What are Interfaces in pfSense? - zenarmor.com (2024)

pfSense® software is an open-source firewall and router software that provides a comprehensive solution for network security and management. It is based on the FreeBSD operating system and offers enterprise-grade features and security.

In computer networking, an interface is a point where various components can communicate and share data. Interfaces play an essential role in the management of network connectivity and traffic in the pfSense infrastructure. They serve as the bridge between the physical hardware and the software-defined networking environment provided by pfSense software.

In this article, we delve into the fundamental concepts of interfaces within pfSense, exploring how they aid in managing network connections and the different types available on the platform. From LAN and WAN interfaces to more specialized options like VLAN and bridge interfaces, each serves a unique purpose in configuring and controlling network traffic within the pfSense ecosystem. We'll provide step-by-step guidance on configuring LAN interfaces for local network access, setting up WAN interfaces for external connectivity, understanding the role of OPT interfaces, implementing VLANs for network segmentation, leveraging virtual interfaces for flexibility, considerations for wireless interfaces, and the utilization of bridge interfaces for specific network configurations.

Let's explore these topics in detail to gain a comprehensive understanding of interface management in pfSense.

What is the Fundamental Concept of Interfaces in pfSense?​

The fundamental concept of interfaces in pfSense is to manage network connections and control the flow of data. Interfaces are crucial because they allow users to configure and manage network settings, firewall rules, and routing policies.

To understand interfaces in pfSense, it's essential to grasp the naming convention used in FreeBSD, upon which pfSense is based. In FreeBSD, the name of an interface begins with the name of its network driver, followed by a number starting at 0 and increasing sequentially for each additional interface sharing that driver. For instance, the driver "igb" is commonly used for Intel gigabit network interface cards. The first card utilizing this driver would be named "igb0", the second "igb1", and so forth. Other drivers like "cxl" (Chelsio 10G), "em" (also Intel 1G), "ix" (Intel 10G), and "bge" (various Broadcom chipsets) follow a similar naming convention. In cases where a system incorporates multiple types of network cards, such as Intel and Chelsio, the interfaces would be labeled accordingly, such as "igb0" and "cxl0" respectively.

The interfaces can be assigned roles such as WAN, LAN, or OPT interfaces, and they can support multiple networks and protocols on a single interface. Physical and virtual interfaces are treated the same once assigned, and they have the same capabilities. This flexibility and functionality make interfaces a key component of pfSense, allowing users to tailor their network configurations to specific needs.

WAN and LAN interfaces are the foundation of pfSense. WAN interfaces are used to connect to the Internet or an upstream network, while LAN interfaces are for internal network connections. VPN interfaces in pfSense exhibit characteristics of both WAN and LAN interfaces due to their versatile nature.

Key points regarding interface types in pfSense are as follows:

• WAN interfaces are typically used to reach the Internet and have a gateway selected in their configuration, enabling outbound NAT and specific firewall behaviors.
• LAN interfaces are for internal network connections and do not have a gateway selected, allowing for different firewall rules and NAT settings.
• VPN interfaces are treated differently than traditional interfaces, with the firewall balancing common user needs and expectations for various VPN use cases.
• Understanding the distinction between WAN and LAN interfaces is crucial for configuring firewall rules, NAT settings, and traffic shaping in pfSense. It is essential to verify the interface type to ensure proper network functionality and security measures are in place

How Do Interfaces in pfSense Help Manage Network Connections?​

Interfaces in pfSense play a crucial role in managing network connections by providing a structured way to handle traffic flow, security policies, and network segmentation. Here are some ways interfaces in pfSense help manage network connections effectively:

1. Traffic Segmentation: Interfaces categorize network traffic into WAN and LAN types, allowing for distinct handling of inbound and outbound data flows. This segmentation helps in applying specific firewall rules, NAT configurations, and traffic-shaping policies based on the type of interface.
2. Security Policies: By defining interfaces as WAN or LAN, pfSense enforces different security policies based on the network's purpose. For example, WAN interfaces have stricter inbound traffic rules to protect against external threats, while LAN interfaces focus on internal network communication and access control.
3. NAT Configuration: WAN interfaces in pfSense are configured to perform outbound NAT by default, ensuring that internal network traffic is properly translated when exiting the network. LAN interfaces, on the other hand, do not perform outbound NAT for traffic originating from their subnets, maintaining the original source IP addresses.
4. Traffic Shaping: Interfaces help in applying traffic shaping policies to prioritize or limit bandwidth for specific types of traffic. WAN interfaces are treated differently than LAN interfaces in traffic-shaping configurations to optimize network performance and ensure the quality of service.
5. VPN Integration: Interfaces in pfSense play a role in VPN connectivity, with VPN interfaces being treated as a hybrid of WAN and LAN types. This allows for proper routing of VPN traffic, ensuring that inbound and outbound traffic flow through the appropriate VPN connections.

