pfSense 2.4 - Enabling SSH Access

Key Takeaways

hey guys welcome back to the pfcent series in this video we're going to be taking a look at how to set up ssh on your pfsense router or your psense router and firewall configuration all right so uh before we actually continue with this series i just want to update you guys on my perspective and the way i'll be looking at things especially when talking about pfsense uh on both sides so for now when talking about configuring your router and firewall i'll be looking at it from a systems or network administrator position or role all right so i'll be trying to configure it for security and then when that is done i'll be showing you how to set up machines or virtual machines inside a vlan and then how to perform penetration testing and how you can perform lateral movement all that good stuff but for now for the purpose of this v of this series of videos uh in regards to pf sense i'm going to be looking at it as a systems or network administrator all right now that i've essentially explained my perspective in this particular set of videos we can get started so why would you need to enable ssh access on your router or your firewall well that may seem like a really really obvious question is that you might want to access it on your computer because remember you may have a network room where you have all your servers and that's primarily where you'll have your router and firewall configuration in the form of a computer with its own panel but you can imagine working on your own desk and you want to access the firewall really quickly uh you would need to do that via ssh of course you can do it through the web gui configuration panel but again this is only a sort of a passive access onto the actual control or the core control of the firewall and the router all right so it's really important to understand how to do that now the other reason is that if you do or are considering uh setting up ssh to work on your one meaning you can access uh the firewall or router uh from an external network or from home or remotely really that's what i was what i was getting to so setting up ssh access to access the firewall or router remotely so you could be home you could have left work and you want to access the router we'll also show you how to do that right now so those those are very very good reasons uh for essentially enabling ssh access on your route and firewall so i'm going to be showing you how to do that as securely as possible now i'm currently logged on to the web gui and i still have the same configuration as the previous video and i showed you how to install pfsense so the first thing you need to do is you need to go into your system and you need to go into your advanced settings all right before we actually touch any users now i'll be covering the advanced menu but for now let's just stick with what we are doing you want to scroll all the way down to secure shell and you want to enable uh enable secure shell and as for your authentication you want to select whether you want to use a public key or you want to use a password or public key in my case i'm going to say a password or public key or what you can do is just simply use a public key only all right and for the port this is very important if you are configuring it to to be accessed through the one then changing the port is very important because that is a pole that is going to be really really targeted and of course if you are on your local network then again you might want to set this up and when when talking about firewall rules also i'll show you how to prevent uh particular nmap scans from actually determining what ports are running on the router but for now we'll just leave it as the default on port 22. and once that's done because we've selected our authentication to work with a public key only what we can do as well is we can also enable password or public key but for now and let's use the publicly the public key only so you need to generate your your two pairs your private key and your public key and of course you can do that on windows and on linux on windows you can do it on you can use you can do it with putty and on linux you can use your ussh key generator to do so all right so i'm going to save this and apologies if the router takes a while to load i haven't actually optimized it yet so don't worry about that i'll just wait for this to load up shouldn't take a lot of time now all right the settings have successfully been applied and now we need to go into system and you want to go into your user manager this is where we will be essentially providing our public key so let us talk about generating your ssh keys which i'm sure many of you already know to do so the first thing we need to do is we need to use putty we need to use puttygen if you're on windows if you're on a linux you can simply use the ssh generation or the ssh keygen and they'll essentially generate your keys for you and you'll be able to log in the only thing you need to do is you need to you need to actually save the public key so i'm just going to generate here and again we're just going to rotate around the screen here and just give it a bit of randomness here so that it can generate our key for us and once it's done we should be good all right so this is your public key here and we want to save the private key because uh yes we actually i'm gonna provide a passphrase before i do that so provide a passphrase here like so and i'm going to save the private key and i'll just save it on my desktop here and i'll just call it uh pf sense all right and i'm just going to hit save and that's done all right now i'll copy the public key here onto my clipboard and i'll edit my admin user now if you want to create any users here you can do it from this page if you want to also separate access or roles you can do that from your groups and take a look at your settings this is something i'll be covering later on but hopefully you'll get an idea of what's going on so if i wanted to create another user uh who had sys admin uh privileges if you go to groups right over here you can go ahead and take a look at the at the role so the group name is admins and of course the description is the fact that this group is only for system administrators so you can get a good idea of the rules here what i'm going to do is i'm just going to hit on the little pen or pencil here and you can from this page you can edit the settings in regards to the user's access etc so the password here i'm just going to specify the password right over there so because i know it will prompt me to to actually confirm the password if i'm making any changes you want to go down to keys and paste in the public key right over here all right and once that is done we can just hit save i'm just going to give that a few seconds right over here and once that is done uh this user should have the public keys ready to go so that when we load the private key with putty uh we can actually access it we can have ssh access all right so there we are it's uh the settings seem to have changed uh now we can go on to our desktop here and we can load the pf sense key with pageant right over here which is part of the putty suite so i'm just going to load it up here it's going to ask me for my passphrase i'm going to hit ok and now we can open up a new putty session here and i'm going to type in the ip address for my router and firewall configuration which is 192.168.1.1 let me just increase the the font size here so that we can actually see what's going on and there we are so i'm going to open and uh just like that it is going to prompt us to log in apologies for the speed again uh there might be a few connection issues that i still have to optimize or it's going to prompt you to log in as and you're going to provide the username as it is on the putty ui configuration i'm going to hit enter and there you are so we are authenticated uh via ssh to the firewall um and router so this is the screen if you have watched my installation video this is the console screen and it's really awesome that you can have access to the screen via ssh because you can essentially control it even if the server room is miles away or you know if you're in another country you can essentially manage the company's infrastructure remotely all right so you can see that these are the settings that i had when i had set up the router so we have one which is getting its ip from my primary router which is outside my room or my office and then we have the lan access here which is provided on the local ip1 and the appropriate subnet which is 192.168.1.1 uh so these are the up the other options that you can interact with on the console again these are all things that we'll be taking a look at so you can reboot the system you can hold the system you can bring a host you can access the shell you can restart the web configurator you can uh update from console you can disable ssh as well and you can also you can of course reconfigure the interfaces right over here and you can essentially control the entire uh the the entire firewall in our router configuration all right so that is how to configure ssh on your pf sense installation i hope that made sense if you have any questions in regards to the video please leave them in the comment section if you want to support the channel you can do so by uh supporting us on patreon we really appreciate all the support you've given us and i'll be seeing you in the next video peace [Music]