next »

[ZGamer]

Running pfSense in a vmware instance in production is an exceptionally bad idea. 

true, never said it was a good idea but it should work. I have heard of some people doing something similar on their home connections but you talking 2 or 3 SIP phones and three computers.....not a typical office enviroment.

[jahonix]

Why would it be an "exceptionally bad idea" to use Vmware in a production environment?
And are you referring to this specific product or virtual machines in general?

Granted, I will always separate my pfSense physically.

[dmz]

I would say I will not go for VMWare in the production even the smallest network. We need to ensure quality. Anyway, any ideas to put them together in a high performance machine or any way to have pfsense or other recommended captive portal to run on the Linux OS?


Regards

[jahonix]

...to run on the Linux OS?

pfSense (and m0n0wall) are FreeBSD based. This is not Linux!

[lacoursj]

I am also trying to do the same thing - large server, small number of phones and machines behind a captive portal.

Most peoples comments here seem to be "don't put stuff on a firewall or it stops being a firewall".  Normally I would agree, but in my case (and I suspect the originators case) the firewall aspect is only tertiary - the SIP gateway and captive portal are what is important.  If the SIP gateway is not doing any codec translation it uses hardly any resources whatsoever, and the captive portal is the same.  In my case I don't even need a "big honking server".

So for those of you who are maybe not so paranoid, I *will* make this work this evening and will post my results.

Cheers,

j

[lacoursj]

Ok, I have asterisk 1.4.17 running on the pfsense platform.  It is happily gateing 50 SIP phones with no codec translation (gsm) onto an IAX trunk to our main switch.  It is also a captive portal for 20 Internet Cafe machines and a handful of wifi routers.  This is all running on an Acer Celeron 2.4Ghz with 1GB RAM.  Load average with traffic has yet to go over 0.1 .  I haven't done any exhaustive tests, but I have no reason to believe that my actions have crippled pfsense in any way.

This is not easy to do.  You must have a fully installed 6.2-RELEASE machine available on the net to pull files from.  pfsense has been severely stripped!  Some bizarre things were removed (split? comm? those two probably saved about 10k of space .  You must be able to read the compile output and fix things as you go along, by pulling missing files from your fully loaded box.  I wish I had made a list of everything I pulled over.  Almost all in /usr/bin.

The hurdles were as follows:

1) used sysinstall to get at online packages, and installed the latest gcc and gmake
2) mv /usr/bin/cc and /usr/bin/cpp out of the way, then symlink to /usr/local/bin/gcc and /usr/local/bin/gpp respectively
3) download the latest ports tree and unpack
4) cvsup the latest asterisk source into the ports tree (was 1.4.17 for me yesterday)
5) make install!

As I said above, you will have to be able to read the errors in the build output and pull missing files.  Thats the biggest issue.  But it IS possible, and I am quite happy with the result so far.  Granted I am not using any zaptel interfaces and it is pretty much exclusively for outbound calls, so I am not stressing asterisk much, or pfsense for that matter.

Want to hear more craziness?  I got X running on this beast too.  Long live FreeBSD.

Cheers,

j

[rsw686]

This is not easy to do.  You must have a fully installed 6.2-RELEASE machine available on the net to pull files from.  pfsense has been severely stripped!  Some bizarre things were removed (split? comm? those two probably saved about 10k of space .  You must be able to read the compile output and fix things as you go along, by pulling missing files from your fully loaded box.  I wish I had made a list of everything I pulled over.  Almost all in /usr/bin.

This is all great and all, but when pfSense puts out a new release are you going to want to do that every time? The reason I use pfSense is due to the config being an xml file. I can grab the newest release, restore the xml file, and be on my way. Just buy a separate box for pfSense or Asterik. It will save you many headaches.

[sai]

dmz, why dont you go with the suggestion of running pfsense and any asterisk VM appliance as VMs on your server? From security point of view this is not good, but if you are OK with that then this is probably easiest to get working. asterisk is exceptionally difficult to compile, configure and run, and if you have not done it before then getting it to work on FreeBSD is not likely to happen.