Using pfSense with LayerOne

Tutorial · 8 min read

A LayerOne virtual network is an isolated L2 LAN. pfSense (or OPNsense, or VyOS) is how you put a WAN in front of it. NAT, DHCP, and VPN run in the guest. The platform does not SNAT the VNet and does not route between two VNets on the same firewall.

Plan and image

no.appliance is the Network Optimized plan intended for a lightweight firewall. Choose a larger plan if you need more memory, storage, or inspection capacity. pfSense and OPNsense typically boot from a custom ISO; contact support if the image you need is not available. Keep public IPv4 on for the firewall itself.

Create the VNets first

Under Network → Private networks, create each LAN you want the firewall to terminate. Example:

• VNet A 10.10.0.0/24 (LAN)
• VNet B 10.20.0.0/24 (OPT1)

Leave each gateway blank until the firewall NICs exist. An account can create 10 VNets by default.

NICs: WAN, LAN, OPT

On a dual- or triple-homed firewall the usual mapping is:

• WAN (net0): the dedicated public IPv4. This is the only NIC with an internet path from LayerOne.
• LAN: VNet A. Assign a host address such as 10.10.0.1.
• OPT1: VNet B. Assign 10.20.0.1. Add more OPT interfaces the same way for more VNets.

Your firewall may connect to multiple private networks. After connecting it, set each network's gateway to the firewall address on that LAN so automatically configured servers use pfSense as their route. Reboot servers after changing their network or address configuration.

Inside pfSense

Assign WAN to the public adapter, LAN to VNet A, and OPT1 to VNet B. Give each private interface the same address you selected when connecting the firewall to that network. Set the interface MTU to 1450 on every private-network adapter.

Enable the NAT, DHCP, VPN, and forwarding rules you need inside pfSense. Servers on one private network can already communicate with each other. Traffic reaches another private network or the internet only when your firewall explicitly forwards it.

Choose static addressing or DHCP

For Linux and BSD servers that need fixed LAN addresses, leave automatic IP assignment on and set the private network gateway to the pfSense LAN or OPT address. For servers that should receive an address from pfSense DHCP, turn automatic assignment off before connecting them. LayerOne does not provide DHCP on private networks.

Configure WAN, LAN, and OPT inside the pfSense interface. When you connect the firewall to a private network, choose the address that pfSense will use on that interface.

Private-only workloads behind the firewall

Application and database servers can deploy without a public IP and connect only to a private network. Reach them through pfSense, another server on the same network, or the browser console. LayerOne does not provide NAT for them, and public IPv4 cannot be added after deployment.

OPNsense and VyOS

The same NIC layout applies. OPNsense: WAN / LAN / OPT, MTU 1450 on the VNet adapters, NAT and DHCP in the guest. VyOS: assign eth0 as the public WAN and later Ethernet interfaces to each VNet, then set interfaces ethernet … mtu 1450 and your own NAT or routing. LayerOne still does not route between VNets.

Related

• Why configure a virtual network
• How to set up a virtual network
• Docs: firewall appliances
• Pricing (Network Optimized, including no.appliance)