplGDr0lT4EUnxuZVqJCsQlHIo6trs1Prp9cLEgx8LaoE/WTmyVTccg3XAY1DbqtJlomN8e1rDn6QdrqPiRvEw25fq5lWpEB7ZdoWxELuVmubc2hBaK//TbRRI+LGGw+cnPwHVLiJBf/rZB8QnEQJxQHcUJxECcUB3GSWBz4Ia/+n1yQIpJYHJ+OjfEd0pKRSBz4sb0fHz8OS6QsJI4cPz9/bj4bHQ1LpAz0FAeiBqxSqZhfnz1LriZSeBJPK2P+mmPuyRPz+4sX5st798y47yO3m557K+12O/i58r29PbO+vm4WFxdNvV43S0tLZmVlxezu7pqjo6PgN++vrq5Mp9MJ2vXolhSAVJGjVquZ6elpMzMzY6ampgKbnJwMfrF61F+PVKvVoK7necE0hJRWYEsSOS4uLszh4aHZ2dkxGxsbQdSALS8vm83NTbO/vx9Ej1arFUQPtGEEKT49xQEgDplaYJhOVldXA4NYMLU0Gg1zenoa1BWBoGvpniIpHonEgYHGex2IHogSW1tbgSjW1taCPCIK/MfHx0E9EQiiBwVSXBKJA0j0wPSBSIEIAmFsb2//H1EgnmazGUwvl5eXgTgkgpDikVgcsvYQgeDtMBgiBqYU5LU4UBdtYEDWIKQ4JBYHwIDDMHVgfQGRQCwQhaw5IAwRBwSB6UWgQIpFKnEAEYgWiUQLPOuQVKYVCqK4pBYHkClGUphEC4gCfohCUlJM+hIHkLUEUjERjPh1SopH3+LQaAFQFLeHTMRBbifcgSdOKA7ihOIgTigO4oTiIE4oDuKE4iBOKA7ihOIgTigO4sCY/wDX6SgBtCPOAwAAAABJRU5ErkJggg==)

Aliases – Where to put in an IP address that the client wants to allow access to the server, as shown below: 
![[pfsense_diagram_2.png]]

NAT – Where the actual "rule" for the Alias is setup, as shown below: 

![[pfsense_diagram_3.png]]

To create an Alias, see below: 
![[pfsense_diagram_4.png]]

Name – Name of the company/client 

Description – same as Name 

Type – leave at host(s) 

Hosts – Click the add and enter the IP addresses that are to be granted access to the server 

I.e public Ip's of routers and/or public IP addresses of remote users 

To create a NAT, see below: 
![[pfsense_diagram_5.png]]

Everything should be default, besides these options: 

Protocol - TCP/UDP 

Source – Click Advanced and select the following: 

Type – Single Host or alias 

Address – The name of the Alias that was created prior to creating NAT198.181.166.19 

Destination Port Range -  

From: Other and box to the right put a 1 

To: Other and box to the right put 65535 

Redirect Target IP – The ip address of the freepbx server 

Redirect Target port – Other and the box to the right, put a 1 

Description – name of the client and/or company 

Once that is filled out, select Save and apply changes will appear on the next page. Make sure to click APPLY CHANGES 

VPN – Virtual Private Network 

VPNs would be used when there are quality issues that cannot be solved by normal troubleshooting 

The following document will show how to create a VPN when using an Edgemarc 

<<VPN setup with EM.docx>> 

1. Setup ipsec tunnel to customer's router. Go to VPN > IPSec and setup phase 1 and phase 2. 
    
    1.  Note: You cannot NAT and VPN on the same router. If you are switching modes, you must delete the other rule. 
        

 Steps required on freepbx13 or later: 

2. Go to Settings > asterisk sip settings > add in the customer's LAN subnet 
    
3. Go to Connectivity > firewall > zones > networks. Add in the private IP Range as "Trusted" 
    

Steps required on freepbx12 or earlier: 

1. Go to webmin on port 9001 > Networking > Linux Firewall (or search firewall) > Add in the customer's local subnet (if there is a 'drop all' rule) 
    

 Steps required on webmin: 

2. Go to Networking > Network configuration > Routing and Gateways. Under static routes, add in "eth0 - network - netmask - gateway"