By effectively managing network connections through interfaces, pfSense enables administrators to control and secure their network infrastructure, optimize performance, and tailor configurations to meet specific business requirements.

What Types of Interfaces Are Available in pfSense, and How Do They Differ?​

There are three main types of interfaces in pfSense:

1. Physical Interfaces: Correspond to the physical network interfaces of the server on which pfSense is running.
2. Virtual Interfaces: Created when certain services, like VLANs or OpenVPN, are configured.
3. Bridge Interfaces: Configurable interfaces associated with physical or virtual interfaces.

1. Physical Interfaces​

Physical interfaces in pfSense refer to the actual network interfaces present on the hardware running the pfSense firewall or router. These interfaces can be physical network interface cards (NICs) or built-in network ports on the hardware. Physical interfaces are used to connect the pfSense device to external networks, such as the Internet, and to internal networks, such as local area networks (LANs). Physical interfaces in pfSense are classified as follows:

1. LAN (Local Area Network) Interface: Used for connecting internal devices and forming the primary network segment.
2. WAN (Wide Area Network) Interface: Connects to the internet service provider (ISP).
3. OPT (Optional) Interfaces: Additional physical interfaces for creating separate network segments.
4. Wireless Interfaces: Physical interfaces that provide wireless connectivity.
5. PPP (Point-to-Point Protocol) interface
6. LAGG (Link Aggregation Group) interfaces

2. Virtual Interfaces​

Virtual interfaces in pfSense are logical network interfaces that are created within the pfSense firewall or router to provide additional networking capabilities and flexibility. These interfaces are not tied to physical network hardware and are used to extend the functionality of the firewall by creating virtual network segments, implementing advanced networking features, and facilitating connectivity to external and internal networks. Virtual interfaces in pfSense are classified as follows:

• VLAN (Virtual LAN) Interfaces: Logically divide a physical interface into multiple broadcast domains.
• Virtual (Assign) Interfaces: Created within pfSense, often for specific purposes like VPNs or routing.
• QinQ interfaces: QinQ, also known as IEEE 802.1ad or stacked VLANs, allows for nesting VLAN-tagged traffic inside packets that are already VLAN tagged, facilitating the transmission of VLANs over a single link with an outer tag.
• Generic Tunnel InterFace (GIF): GIF is a tunneling protocol used to transport IPv4 or IPv6 traffic over networks, enabling the creation of virtual point-to-point or point-to-multipoint connections.
• Generic Routing Encapsulation (GRE): GRE is a tunneling protocol used to encapsulate various network layer protocols inside IP packets, facilitating the creation of virtual private networks (VPNs) or the transmission of multicast traffic over networks.

3. Bridge Interfaces:​

Bridge Interfaces in pfSense are virtual interfaces. They are created by combining multiple physical or virtual interfaces into a single logical interface, allowing for transparent communication between devices on the same network segment. Bridge interfaces are commonly used for segmenting LANs, creating transparent firewall deployments, or integrating with other network devices.

How Can I Configure LAN Interfaces for Local Network Access in pfSense?​

An interface of the LAN variety establishes a connection with a local network, such as a DMZ, LAN, management network, guest network, or another similar network. This typically includes private or dedicated circuits and site-to-site links utilized to access other local or internal networks, such as VPNs. Any assigned interface that lacks a gateway selected in its interface configuration is classified as a LAN-type interface by the firewall. To assign a new LAN interface on pfSense software, you may follow the next steps:

1. Navigate to Interfaces > Interface Assignments on your pfSense web UI.

2. Pick the new interface from the Available network ports list.

3. Click the +Add button.

   Figure 1. pfSense Interface Assignment

In the interfaces list, the newly assigned interface will be displayed. The new interface will have a default name allocated by the firewall, such as OPT1 or OPT2, with the number increasing based on its assignment order. The first two interfaces default to the names WAN and LAN, but they can be renamed. These OPTx names appear under the Interfaces menu, such as Interfaces > OPT1. Selecting the menu option for the interface will open the configuration page for that interface.

To configure LAN interfaces for local network access in pfSense you may follow the next steps:

1. Go to Interfaces > LAN option on pfSense web UI.

2. Select the checkbox labeled Enable Interface.

3. Select an IPv4 configuration type, which is typically static.

4. Alternatively, you may select None as the IPv6 Configuration Type.

5. Provide the correct CIDR in the drop-down menu adjacent to the field containing the IPv4 address. Leave IPv4 Upstream gateway set to None.

6. Input the IPv4 address and CIDR in the corresponding fields, respectively, if IPv6 was enabled through the IPv6 Configuration Type setting.

   See Also

   What is User Interface (UI)? (Types & Features) | BrowserStack

7. By default, the Block private networks and Block bogon networks settings should be left unchecked.

8. Once the modifications are complete, select the Save button. When the page reloads, click on the Apply Changes button.

