header-logo-left

The Lone Geek Blog

One geek in a sea of nerds.

header-logo-left

Building a Pfsense Install on a Physical Disk for Deployment

with VirtualBox. :)

| Comments

A few days ago, I have a brilliant idea to build pfsense on a hard drive from within virtualbox and it worked surprisingly easy once I worked out how to get the network interfaces to work with my config.

Hardware bit

The setup was something like this; a WD 250GB HDD attached to a SATA to USB bridge with a VMDK placeholder file pointing to the block device. VirtualBox didn’t care, all it had was the VMDK file attached. I don’t know the science behind how it works, just that it does. The VBox machine file needed 5 nics setup because my physical computer it is meant for has that many; a quad nic and the integrated one.

VBoxManage internalcommands createrawvmdk -filename physical_pfsense.vmdk -rawdisk /dev/sdd

Because of the way my router pc arranged it’s numbering of the nics, I have to work in reverse with em4(nic5) being the wan port. vboxmanage modifyvm "pfsense" --nic5 nat --nictype5 82543GC. For some reason, it’s just how the quad nic numerates it’s ports. The integrated port first, then number from the outside port to the inside. My modem is connected to the inside one followed by the lan. (Could have used a single nic and use the integrated one for lan or wan but I was thinking I’d have isolated physical lans at some point.)

Now the VBox machine got 2GB of RAM and 2 cores to keep things happy (just in case). The first 4 nics were pointed to independent internal networks to avoid any ip collisions set about from my config.

Software bit

I installed pfsense from the iso, as you do, while paying attention to the partitioning; I didn’t want it to take the whole disk just yet so it got 8GB for now. The flash drive it’s on right now is 8GB but the partition is slightly smaller. I wanted to just copy the partition from the flash drive to the disk with DD but I didn’t think that’d work out too well so I exported the existing config and manually installed it with pfsense’s file editor in the webui then rebooted the vm. I found that the restore function wouldn’t accept my config as a whole so manual it was. I did create a separate package config to install the packages I use and wouldn’t you know it, the shotgun package installer button also didn’t work. smh. It took me a while to work out how to get that to work including manually copying the package files from a backup image of the existing install to the external disk from within a freebsd vmdk install from the freebsd website. (that didn’t work, maybe I missed something. idk)

In the end and from the package manager on the webui, I installed the first package I knew I had and the others just magically appeared in the list for me to reinstall one by one. Kinda annoyed at that but whatever. I got it done.

My Reasoning

Because my pfsense box is running on a flash drive, I worry about that drive quitting on me so I needed a more reliable solution. It started with a Sandisk SSD but I guess from me trying out squid and other heavy disk apps, it just couldn’t take it. Then I installed a flash drive that also failed so it’s on it’s second flash drive because I didn’t have a suitable replacement solution at the time. The two failures was just the drives going to read-only mode so at least I was able to save my config. The flash drive just needed a simple disk copy to another one and it was good to go. I couldn’t figure out how to recover from the SSD so I reinstalled and copy the config. Partition size differences and me being new to BSD. Now with cloud backups, restoring should be easier. I need to test that in a VM at some point to get some ideas.

Hopefully this $20 hard drive from Amazon will hold up for a few years or more. I went with solid state thinking it’d be more reliable but apparently the ones I chose just wasn’t suitable for it. If I could justify the cost of Samsung SSDs in a router, I’d probably use them but it’s hard to find one smaller than 250GB nowadays. Pfsense doesn’t need much on it’s own unless I use squid. Oh well, spinning rust it is. It’s even hard to find new small hard drives at decent prices too. Weird. shrug

If this made any sense, great. If not, well, I don’t know what to tell ya. Cheers.

TL;DR: I installed pfsense from within a VM to a physical disk for deployment on bare metal.

UPDATE 8/12: Hard Drive was installed and booted with no problems as if nothing changed. On the plus side, I now have plenty of space to try things without worrying about exceeding writes on flash media and the webui loads and changes faster. :)

Moved to Linux

Givin up on windows for now

| Comments

Welp, after months of dealing with windows crashing my pc I’ve resorted to using Linux Mint 19.1. I’ve switched my drives from NTFS to EXT4 but left room to maybe install windows just for my games when I can be bothered to try again. All I wanted was a stable system and windows wasn’t havin it. lol No amount of troubleshooting helped, the symptom remained the same; a video driver crash at the most inconvient of times and after gaming for a few hours.

Posting on reddit reveiled some sort of issue with VT-D and Windows 10 but only after I deleted it. XD Something to consider when I try windows again. I’m not sure why it’d cause my problem but that’s something to explore in the future.

Redshiftin the Desktop

Using redshift to automatically change the monitor's temperature color

| Comments

Save your eyes, use RedShift on linux and windows’ builtin night mode.

