Part 2 Pfsense Router setup
In this design, the pfSense router will perform 4 different functions.
Provide the dhcp addresses to the clients on the deployment network [192.168.23.0/24]
Provide the necessary dhcp boot options to pxe boot the clients on the deployment network
Act as a normal router to route traffic between the subnets
Act as a IGMP route (via its built in IGMP Proxy server). The IGMP server will listen on its defined upstream interface [LAN] for any defined multicast streams and rebroadcast the stream on any of the defined downstream interfaces [WAN]. Please note I’m only using the concepts of LAN and WAN as interface names. I could have just as easily used em0 and em1, but inside pfSense they reference the logical names of LAN and WAN exclusively. To avoid confusion I’ll continue to use those labels through this document, just understand the are label and not based on functional intent.
I’m not going to go through the setup of the pfSense router since there are many fine examples of setting up pfSense as a basic router. I will go through the settings I changed to configure the igmp proxy setting.
In the graphic above I configured the pfSense router’s
Set the LAN interface address to 192.168.50.250/24
Set the WAN interface address to 192.168.23.1/24
Configured the dhcp server on the WAN interface to issue IP addresses from 192.168.23.10 to 192.168.23.250.
For the imaging network, the default route points to the pfSense WAN interface of 192.168.23.1
Configured the netboot section of the WAN’s dhcp server to send out the {next-server} of 192.168.50.100 with a bios {boot-file} of undionly,kpxe, ia32 uefi boot file of i386/ipxe.efi, and ipxe.efi for the x64 uefi boot file.
In pfSense Advanced Configuration I disabled all firewall rules. In this setup I want pfSense to act as a normal unrestricted router and not as a screening or firewall appliance.
You will need to go into the firewall rules and add one rule to each interface (LAN and WAN) that is an allow all to any
WAN rule
LAN rule
With the static route configured on your FOG server and the pfSense router now setup on the network, you should be able to ping the deployment network’s router interface [WAN] from the fog server. If you can’t then something is setup incorrectly on the iP router side. Don’t proceed until you have basic IP routing working correctly.