   Figure 2. pfSense LAN Interface Configuration

Additionally, when configuring a LAN interface in pfSense, keep in mind the following key points:

• Interface Configuration: Ensure that the LAN interface is selected and configured to connect to the local network.
• Gateway Selection: Do not select a gateway on the LAN interface configuration page.
• Outbound NAT: The firewall will perform outbound NAT for traffic originating from the subnet(s) directly attached to a LAN-type interface when that traffic exits a WAN-type interface and automatic or hybrid outbound NAT mode is active.
• NAT Reflection: If NAT reflection is active, the firewall will create NAT reflection rules that allow clients on LAN-type interfaces to access port forwards from behind the firewall.
• Firewall Rules: Configure firewall rules to control traffic flow to and from the LAN interface.

By following these steps, administrators can effectively configure LAN interfaces for local network access in pfSense, ensuring proper connectivity and security for devices within the local network.

What is the Purpose of WAN Interfaces, and How Are They Set Up in pfSense?​

The WAN (wide area network) interfaces in pfSense serve the purpose of connecting the network to the Internet or an external network. They are responsible for handling incoming and outgoing traffic to and from the Internet. Purpose of WAN Interfaces are as follows:

• WAN interfaces allow the network to communicate with external networks, such as the Internet.
• They handle outbound traffic from the internal network to the Internet.
• They are essential for accessing online resources, services, and communication with external devices.You may set up WAN interfaces in pfSense by following the next steps:

1. Configure the WAN interface to connect to the Internet or external network.
2. Select a gateway in the WAN interface configuration to establish the connection.
3. WAN interfaces typically have a dynamic IP address or a static IP address assigned by the ISP.
4. The firewall performs outbound NAT on traffic exiting a WAN-type interface when using Automatic or Hybrid outbound NAT modes.
5. Reply-to and route-to attributes are added to firewall rules on a WAN-type interface for traffic management.
6. WAN interfaces are considered for traffic-shaping purposes in pfSense.

By setting up WAN interfaces in pfSense, administrators can ensure that the network has access to the Internet and external resources while maintaining security and control over outbound traffic.

To configure a WAN interface on pfSense, proceed as outlined below:

1. Go to Interfaces > WAN option on pfSense web UI.

2. Verify the Enable Interface checkbox, which is by default selected.

3. Select a IPv4 Configuration Type (typically DHCP).

4. Leave the IPv6 Configuration Type at its default value of None.

5. Omit the MAC Address field. MAC address spoofing occurs when an individual enters a MAC address manually. If you want to compel your ISP to provide you with a different IP address or a different set of DNS servers, you may enter a MAC address here. However, it should be noted that the MAC address entered must contain a valid manufacturer's prefix in order to function.

6. Negate the values for MTU, MSS, Hostname, and Alias IP address.

7. By default, the Block private networks and loopback addresses checkbox should be selected. This will prevent the transmission of RFC 1918 private addresses over the public internet.

8. By default, the Block Bogon Networks checkbox should be selected. Thus, packets from IP addresses not yet assigned by IANA will be prevented from being transmitted or received.

9. Click the Save button. When the page reloads, click on the Apply Changes button.

   Figure 3. pfSense WAN Interface Configuration

How Do OPT (Optional) Interfaces Function in pfSense, and When Are They Used?​

pfSense supports various interface types, including physical, virtual, WAN, LAN, and OPT (Optional) interfaces. OPT interfaces is configured as additional LAN or WAN interfaces, allowing them to perform tasks such as creating guest networks, DMZ, IoT isolation, wireless segments, or connecting to upstream networks for Internet access. These interfaces provide flexibility in network design and can be used to expand the capabilities of the firewall.

1. Go to Interfaces > OPT1 option on pfSense web UI.
2. Select the checkbox labeled Enable Interface.
3. Declare a Description, such as DMZ.
4. Utilize Static IPv4 as the IPv4 configuration type.
5. A CIDR and IPv4 address must be entered. We shall utilize the 192.168.XX.X address and opt for CIDR 24 via the drop-down menu.
6. IPv4 Upstream gateway should be left at None.
7. By default, both the Block private networks and Block bogon networks checkboxes should be deactivated.
8. Once the modifications are complete, select the Save button. When the page reloads, click on the Apply Changes button.

Figure 4. pfSense OPT1 Interface Configuration

What are VLAN Interfaces, and How Can I Implement Them in pfSense for Network Segmentation?​

VLAN (Virtual Local Area Network) interfaces are a method of segmenting a physical network into multiple logical networks, allowing for improved network management, security, and traffic isolation. VLAN interfaces allow the creation of multiple virtual LANs on a single physical network infrastructure. Each VLAN functions as a separate logical network, enabling the isolation of traffic and the implementation of distinct security policies for different VLANs.

