Thank you Ruby I really appreciate the kind feedback. Whenever I make these types of guides I really try to remember a younger me just getting into the tech space working for an ISP and wanting someone to teach me in a similar manner. Not being condescending or speak to me as if I was there helping create the firewall/router/switch and know everything about it. As long as these guides help ease at least one person into the sometimes complex world of networking then I am extremely happy!

I agree they don't take in to account some of us are novices at this type of thing.

I bought a Netgate SG-1100 and didn't know what vlans, tcp/udp or any of it meant years ago. Now I feel confident I won't get locked out of the web interface with your thorough breakdown and helping me understand everything. Thank you sir. You have earned yourself a sub here. Cheers🎉

Thank you for the nice comment I really appreciate it very much!

Thank you for subscribing I really appreciate it

Glad it was helpful!

You're very welcome!

Glad you enjoyed it!

Thank you for watching ^^!

Glad you liked it!

Thanks!

Can you drop some light, about the setup that it act as a bridge instead of L3, or advise with an article which is worth spending time on?

@@makeitcloudy Hello, I just want to be clear. What I am referring to is not really like a switch. But kind of in a way... Though note you shouldn't use pfsense as a bridge as it is not designed for that work load and neither are the NICs that are most likely in your pfsense box. You want a switch doesn't really matter what kind it's just they are far better at well actual switching and forwarding traffic. Now, if you want to learn about what I am doing you can do that by watching this Lawerence Systems video Bridge with suricate testing.

@@blindside995 thank you, I was watching Lawrence, he was my inspirations for freenas, syncthing and pfsense, before I realized network Berg exist :) cheers!

Thank you for suggestion, sorry about distracting you. Sometimes I turn off the mouse pointer in my newer videos. I think at times I just move the mouse around as a pointer to showcase things but at a hyper ADHD level.

A slow webconfigurator sounds more like a resource issue, are you running the software on a VM or Hardware? I would highly suggest posting about it on the pfSense forums with your specs to see if someone from Netgate might be able to help out.

Thank you for your kind words, I chose single host as I was going to allow traffic just to the IP of the server in the DMZ. The object DMZ address relates to the IP of the DMZ interface of the FW which is not what I wanted to allow. The other object DMZ net relates to the entire subnet, which is also not a good fit for the policy I wanted to implement. Hmmmm I think the most similar videos I have on the subject for MT is what I covered in my MTCNA course here: 📗MikroTik MTCNA - Firewall Principles (Forward,Input,Output) kzfaq.info/get/bejne/hL6me8eLx6fZhH0.html 📗 MikroTik MTCNA - Firewall Fasttrack, Mangle Rules & Address Lists kzfaq.info/get/bejne/qcCqqcmqy6nYh4k.html There is also this video from my live stream, but it is quite lengty: 💻 Taking a look at RouterOS/MikroTik Firewall in EVE-NG Live Lab: Filters, NAT, Mangles etc! kzfaq.info/get/bejne/sKdmlc6Yl7HWmnk.html

Ironically I did remember setting up firewalls more than 20 years requiring a lot of rules and the first time I setup pfsense (very recently) I was confused because it is too simple now 😅

Package reinstall process was ABORTED due to lack of internet connectivity @ 2024-04-03 21:48:08

Sure, I could take a look at OPNsense as well and do some comparisons ^^

It's called Aliases in pfSense

Hi Anthon, I think the statement "With extensive scripting" already summarizes why a SOHO or Medium sized business should rather opt for something like a pfSense firewall as opposed to having the MikroTik doing the firewalling. Scripting in itself can be pretty complex and even if you are just importing scripts from some vendor you are probably going to be paying them for those services, which they do on their own platforms which is most likely just another firewall. If you are going to do your own scripting that also means you are going to have to learn the scripting language or find someone that understands it. It's definitely not the hardest scripting language in the world, but it's still a niche skillset. Very useful, but in the sense of business if I suddenly lost a person that performed all the scripting and that skillset gets lost then I think the business could face some serious trouble. Especially after some software upgrade on ROS that creates some or other bug on a script that you are using. So for ease of use I think pfSense is a much better firewall, although I still think MikroTik is a superior router :D!

@@TheNetworkBerg Thanks for the quick reply - we have several staff quite comfortable with Mikrotik scripting and have about two decades worth of Mikrotik experience so we know them really well. The question for me here is whether we should look at PFSense as a replacement (or addition) for a skillset we already have given that we have no issue with Mikrotik where it stands at present. We supply a service to business in this regard. Your knowledge of Mikrotik and now PFSense makes your opinion matter hense the reason I asked and might save some time playing with something and then realize its not needed. So I guess the real question to ask is then why would you choose PFSense over Mikrotik if skills are not an issue.

@@anthonwalters3706 Valid, but still a tough question to be honnest. I could say and summarize it this way, that if you can afford the effort of scripting by your own, and you are in such comfortable situation that the tests can be performed outside of production, then why not performing all the logic within your scripts, especially when you are sure about the people standing behind the whole logic. The thing is that the code itself, does not scale well if it is not designed properly. Keeping the IaC (Infrastructure as Code) in mind, the real question is about combining the scripts with the processes or other API's which can talk with your functionality. I still can not compare all the plugins available in pfsense, and whether those has the integration with the particular usecase you have in your head for the business case of your's, that's why this question can be probably answered by you only. Unless I'm completelly wrong. Cheers

Most people tend to drop ICMP to the wan IP, though you could tweak rules to allow monitoring from a specific source to that you could see if the link ever goes down but no one else would even know the IP was live

Implicit Deny Rule

Not a strange question at all Dennis, there's a few configurations you can run using both a RB3011 and a Netgate firewall. I would prefer putting the RB on the WAN edge and having it be responsible for connections and such where you could leverage the firewall features of the Netgate behind the MikroTik to monitor and restrict access to your internal networks a bit more effectively.

@@TheNetworkBerg That is the answer I was looking for. I have 20 VLANS setup on my 3011 with the last 10 devoted to 10 computers forr all the grandkids and neighberhood kids to utlize them for gaming. I need to get more granular control on the kids use of the internet. Another goal is VLAN internet connection blocking. sould this be acomplished on the Netgate or the 3011? I have a symentrical 1Gb x 1Gb internet connection. All the other Vlans are used for Plex, Unraid, Windows Server 2022, and Wireless networks.

This video was aimed at how to configure firewall policies, I suggest looking at your logs and creating policies to specifically drop the torrent traffic you are seeing on either their protocols and/or destinations

Sorry if the mouse pointer was distracting for you, and thank you for your feedback :)

Lots of context to cover :)