VTG-Vault/Training/02 Pfsense.md

The chain of routers that are used to route all calls from PBX out to the internet. These will be used by all servers, but k12 schools and on-prem servers. 

Normally, the PF sense external is under the Settings> Asterisk Sip settings (in the FreePBX) 

Chicago
Private		External
10.0.81.11		198.181.166.11
10.0.81.12		198.181.166.12
10.0.81.13		198.181.166.13
10.0.81.14		198.181.166.14
10.0.81.15		198.181.166.15
10.0.81.16		198.181.166.16
10.0.81.17		198.181.166.17
10.0.81.19		198.181.166.19
10.0.81.20		198.181.166.20
10.0.81.22		198.181.166.22
10.0.81.23		198.181.166.23
10.0.81.24		198.181.166.125
10.0.81.25		198.181.166.126

Youngstown
Private		External
10.0.72.1		74.112.4.108
10.0.72.2		74.112.4.219
10.0.72.3		74.112.5.55
10.0.72.4		74.112.4.42
10.0.72.5		198.181.167.10
10.0.72.6		198.181.167.11
10.0.72.7		198.181.167.12
10.0.72.8		198.181.167.8
10.0.72.9		198.181.167.14

 Accessing the PF Sense Routers:  

!

• Chicago Login screen 

  • Username: would be your first and last name 

  • Password: would be the password used to log into the Chicago RDP 

• Youngstown PFsense Login 

  • Username: admin 

  • Password: Qu@l1ty123 

Once logged in, what we normally use are the following: 

Aliases – Where to put in an IP address that the client wants to allow access to the server, as shown below:  !

NAT – Where the actual "rule" for the Alias is setup, as shown below: 

!

To create an Alias, see below:  !

Name – Name of the company/client 

Description – same as Name 

Type – leave at host(s) 

Hosts – Click the add and enter the IP addresses that are to be granted access to the server 

I.e public Ip's of routers and/or public IP addresses of remote users 

To create a NAT, see below:  !

Everything should be default, besides these options: 

Protocol - TCP/UDP 

Source – Click Advanced and select the following: 

Type – Single Host or alias 

Address – The name of the Alias that was created prior to creating NAT198.181.166.19 

Destination Port Range -  

From: Other and box to the right put a 1 

To: Other and box to the right put 65535 

Redirect Target IP – The ip address of the freepbx server 

Redirect Target port – Other and the box to the right, put a 1 

Description – name of the client and/or company 

Once that is filled out, select Save and apply changes will appear on the next page. Make sure to click APPLY CHANGES 

VPN – Virtual Private Network 

VPNs would be used when there are quality issues that cannot be solved by normal troubleshooting 

The following document will show how to create a VPN when using an Edgemarc 

<> 

1. Setup ipsec tunnel to customer's router. Go to VPN > IPSec and setup phase 1 and phase 2. 

   1.  Note: You cannot NAT and VPN on the same router. If you are switching modes, you must delete the other rule. 

 Steps required on freepbx13 or later: 

2. Go to Settings > asterisk sip settings > add in the customer's LAN subnet 

3. Go to Connectivity > firewall > zones > networks. Add in the private IP Range as "Trusted" 

Steps required on freepbx12 or earlier: 

1. Go to webmin on port 9001 > Networking > Linux Firewall (or search firewall) > Add in the customer's local subnet (if there is a 'drop all' rule) 

 Steps required on webmin: 

2. Go to Networking > Network configuration > Routing and Gateways. Under static routes, add in "eth0 - network - netmask - gateway"