Description

Redshift adjusts the color temperature according to the position of the sun. A different color temperature is set during night and daytime. During twilight and early morning, the color temperature transitions smoothly from night to daytime temperature to allow your eyes to slowly adapt. At night the color temperature should be set to match the lamps in your room. This is typically a low temperature at around 3000K-4000K (default is 3700K). During the day, the color temperature should match the light from outside, typically around 5500K-6500K (default is 5500K). The light has a higher temperature on an overcast day.

Some tips

Use the config on the site if you encounter issues with the gtk applet. Or do if you don’t. :)

Set your location if redshift has issues retrieving it from the web with a 3 digit latitude and longitude value. I found mine by looking at the gtk applet’s info window when it did connect. OR you can use this url I found in the geoclue.conf file https://location.services.mozilla.com/v1/geolocate?key=geoclue.

If you want it to affect just one monitor; put this at the end of the config that site lists. Just omit the similar line listed on the site.

1
2
[randr]
crtc=0 #this is the primary monitor

Tech Update: Bluetooth Transceiver and Battery

| Comments

Tech update:

Some time ago, I purchased a bluetooth audio transceiver that mostly went unused till I had the idea to use it for my phone and run ear buds off it since the headphone jack on my phone became iffy, the left audio channel would cut in and out if the plug moved ever so slightly. The device was sold by Anker on Amazon for I dunno, 28 bucks. A tiny thing, fits in the mini right pocket of my jeans. Battery lasts about 8 hours fully charged. Lets out a loud beep beep beep when something is playing from the phone. It’s loud and startling. I kinda wish I knew how to hack firmware but I don’t think the computer even knows it’s connected. Doesn’t show up in any sort of device list. I mean, why would it but still.

In comes a portable 10,000 mAh battery, also by Amazon that recently sold for about 36 bucks. I tuck it in my right pocket next to the phone and bluetooth device to charge up when the device gets low or just keep it topped off. I have no idea how many fully charges the big battery will cover, I haven’t done the math yet or can be bothered.

The device looks like this;
image1

On top of that, I can top off my phone as needed for those long work days away from any power sockets. :)

I like to play podcasts and audio books while I work.

The product page is here but the main seller, Amazon, no longer carries it sadly.

Old Calculator for Windows 10

| Comments

Old Calculator for Windows 10

Here’s a little program I found on the net cause I liked the old calculator better. The Win10 calculator app just doesn’t do it for me. Frequently opens up all big and taking up 1/3 of my screen and feels slower to start. The old one is fast, light, and has a smaller UI. :)

Download Link (889KB)

Resizing Root Fs for Ubuntu

| Comments

I needed to resize one of my VMs. This will serve as some better notes than what I see online.

1. Shutdown VM and open the ESXI WEB UI to resize the virtual disk and check a box to force the bios to open on power up.

2. Attach gparted iso to VM then power it up and adjust boot order to boot iso.

3. Once booted, deactivate LVM root volume and resize both extended and logical partitions to max disk size or as desired.

You should see something like this, with different sizes and uuid.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
# vgdisplay
  --- Volume group ---
  VG Name               system
  System ID
  Format                lvm2
  Metadata Areas        1
  Metadata Sequence No  3
  VG Access             read/write
  VG Status             resizable
  MAX LV                0
  Cur LV                1
  Open LV               1
  Max PV                0
  Cur PV                1
  Act PV                1
  VG Size               <15.52 GiB
  PE Size               4.00 MiB
  Total PE              3973
  Alloc PE / Size       2437 / <9.52 GiB
  Free  PE / Size       1536 / 6.00 GiB
  VG UUID               rVuKv3-0fim-f6CQ-4HJs-XqnE-Vaec-xc2jr9

4. Extend LVM Volume

1
# lvextend -l +1536 /dev/mapper/system-root

5. Extend filesystem.

1
# resize2fs /dev/mapper/system-root

6. End result. More space. :) Enjoy.

1
2
3
# df -h /
Filesystem               Size  Used Avail Use% Mounted on
/dev/mapper/system-root   16G  8.3G  6.3G  57% /

VM Creation Script for ESXI 6.5 Hosts

| Comments

So I had an idea to make creating VMs a little easier for me instead of clicking a handful of buttons and powering up the VM then waiting for it to install. I found a blog post intended for Mac VMs that was inspired from a now deleted site’s blog post by a guy who needed to make a bunch of them quicker so I forked Tamas’s script (the original one I think) and modified it to create Ubuntu VMs. :) I also added a few scripts of my own that would tell me if a VM was ready and another to give me the IP. I may try to integrate those two at some point.

How does it work?

Glad you asked. wink Basically, you give the script some parameters and it does it’s thing, it mainly needs the name of the VM; the rest is optional. Details on that is in the readme file.

