building pFsense on an old Watchguard Firebox. ( Lets see if I can do it)

[twin--turbo]

Background.

 

With relation to this thread

http://www.edugeek.net/forums/wired-networks/104166-using-smoothwall-express-cisco-layer-3-switch.html

 

And a tip off from "cpjitservices"

 

I built a Virtual machine to test captive portal for our BYOD project.

 

That worked realy well, however whilst stumbling round the net i came across reference to using pFsense on a Watchguard Firebox....

 

Fortunatly we had 2 X5500e-Peak and an SSL500 (which is more or less the same platform with different software). These were redundant and taking up space in a pile of stuff behind my desk, so finding a decent use for them was a bonus.

 

So I am going to try the build and documnet my success/failure for you.

 

There is quite a lot of info on the subject

http://forum.pfsense.org/index.php/topic,20095.0.html

http://forum.pfsense.org/index.php/topic,25011.0.html

Firebox X500 hardware

 

and two guides that I am referencing.

Installing pfSense on a Watchguard Firebox X

PracticalKungFu.net » >How to install pfsense 2.0 on a Watchguard x750e Core

 

Various WG Fireboxes can be picked up and some for under £100 so they can hopefully make cracking reclaimed firewall.

 

Rob

Edited November 20, 2012 by twin--turbo

[twin--turbo]

The Firebox is just a Intel Processor based PC board (Custom) the WG boots of a 256MB CF card, so the crux of it is changing the software to pFsense. 1st stumbling block that people have found is that the Firebox Bios is setup so that only a 256MB card will boot and the new image is bigger. So you have to get into the bios ( enabling serial console ) and change some settings.

 

After taking the case appart (X5500) (photo to follow) I found the CF card that holds the system. On this platform it was hidden under a hardwar VPN expansion card.

 

I then but this in a PCMCIA -> CF adapter and slotted it in an Ubuntu laptop.

 

Unlike other guides I decided to try and back up the CF Card first. ( we will see if this works later! ) using the dd command

 

dd if /dev/sdb of=/home/administrator/pfwork/firebox256.img

 

(obviously the device needs to be the correct one! /dev/xxxx)

 

 

 

It reported 257MB copied so that sounds reasonable.

[twin--turbo]

and then wrote out the new image which has freedos and the program to update the bios.

 

dd if=FreeDOSBios.img of=/dev/sdb

 

which returened 8.2MB Copied

 

So far so good.

 

Before continuing I decided to put the image of PFSense on the BIG CF card that would run the new OS, this was so I can swap to an older laptop with Serial ( I could have done it on just one laptop but prefered using "dd" to move the images arround.

 

So I downloaded an unpacked the latest ( Well it's Dec 2011) 2.0.1 4GB NanoBSD image for i386.. http://pfsense.mirrors.ovh.net/pfsense.org/downloads/pfSense-2.0.1-RELEASE-4g-i386-nanobsd.img.gz

 

Unpacked it and transfered it to the 4GB card. ( well I will do in 55 mins when the download finishes! )

[cpjitservices]

Excellent... I've been looking forward to this thread!

 

This is one thing I've never tied, I've only ever had pfsense running on a PC based machine or a VM.

 

Once you have got pfsense up & running on the WG will you be using it / testing it as a UTM device ?

 

I've often wondered whether pfsense would make the ultimate solution as a UTM but never had the chance or time to test it.

 

Looking forward to photo's and some more of your findings.

 

Thanks @twin--turbo

 

PS - If you get chance look on the internet for pfsense home router... you can make some routers actually run pfsense - some of those routers do go on ebay now and again for 30 quid or so, Ideal for those of you with a Cable Internet connection. Usually pfsense works on home routers based on the ALIX hardware. Right now I cant find the link but it's out there somewhere.

http://linitx.com/product/12647?gclid=COf_jPen3bMCFaTKtAod2jcAag

Edited November 20, 2012 by cpjitservices

[twin--turbo]

So instead of waiting arround I put the 256MB card back in the WG and powered on with my Windows laptop, serial cable salvaged from a random box, and a putty session on 9600 baud.

 

Yay "Freedos" ( Picture later )

 

and now it 's time to flash the BIOS, the files are already on the image so no need to put them there.

 

AWDFLASH is used to flash the BIOS

AWDFLASH command line switches

 

with the recomended command of

awdflash.exe X750EB2.BIN /py /sn /cc /e

 

but I am goign to attempt to back up the original so my command will be

awdflash.exe X750EB2.BIN OLDBIOS.BIN /sy /py /sn /cc /e

 

Here goes... Afterwards we will hopefully have bios on the terminal line..

