Using pfSense with LayerOne

Tutorial · 8 min read

A LayerOne virtual network is an isolated L2 LAN. pfSense (or OPNsense, or VyOS) is how you put a WAN in front of it. NAT, DHCP, and VPN run in the guest. The platform does not SNAT the VNet and does not route between two VNets on the same firewall.

Plan and image

no.appliance is the Network Optimized plan intended for a lightweight firewall. Choose a larger plan if you need more memory, storage, or inspection capacity. pfSense and OPNsense typically boot from a custom ISO; contact support if the image you need is not available. Keep public IPv4 on for the firewall itself.

Create the VNets first

Under Network → Private networks, create each LAN you want the firewall to terminate. Example:

• VNet A 10.10.0.0/24 (LAN)
• VNet B 10.20.0.0/24 (OPT1)

Leave each gateway blank until the firewall NICs exist. An account can create 10 VNets by default.

NICs: WAN, LAN, OPT

On a dual- or triple-homed firewall the usual mapping is:

• WAN (net0): the dedicated public IPv4. This is the only NIC with an internet path from LayerOne.
• LAN: VNet A. Assign a host address such as 10.10.0.1.
• OPT1: VNet B. Assign 10.20.0.1. Add more OPT interfaces the same way for more VNets.

Your firewall may connect to multiple private networks. Configure client routes in each guest or advertise the gateway through pfSense DHCP. The portal's gateway field is an optional reference and does not configure clients.

Inside pfSense

Assign WAN to the public adapter, LAN to VNet A, and OPT1 to VNet B. Choose and configure each private interface address inside pfSense. Set the interface MTU to 1450 on every private-network adapter.

Enable the NAT, DHCP, VPN, and forwarding rules you need inside pfSense. Servers on one private network can already communicate with each other. Traffic reaches another private network or the internet only when your firewall explicitly forwards it.

Choose static addressing or DHCP

For fixed LAN addresses, configure the IP, subnet and gateway inside each guest. For DHCP, enable the DHCP client on the guest interface and run the server in pfSense. LayerOne does not allocate private addresses or write private Cloud-Init settings.

Configure WAN, LAN, and OPT inside the pfSense interface. No private IP is requested when you connect a network in LayerOne; set it inside pfSense.

Private-only workloads behind the firewall

Application and database servers can deploy without a public IP and connect only to a private network. Reach them through pfSense, another server on the same network, or the browser console. LayerOne does not provide NAT for them, and public IPv4 cannot be added after deployment.

OPNsense and VyOS

The same NIC layout applies. OPNsense: WAN / LAN / OPT, MTU 1450 on the VNet adapters, NAT and DHCP in the guest. VyOS: assign eth0 as the public WAN and later Ethernet interfaces to each VNet, then set interfaces ethernet … mtu 1450 and your own NAT or routing. LayerOne still does not route between VNets.

Related

• Why configure a virtual network
• How to set up a virtual network
• Docs: firewall appliances
• Pricing (Network Optimized, including no.appliance)