To implement VLAN interfaces in pfSense, the following general steps can be followed:

1. Configure the physical network switch to support VLANs and assign specific ports to the desired VLANs.

2. Create VLAN interfaces in pfSense by assigning VLAN tags to the physical network interfaces.

3. Configure firewall rules and policies for each VLAN interface to control traffic flow and enforce security measures.

4. Optionally, assign IP addresses and DHCP settings to the VLAN interfaces to enable communication within each VLAN.

How Do Virtual (Assign) Interfaces Work in pfSense, and Why are They Useful?​

Virtual (assign) interfaces in pfSense are a powerful feature that allows administrators to create additional logical network interfaces for various purposes. Virtual (assign) interfaces in pfSense can be created for a variety of purposes, such as VLANs, VPNs, and other virtualized network interfaces. They are created and managed within the pfSense web interface, providing a flexible way to extend the network infrastructure. Here's an overview of how virtual interfaces work and why they might be useful:

• VLAN Support: Virtual interfaces can be used to create VLANs, allowing the segmentation of a physical network into multiple logical networks. VLANs enable the isolation of network traffic and the implementation of separate security policies for different network segments.
• VPN Interfaces: Virtual interfaces can be utilized for VPN connections, such as IPsec VTI (Virtual Tunnel Interface) and OpenVPN interfaces. They enable the establishment of secure communication channels over public networks, providing remote access and site-to-site connectivity.
• Traffic Segmentation: Virtual interfaces allow for the segmentation of network traffic based on specific requirements, such as separating guest Wi-Fi traffic from internal network traffic.
• Resource Optimization: Virtual interfaces can be used to optimize network resources by logically dividing physical interfaces for different purposes without the need for additional physical hardware.
• Flexibility and Scalability: Virtual interfaces provide flexibility and scalability, allowing administrators to adapt the network infrastructure to changing requirements without significant hardware changes.
• Use Cases: Useful in scenarios where there is a need to create multiple logical networks within a single physical network infrastructure. They are ideal for implementing advanced networking features, such as VLANs and VPN connections, to meet specific organizational or security requirements.

By leveraging virtual (assign) interfaces in pfSense, administrators can effectively extend and optimize their network infrastructure, implement advanced networking features, and meet the diverse connectivity needs of modern organizations.

Are there any special considerations for configuring wireless interfaces in pfSense?​

When configuring wireless interfaces in pfSense, there are some special considerations to keep in mind to ensure proper setup and functionality:

• Wireless Interface Configuration:
  • Configure the wireless interface settings, such as SSID, security mode, encryption, and channel, within the pfSense interface configuration.
• Ensure that the wireless interface is properly associated with the wireless network and has the necessary security settings configured.
• Bridge with LAN Interface:
  • Consider bridging the wireless interface with a LAN interface if devices on the wireless network need to communicate with devices on the LAN.
  • Bridge interfaces can facilitate seamless communication between wireless and wired devices on the same network segment.
• Firewall Rules:
  • Create firewall rules to control traffic flow to and from the wireless interface.
  • Apply appropriate security measures to protect the wireless network from unauthorized access.
• Wireless Security:
  • Implement strong security measures such as WPA2 or WPA3 encryption and strong passwords to secure the wireless network.
  • Regularly update the wireless interface settings and passwords to enhance security.
• Wireless Access Points:
  • Consider using dedicated wireless access points for better wireless coverage and performance.
  • Configure the wireless access points to work in conjunction with the pfSense firewall for seamless network connectivity.

By considering these points when configuring wireless interfaces in pfSense, administrators can ensure a secure and reliable wireless network setup that integrates seamlessly with the overall network infrastructure.

What Are Bridge Interfaces?​

Bridge interfaces in pfSense are used to connect two or more interfaces to form a single network segment. The purpose of bridge interfaces on pfSense are listed below:

• Bridge interfaces allow multiple interfaces to function as if they were a single interface.
• They combine the network segments of the connected interfaces into one logical segment.
• Traffic between the bridged interfaces is passed transparently without routing.
• They can be used to connect a LAN and a wireless network.
• Bridge interfaces facilitate the application of firewall rules to the combined network segment.

The main characteristics of bridge interfaces on pfSense are listed below::

• Traffic between the bridged interfaces is treated as if it is on the same network segment.
• Bridge interfaces are commonly used in scenarios where devices on different physical interfaces need to communicate as if they were on the same network.

By utilizing bridge interfaces in pfSense, administrators can create a unified network segment from multiple interfaces, allowing seamless communication between devices connected to different physical interfaces.

When Should Bridge Interfaces Be Utilized for Network Configuration in pfSense?​

Bridge interfaces in pfSense should be utilized for network configuration when there is a need to connect two or more interfaces together to form a single network segment.