[glennda]

I might give this a go! I have a couple of old Watchguards in the corner!

[Oaktech]

I built pfsense onto an old appliance - had no problems building it, spent nearly a week trying to configure the bloody thing and eventually gave up and did the routing job I wanted it for with our HP switches...

[twin--turbo]

Phew.....

 

Tried a few of the various bios flashes and had no joy, found out I needed 115200 baud but that still seemed to be spitting junk out.

 

Removed and reseated the serial cable and it popped up.

 

I was on file X750EB5 ( thought I had bricked the box when it did not work... )

 

So I am now in the serial BIOS ( press tab to get in rather than DEL )...

 

Got to go and sort a Phone for someone now though.............................................................

[cpjitservices]

Hmmmmmm Phone or pfsense.... know which on I'd rather be sorting... owell we have to do these things lol.

 

Glad yo got it sorted regarding getting into the BIOS, you've got further than what I would of ... I'm afraid I'd of given in with defeat.

[twin--turbo]

LOL... Phone only took 20 mins, had to patch through fromanother old building, setup the vlan and patch from one end of the server room to the other.... Job Jobed..

 

the image i downloaded came as a .gz (gzip) which we use gunzip to unzip.. (I renamed it for ease of use to pf.img.gz)

 

gunzip pf.img.gz

 

and then write it out to my 4gb CF with

 

dd if=pf.img of=/dev/sdb

 

going to take a few mins to do that

 

dd

[twin--turbo]

I am not stuck....

 

the small image did 8.2MB in 16 seconds.. (Roughly 2secons a MB)

 

so by my reconing 4GB ( 4024 at 2MB/s = 8048 Seconds = 134 Minuets 2hrs 14m ) ...

 

Coffee on the boil.

 

Rob

[twin--turbo]

7744 Seconds

 

Rob

[twin--turbo]

Balls...

 

(forgot the last paramater of the image transfer... See you agai in 7700 seconds.

 

dd if=pf.img of=/dev/sdb bs=16k

[twin--turbo]

Ahhhhhrg..

 

Well after re-imaging the 4GB i found I still could not boot.

 

It was only this mornign that I realised that i had downloaded the VGA image which does not work on a serial line!!

 

It's now booted....

 

Rob

[twin--turbo]

on the serial console i set up the lan and wan addresses and then tried to determine which socket I was connected to as the naming was a little different ( not 1 - 8 0r 0- 7 )

 

at first I had trouble as I was tryign to ping the wan interface which is default firewalled.

 

then I tried the lan interface and eventualy found and connected to the web console.

 

I determined that the 8 interfaces on this box,

 

pfsense = watchguard front

msk0 = interface 0

msk1 = interface 1

msk2 = interface 2

msk3 = interface 3

sk0 = interface 4

sk1 = interface 5

sk2 = interface 6

sk3 = interface 7

 

 

 

 

 

whilst in the bios I also set the terminal speed to 9600 as that is what pfSense outputs. It makes the memory test on boot very slow but you can 'esc' past it.

 

 

 

So that's it.

 

Basicaly installing pFsense on an old Watchguard is not difficult and works.

 

 

I guess I should now do a quick "Captive Portal" Guide...

[twin--turbo]

P.S.

 

 

I have named this the "BotchGuard"

[cpjitservices]

LOL I like the name botchguard...

 

I have just purchased this:

LinITX.com - LinITX ALIX 2D3 LX800 (3NIC+USB) pfSense Firewall Kit

 

As we have a client needing UTM and we will see how it goes!

 

Looks like you've had fun with Pf and the watchguard... you'll have to show us some pics!!!

[MicrosoftTechy]

what edition of pFsense are you using on the box ? 2.1>?

[cpjitservices]

what edition of pFsense are you using on the box ? 2.1>?

 

2.1-BETA-0 here.

 

I've just emailed them to see when it is going to be released.

[twin--turbo]

2.0.1 here.

 

I installed the Beta on a VM to see if there was an improvement on Captive portal.

 

We want 2 portals on for students and one for guests.

 

Unfortunatly using LOCAL auth you can't segregate portals they can all be accessed by any user..

 

Rob

[MicrosoftTechy]

How much RAM is in your watchguards?

[twin--turbo]

Note:

 

I built the second box yesterday and had a faf again getting the BIOS to show.

 

to boot freedos fisrt use 9600 Baud , and flash the bios.

power off

pull the serial cable

kill putty

connect at 19200 baud, connect cable

power on.

 

Bios Should Display.

 

Rob

[twin--turbo]

So two Boxes built ready for production. Now building the Test Box

 

Rob