pfsense Archives

Home » pfsense

Best Pfsense hardware

Dave Farquhar Hardware, security March 13, 2017July 11, 2018Broadcom, intel, kingston, micron, pfsense, podcast

The best Pfsense hardware is rather subjective. I think the ideal Pfsense box should deliver solid performance while being affordable.

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.

dfarq.homeip.net

DD-WRT needs to be saved, but I won’t bet on it happening

Dave Farquhar DD-WRT, Servers and Networking October 5, 2015August 14, 2016classmate, FCC, pfsense, wi-fi

A college classmate asked me if there’s anything to the stories that DD-WRT might potentially get locked out due to new FCC regulations.

Unfortunately the answer is yes, there may be something to it.

Dave Farquhar

dfarq.homeip.net

How hard-coding your DNS can improve your security

Dave Farquhar security May 27, 2015August 29, 2018intel, malware, PCI Express, PCI-X, pcie, pfsense

I’ve long recommended hard-coding your DNS settings as a performance and reliability enhancement–here’s my guide for that–but it turns out it can be a security enhancement too.

Botnets targetting routers aren’t new at all, but there’s a particularly nasty one named Moose running around right now. Among other things, it changes routers’ DNS settings to point to rogue DNS servers that allow the attackers to steal your social media credentials, furthering the bot. Read more

Dave Farquhar

dfarq.homeip.net

The clear and present danger lurking at the edge of your home network

Dave Farquhar DD-WRT, Hardware, security, Servers and Networking August 11, 2014May 17, 2017pfsense

In 2003, Dan Geer called the combination of Microsoft’s market dominance and the flimsy security of its products a threat to national security.

Today, he’s calling the security holes in consumer routers a threat to critical infrastructure.

These two things are related in more ways than being utterances from the same person. These routers were designed to protect flimsy PCs from the horrors lurking on the Internet. In 2003, they were arguably adequate. But since 2003, Microsoft operating systems have improved dramatically from a security standpoint while routers have stood still. Many of them are still running on the same outdated Linux kernels and userspaces, just on newer, faster hardware. These routers are now less secure than the computers they are supposed to protect. This isn’t a knock on Linux; Linux has improved in the last 11 years too, but router makers generally haven’t incorporated those improvements. So these routers are easy to attack, easy to use to build botnets, and the user will never be the wiser since they keep the devices until they break. The only good news here is that many of them break after a year or two, and that’s supposed to be bad news.

Sadly, these problems are all solvable.

Dave Farquhar

dfarq.homeip.net

Rick Broida thinks he doesn’t use antivirus software

Dave Farquhar security June 30, 2014June 28, 2014antivirus, malware, McAfee, pfsense, symantec

C’mon. You knew I’d get around to writing a response to Rick Broida’s claim that he doesn’t use antivirus software.

Actually, he’s not nuts. But he’s also mistaken if he thinks he doesn’t use antivirus software. His editorial is kind of like saying, “I don’t use a web browser. I use Internet Explorer.”

Although he’s mistaken that he doesn’t use antivirus software, and not all of his advice is spot-on, you can do a lot worse than follow his advice.

Dave Farquhar

dfarq.homeip.net

Firefox memory high? It might be Adblock Plus

Dave Farquhar Uncategorized May 26, 2014May 21, 2014firefox, pfsense

Last week, a great deal of discussion about ad blocking and its effect on memory usage took place. This makes a lot of sense, and explains why my memory usage has always been really high.

I’m not sure there’s a lot you can do about it. One of these days I’m going to get around to standing up a pfsense box, which, among other things, can serve as a web cache and block ads for an entire network. My family has enough machines to justify that, and, given that security is what I do for a living, it’s something I need to be experimenting with anyway.

Dave Farquhar

dfarq.homeip.net

The world’s fastest budget PC

Dave Farquhar Hardware February 25, 2014February 23, 2014Broadcom, christmas, compaq, firewall, hp, intel, Libre Office, Micro Center, new hardware, office 2010, PCI Express, pcie, pentium d, pfsense, SUBSYSTEM, windows 7, Windows XP

So, a relative’s PC was getting a bit aged, and runs Windows XP, barely, so I talked them into an upgrade. I noticed that Micro Center had HP/Compaq DC5700s for $99. They were standard issue office PCs a few years ago, and there are a lot of them in the refurb channel. We went and got one over the weekend.

“What are you going to do with that?” the sales rep asked. “We only use them as cash registers.”

“Word processing,” I said.

“You sure you want to run Windows 7 on an 8-year-old PC?”

“I wrote the book on running Windows on older PCs. Literally. It’ll be fine.”

I hate calling rank like that, but sometimes it’s what you have to do.

And really, for $99, it’s awfully good. Web browsing is plenty fast, Libre Office runs fine on it, and think about it. Windows 7 retails for $100-$109. So it’s like getting the hardware for free. Or Windows for free, however you want to look at it.

Dave Farquhar

dfarq.homeip.net

More about Pfsense, the alternative to the crappy consumer router

Dave Farquhar security February 24, 2014July 11, 2018android, antivirus, AV, DEC, firewall, freebsd, hp, Image File, linksys, netgear, PCI Express, pfsense, tinkerer, tp link, vulnerability, x86

I spent some time over the weekend playing with Pfsense, and I can’t say much about it other than it does what it says. I didn’t throw a ton of hardware at it–the best motherboard I have laying around is a late P4-era Celeron board, and the best network card I could find was, believe it or not, an ancient Netgear 10/100 card with the late, lamented DEC Tulip chipset on it. Great card for its time, but, yeah, nice 100-megabit throughput, hipster.

If you actually configure your routers rather than just plugging them in, you can do this. Plug in a couple of network cards, plug in a hard drive that you don’t mind getting overwritten, download Pfsense, write the image file to a USB stick, boot off the USB stick, and follow the prompts. Then, to add wireless, plug in a well-supported card like a TP-Link and follow the howto. Read more

Dave Farquhar

dfarq.homeip.net

Consumer routers are the security vulnerability of the year, so far

Dave Farquhar security, Servers and Networking February 21, 2014February 20, 2014AT&T, firewall, intel, pc world, PCI Express, pfsense, vulnerability, Windows XP

Today I found an article in PC World that gives a somber assessment of the state of consumer routers, like the device that probably sits between you and the Internet.

I’m glad this is getting attention. There’s a lot more to it than what’s in the PC World article, but I’ve droned enough about what’s bad about consumer routers. It’s bad now, and it’s going to get worse before it gets better. Kudos to PC World for providing a bit of an action plan.

What if you want to go beyond what PC World is talking about? I’m glad both of you asked. Read more

Dave Farquhar

dfarq.homeip.net

Home network projects for a budding sysadmin

Dave Farquhar Servers and Networking February 13, 2013July 4, 2018cisco, pfsense, windows 7, Windows Server

A very good question came in as a comment to my earlier post, the benefits of practicing IT at home. What do I mean by putting some Windows 7 machines on a domain? It’s one of several good home network projects.

I mean standing up a server with centralized user accounts and shares, running on Windows Server or Samba, whichever you can afford. Make it a print server too, and print from it, just like you would from an office. Then extend it, and extend your sysadmin skills. Here are several ideas for projects of varying length, difficulty, and expense.

Dave Farquhar

dfarq.homeip.net