daemonhorn

PfSense Air-gapped configuration

In certain environments, it is useful to have a router and firewall between two private vlans. When the WAN interface of PfSense is not able to access the internet (e.g. DNS Resolution, Update Checks, etc.) it can become sluggish to boot and configure. This guide attempts to capture configuration knobs that can improve the usability in these environments, and was written with PfSense CE 2.7.2 configuration as a baseline.

TODO

Finish Documentation
tcpdump -nn -i XXX pfsense at steady state air-gapped {for em0 (WAN), em1 (LAN), lo0 (loopback)} Loopback will show you all of the items that would have being queried via root.hints or other pfsense internals. Start with udp port 53 capture filter to look for DNS traffic.
tcpdump pfsense at boot with WAN interface to look for extra ntp, dns, http, tls packets

Install

Installation from the PfSense CE ISO file can easily be done in these environments. Download the ISO from mirror (to avoid creatin

Cloudflare WARP tunnel via Wireguard client

This example provides a simple configuration for a Debian client to have a Cloudflare tunnel while not installing the official Cloudflare WARP client. Note: Tunnel transport outbound to engage.cloudlflare.com on udp/2408 is default, with a dynamic listening udp port and a fwmark for packet matching by wireguard. Any applicable firewall rules may need to be adjusted.

Top-level GitHub project to convert cloudflare endpoint to generic wireguard configuration file: https://github.com/ViRb3/wgcf

Install dependancies

sudo apt install openresolv wireguard-tools golang git

Get the latest client from Github and build using go

git clone https://github.com/ViRb3/wgcf.git

Intro

This Quickstart receipe for Qemu assumes a recent FreeBSD release (stable/13 or newer), and provides an example configuration for running arm64 (aarch64) FreeBSD guest on an amd64 FreeBSD Host. Concepts can be applied to other architectures as desired, but syntax and capabilities will vary.

Dependancies
Getting Started
Example Qemu guest startup script

Dependancies

Install qemu pkg install qemu or pkg instal qemu-nox11. Latest pre-built package release as of this writeup is 8.1.0
Sufficient disk space (50+GB) on a mounted FreeBSD Host disk (e.g.: /qemu-data in this example)

FreeBSD Ports

Some random FreeBSD Ports information for future me

See https://cgit.freebsd.org/ports/about/ as well
See Freshports https://www.freshports.org/ for searchable interface
See FreeBSD Porters handbook: https://docs.freebsd.org/en/books/porters-handbook/testing/

Git Repo

Get latest ports source:

Using git git clone https://git.freebsd.org/ports.git
Direct download (zip for arch without pkg repos) fetch https://github.com/freebsd/freebsd-ports/archive/refs/heads/main.zip

Configuration file: `/etc/make.conf`

Socks5 proxy using Microsocks and Stunnel on FreeBSD

Configuration information for the Microsocks package on FreeBSD as the existing documentation does not give sufficient details to create a secure configuration flexible enough to use for various use cases. See https://github.com/rofl0r/microsocks for the latest source code and wiki documentation. Note: The user authentication method supported by Microsocks is only plaintext, and is not protected by any layer of encryption. Please be hyper aware and use other layers of protection to secure your socks5 endpoint. (Firewall + TLS encryption with client authentication using something like stunnel).

If you want an easy way of doing this, just look at ssh -D localhost:1080 <user@host> instead since SSH provides a native Socks5 tunnel with encryption.
You can also use stunnel in socks5 protocol mode without Microsocks since it has native support for protocol = socks. See stunnel documentation here: https://www.stunnel.org/static/stunnel

Create specific folder for certs and allow user to have permission based on group

mkdir /etc/nginx/certs
chmod 770 /etc/nginx/certs
chown root:www-data /etc/nginx/certs
groupmod -a www-data -U dhorn

Upgrade Unifi and MongoDB including Remove configuration and database for clean upgrade/restore

Important: Download your unifi controller backup using an admin webui account FIRST! e.g: https://unifi:8443/manage/default/settings/system/backups

Stop and delete the old configuration and db (only after backup)

Overview

I want to forget about differences between my Linux machines (running bash), and my BSD machines (running tcsh), and have user-friendly cli experience. The knobs below will cause bash/readline/less to behave more like tcsh defaults.

Searching through history with filters

echo '"\e[B": history-search-forward' >>~/.inputrc
echo '"\e[A": history-search-backward' >>~/.inputrc

Pager re-init and thus manpages causing screen to clear on quit

	# Place this file in our $profile location and restart powershell.
	# e.g.: copy Downloads\example.ps1 $profile
	# $profile defaults to $HOME\Documents\PowerShell\Microsoft.PowerShell_profile.ps1
	# aka: c:\Users\username\Documents\PowerShell\Microsoft.PowerShell_profile.ps1
	# If you want to sign it see function `user-sign-psscript` below for signing
	# This enables the use of:
	# set-executionPolicy -ExecutionPolicy AllSigned -Scope CurrentUser
	# Or if you don't care about security on Powershell locally, you can ignore local signing, and just use:
	# set-executionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

	import network
	import time
	from soldered_inkplate10 import Inkplate

	ssid = "My_SSID"
	password = "My_Pass"

	# Function which connects to WiFi
	# More info here: https://docs.micropython.org/en/latest/esp8266/tutorial/network_basics.html
	def do_connect():

	<!-- See https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file -->
	<Configuration>
	<VGpu>Disable</VGpu>
	<Networking>Enable</Networking>
	<MemoryInMB>5096</MemoryInMB>
	<ClipboardRedirection>Enable</ClipboardRedirection>
	<PrinterRedirection>False</PrinterRedirection>
	<ProtectedClient>False</ProtectedClient>
	<VideoInput>False</VideoInput>
	<AudioInput>False</AudioInput>