Extended version

The script has a list of defaults you can set so all you need is a name. From those defaults, there’s a list of loops that check for an input and do some error checks then if none is provided, it uses the defaults. It also checks if the datastore and vm name provided exists. If everything checks out, it proceeds to create the directory, VM Disk Image, and the VM file (.vmx) itself populated with a bunch of stuff the hypervisor needs. Once that is done, it then registers and powers on the VM and prints out the config details.

Following all that, I have two scripts to check if it’s ready and print the ip to the console. All the scripts need is the VM ID outputted from the create.sh script.

What I added to the create.sh script

I added support for multiple datastores and put the network name in a variable if one needed to change it for a single instance or something. I also changed the original RAM and VDISK values to suit my needs as well as the guestOS type for the vmx file it makes and set the location to my ISO file.

Feel free to read all the code and compare with the other guy’s repo. I think this script ought to do just nicely. :)

Bonus points

Moving the script from it’s home in the primary datastore to /usr/bin and run auto-backup.sh on the host itself.

Setup windows (via the win10 linux subsystem unless you can make it work with putty or powershell) to create VMs from a cmd or powershell prompt. All you’d need to do is add your public ssh key to /etc/ssh/keys-root/authorized_keys on the host and run the aforementioned backup script. If that backup script isn’t ran, any changes outside of the datastores and what is usually backed up will be lost upon reboot.

Closing

I think that’s all. It’s a cool script, props to the guy who made it. I just improved it some. ;) Cheers.

Moving VMDK Images Between ESXI and VBox

I did a thing that works but requires a little manual work to do...

| Comments

About 10 days ago, I decided to shutdown my server because my room was getting uncomfortably hot half way into the night but before I shut it down for the time being, I copied a couple virtual machines over to my continuously running file server that I wanted to remain up. The VM I do my webdev stuff on and a small ftp server for the networked printer to upload scans to.

The process is fairly straight forward. Just download the VMDK disk image to my file server and create a .vbox file for VirtualBox. I kept the virtual NIC’s MAC addresses so they’d get the same IP from my pfsense box but due to NIC driver changes from the differing hypervisors, I had to adjust the network config within the VMs. No biggie.

Gave the webdev vm 2vCPUs and the ftp server got just one and kept the ram allocation the same and it’s almost like nothing happened as far as the guests are concerned. :)

When I decide to start using the room heater / VM box, I can simply shutdown the guests before making minor networking changes again and copy the disk images back over to fire them up on it.

Side note

The space heater computer has got me thinking about a second cooler running machine to run ESXI on as well then it’d be a simple migration to and from as needed or desired. I’m thinking maybe single Xeon E5-something or i7 2nd or 3rd gen cpu with 32GB of ram and about 1TB of disk space ought to do.

Just making a public note. :) Cheers.

Installed an Amp in My Truck

because the factory deck just wasn't loud enough. ;)

| Comments

I installed an amp in my truck 🚚 because I got tired of having to crank it almost to max just to make out words playing in a podcast. The stock unit did ok with music, just lacked any decent power to jam with. Initial testing yielded pleasent results.

Install proceedure is typical. Radio outputs to Amp, Amp outputs to Speakers. Grabbed power from an old unused cigarette lighter and tucked all the wires and amp into the dash. Sounds pretty good for ~$92 on amazon. I have 4 3-way speakers in the truck that was installed a few years ago. I tuned the radio to put more power to the back and reduce the highs from the audio from the fronts.

It sounds good, has better bass now that I don’t need to turn the radio up so loud to hear it. It has me thinking about a subwoofer for that extra thump but I dunno where I’d put it exactly, maybe under the driver seat. ;)

Cheers.

DNS Over TLS Using PFsense

and why you need it.

| Comments

Before I begain, this guy talks a bit about it and does it the “old” way for systems with version 2.4.3 and older.

In version 2.4.4, pfsense was updated to offer support within the webui. Just 3 check boxes and your outgoing dns traffic is encrypted. You can do a packet capture on port 853 of you WAN interface to verify. I did a scan on my network and discovered there is still some plain DNS traffic but I’m unsure what to make of it. Some to microsoft and some to “akadns.org” (some sort of CDN for something). Maybe I need to do some checking at some point.

image1

image2

For those who run unbound on other systems (or older pfsense boxes), you can try this bit of config code to see if it will work for you.

1
2
3
4
5
6
7
forward-zone:
    name: "."
    forward-ssl-upstream: yes
    forward-addr: [email protected]
    forward-addr: [email protected]
    forward-addr: 2606:4700:4700::[email protected]
    forward-addr: 2606:4700:4700::[email protected]

Now to encrypt what little HTTP traffic I have without triggering Amazon and Netflix’s Anti-VPN/Tunneling block…

Enjoy!