Building a gateway firewall

I spoke to the ISP and they said that they will come in and configure that mode so that it can be available on the modem

This week I will be getting the bridge mode setup so I will be able to sort out the firewall/ gateway. Let me ask, can PFsense act as a router where I can apply NAT on the external interface for multiple private addresses?

pfsene was built for this type of work.

OK great

So I'm about to get the modem bridge. The ISP is waiting on me to have it done. I'm asking for some assistance with getting the network setup. I have 3 interfaces. One interface is connected from pfsense to the modem (WAN), another one is connected from pfsense to the switch (LAN) using the subnet 192.168.100.0/24 and the other is connected to WAP using the subnet 172.16.0.0/12. How do I setup the configuration with the necessary routing and firewall rules to have everything up and running. Also, can I manually select an interface that I want to act as the WAN or LAN in pfsense.

Thanks for your assistance.

I'm using VMware, so do I need to to add three virtual interfaces and bridge each individual interface?

i have build my linux routers following these instructions :

https://arstechnica.com/gadgets/2016...ur-own-router/
https://arstechnica.com/gadgets/2016...-from-scratch/

I have limited experience with VMware but here is an article from the Pfsense people.

https://www.netgate.com/docs/pfsense...here-esxi.html

Installing a DHCP server

Now that I have talked about how you can avoid DHCP conflicts, let's talk about how to install and configure a Windows Server 2003 based DHCP server. Before I get started, I should mention that the server itself must be configured to use a static IP address.

Begin the process by selecting the Add / Remove Programs option in the Control Panel. When the Add / Remove Programs dialog box opens, click the Add / Remove Windows Components button. After a brief delay, Windows will open the Windows Components Wizard. Scroll through the list of available components until you find the Networking Services option.

Select Networking Services and then click the Details button. You will now see a list of the various Windows network services. Select the check box next to Dynamic Host Configuration Protocol and click OK, followed by Next. Windows will now begin to copy the necessary files. During this operation, you may be prompted to insert your Windows Server installation CD. When the file copy operation completes, click Finish to close the wizard.

Configuring a DHCP server

The process of configuring the DHCP services is almost as simple as the installation was. Before you begin the configuration process though, you will need to come up with at least one scope. Remember that a scope is a range of IP addresses that the DHCP server can lease to clients.

Begin by opening the DHCP console. You can access the DHCP console by selecting the DHCP command from the server's Administrative Tools menu. When the console opens, the first thing that you will want to do is to create a new scope.

To do so, right click on your server and select the New Scope command from the resulting shortcut menu. This will cause Windows to launch the New Scope wizard. Click Next to bypass the wizard's Welcome screen and you will be prompted to enter a name and a description for the scope. After doing so, click Next and you will see a screen prompting you to enter the beginning and ending addresses of the scope range. After doing so, you must also enter the subnet mask to be used by the addresses (or the number of bits to use for a subnet) before clicking next.

The next screen gives you a chance to enter any necessary exclusions. Exclusions are addresses within the scope that are already in use. Entering an exclusion address prevents the DHCP server from leasing that address. Enter any exclusions that you might have and click Next. You will now be prompted to enter a lease duration. The lease duration is the length of time that a workstation can use an IP address before having to either give the address up or renew it. The default lease period is eight days, which works fine in most cases.

Click Next and you will see a screen asking if you want to configure extra DHCP options. Select the Yes option and click Next. You are now given the opportunity to enter the address for a default gateway. Click Next and you are presented with a screen that allows you to enter the IP address of one or more DNS servers. Click next one more time and you will be allowed to enter the addresses of any WINS servers that may exist on your network (newer networks do not usually use WINS servers). Click Next once more and you will be asked whether or not you wish to activate the scope. Select the yes option and click Next followed by Finish.

Although the newly created scope has been activated it won't be used just yet because the DHCP server has not been authorized to issue addresses for your network. To solve this situation, right click on the server's listing within the DHCP console and select the Authorize command from the shortcut menu. Assuming that you are logged in as a domain administrator, the server will be authorized to start servicing requests.

thank you @minakshisondule

I'm having a challenge trying to get the modem bridge. Two weeks ago, the ISP technician and I tried to bridge the modem but pfsense was not able to pick up the external/ WAN IP address. I'm not able to get a block of WAN IP addresses so PPPoe has to be used to assign it statically on the modem and then pfsense external interface on my device so pick it up but when it tried it came up empty. What could be the issue on my end that could be preventing the internal from getting the IP information. The interfaces are connected properly.Can a static WAN IP be assigned to the interface? When we tried the static IP, it wasn't allowing it because the subnet mask was from (1-31) and I only have one IP address.

Thanks for your assistance.

correction, the subnet mask is from 1-32

really good idea

You really don't need 'bridge mode' to make this work.
You can do NAT just the same from your WAN side interface (with a private IP) to the internal one.
The only downside is exporting internal services to the public IP needs port forwarding on both the modem/router and the NAT box.

I didn't get that bridged mode either. There may be ways around it. Some programs may complain about double natting but they seem to work for me.

PFsense and others are well regarded. Consider looking at Untangle too.

@descendant_command
How would I do that. Would you be able to give me the steps? I want to consider it. I really prefer bridge mode.

@Jefro
Thanks for your reply but I really want to use Pfsense.

On another note, my ISP technician and I tried to bridge the modem using a static WAN IP address that is assigned to the modem as well as the upstream address. I setup all of the configuration necessary to have pfsense up and running but when I looked at status> gateway, it is showing Gateway Offline. I changed the internet to bridge mode on the modem and pfsense was still showing Gateway Offline.

Can anyone say what they think is the problem? I'm not able to get more than one Public IP addresses, hence, static WAN was chosen. Should I try to use PPPoe instead of static? Can the static IP work without using PPPoe? The mask that was used was /32

I would really use your help.
Thanks