Re: [pfSense] DNS configurazione under VPN

2018-05-13 Thread WebDawg
"In any case, if you configure your DNS Resolver to use the LAN interface as outgoing interface, the DNS Resolver should use the same routing than your computer, VPN or not." Can anyone confirm that this is true? I never tested it, but it would be nice to get a confirm. I had an issue, similar

[pfSense] Rebuilding confidence

2018-05-13 Thread Richard A. Relph
Hi, I’ve been using a SG-2440 for a couple of years now, but only as a well-maintained basic NAT router. I know I’m not using all the capabilities the box offers. I’m increasingly concerned about ‘infected’ IoT devices inside my firewall. I don’t have any specific concerns. But

Re: [pfSense] Rebuilding confidence

2018-05-13 Thread Eero Volotinen
Well. You should use VLANs to segment IoT devices into different network. Anyway... some commercial vendor might provide a bit better protection ;) You can replace you apple timemachine with unifi aps. https://www.ubnt.com/unifi/unifi-ap/ Eero On Sun, May 13, 2018 at 10:44 PM Richard A. Relph

Re: [pfSense] DNS configurazione under VPN

2018-05-13 Thread Chris L
> On May 13, 2018, at 11:39 AM, WebDawg wrote: > > "In any case, if you configure your DNS Resolver to use the LAN > interface as outgoing interface, the DNS Resolver should use the same > routing than your computer, VPN or not." > > Can anyone confirm that this is true? I

Re: [pfSense] Rebuilding confidence

2018-05-13 Thread ED Fochler
Richard, I agree with Eero, VLANs are real security. It will require time and effort and maybe some additional equipment. If it helps you sleep at night, it's worth it. You might start with just IP groupings and rules though. I have an admin network that only has a couple of

Re: [pfSense] Rebuilding confidence

2018-05-13 Thread C. R. Oldham
On 13 May 2018, at 15:48, Eero Volotinen wrote: You can replace you apple timemachine with unifi aps. https://www.ubnt.com/unifi/unifi-ap/ I second the recommendation of the UniFi access points. They are excellent. While I advocate strongly for pfSense, Ubiquiti also offers a "security

Re: [pfSense] Rebuilding confidence

2018-05-13 Thread Geoff Wolf
Have you looked at the capabilities of Suricata? It’s an open source IDS/IPS available in the pfSense package manager. It takes some setting up and rule adjustment to suppress false positives, but it’s fairly straightforward. There’s plenty of documentation available for it. I think this might