Netgate 4200
This page assumes you already know your way around PfSense. If you are new to PfSense, please reference PfSense's online documentation: https://docs.netgate.com/pfsense/en/latest/
Markey's Stock Config Features
Here is a broad overview of settings and configurations that are applied in our stock config.
Interfaces
Port 1 - WAN 1
Port 1 is configured as the primary WAN port and consumes DHCP. If you need to set static WAN information, first go to System > Routing -> Gateways to configure your static gateway, then go to Interfaces -> PORT1WAN to configure your interface IP and gateway.
Port 2 - WAN 2
Port 2 is the failover WAN port and also consumes DHCP. It is possible to bond the two WAN ports together for aggregated throughput, but we have opted not to do this so that the network setup is as "normal" as possible as much as possible.
Port 3 - LAN
Port 3 is the primary LAN port for the main event network. It is configured at 10.3.0.1/22 and serves DHCP.
Port 4 - Management
Port 3 is intended to be a "rescue" interface, a backup way to get into the gateway in the event that Port 3 is somehow misconfigured. Port 4 is configured at 192.168.1.1/24. This port does not serve DHCP, as the DHCP server could easily be the thing that broke the main LAN. You will need to configure your device with another static IP in this subnet in order to access the gateway via this interface. Also note that this port will not grant internet access; firewall rules only allow management traffic (HTTPS from 192.168.1.1/24 to 192.168.1.1).
The console port is unused.
Access
As indicated on the login screen, you can find login information in Bitwarden or on a card that comes in the case with the unit.
Services
DHCP
Our Netgate is configured to serve DHCP for the primary LAN. The LAN network is 10.3.0.0/22, so host IPs can range from 10.3.0.1 to 10.3.3.254. The DHCP server in PfSense is configured only to serve IPs from 10.3.1.0 to 10.3.3.254, leaving 10.3.0.2 to 10.3.0.254 available for static hosts.
Remember that 10.3.0.3 through 10.3.0.10 are used by Gather Live server clusters. It is recommended not to use these IPs.
DNS
DNS is configured in a two-tier setup. A local DNS server answers queries for internal hosts; records are added automatically to match DHCP leases. The internal domain is lan.markeys.net.
Perhaps at some point in the future, we standardize lan.markeys.net and start creating real certificates for some of our internal-use devices.
There are two upstream public DNS servers configured. PfSense will send queries to both and gradually build a reputation for each over time, preferring the more performant one. Both upstream DNS servers are configured to use DoT in order to prevent MITM DNS. Both WAN interfaces are configured to ignore DNS servers provided by any DHCP lease and will use the two statically configured DoT servers instead.
The two DoT servers are Cloudflare Security and Quad9, both with malware blocking features.
NAT rules are configured to redirect any plain DNS queries from LAN to PfSense transparently. No unsecured DNS queries ever exit the WAN interface.
Any queries for FQDNs under services.speakerreadyroom.co are forwarded to 10.3.0.10, the VIP for a Gather Live server cluster.
NTP
PfSense is configured to respond to NTP requests, and NAT rules redirect any outgoing NTP requests to PfSense. This helps to keep all LAN hosts consistent.