Skip to content

Netgate 6100 MAX Administration

The Netgate 6100 MAX is a hardened security appliance running pfSense, providing firewall, routing, VPN, and network management capabilities. It serves as the perimeter gateway — protecting the internal network while enabling reliable internet connectivity and secure remote access.

Hardware Specifications

8 Ethernet ports:

Port labels Interface IDs Type
LAN1–LAN4 igc0–igc3 2.5 GbE RJ45
WAN1–WAN2 ix3, ix2 1 GbE combo RJ45/SFP
WAN3–WAN4 ix0–ix1 10 GbE SFP+

The SFP+ ports (WAN3–WAN4) do not support 1000BASE-T copper SFP modules or speed autonegotiation — they're 10G optical/twinax only. A 1G copper SFP plugged in there silently won't work.

Basic Administration

First-Time Setup

Access the web interface via the default LAN port (LAN1, igc0):

IP: 192.168.1.1
Username: admin
Password: pfsense (default)

Change the password immediately after first login.

Dashboard Navigation

The pfSense dashboard shows:

  • System status (CPU, memory, temperature)
  • Interface status (WAN/LAN connectivity)
  • Gateway status (redundancy indicators)
  • Recent logs and traffic
  • Active connections and states

Initial Configuration Steps

  1. Set hostname: System → General Setup → System Hostname
  2. Configure interfaces: Interfaces → [igc0 (LAN1), ix3 (WAN1), etc.]
  3. Set WAN/LAN roles: which ports are upstream, which are local network
  4. Configure DHCP: Services → DHCP Server (if desired — see DHCP Fundamentals for how DORA/relay work under the hood)
  5. Set NTP: System → General Setup → Time servers (mismatched clocks make correlating logs across devices painful)
  6. Enable Syslog: Status → System Logs → Settings

Network Configuration

Port Allocation Strategy

The 6100 MAX has 8 network ports. Typical layout:

LAN1 (igc0)                   → Internal network switch (Cisco 3560CX)
WAN1 (ix3, 1G combo RJ45/SFP) → Internet uplink
LAN2 (igc1)                   → Optional DMZ (streaming, API)
WAN2 (ix2, 1G combo)          → Secondary ISP / failover
LAN3-LAN4 (igc2-igc3) and
SFP+ WAN3-WAN4 (ix0-ix1, 10G) → Reserved

Interface Configuration

Each interface can be:

  • Static IP — fixed address for reliable connectivity
  • DHCP Client — for dynamic WAN uplinks
  • Bridge — transparent mode (rarely needed)

Use static IPs on all internal-facing interfaces — this prevents configuration drift if the device restarts.

Firewall Rules

Firewall → Rules → LAN (inbound from internal network)

Allow critical traffic:
- Management/SSH (for remote troubleshooting)
- NTP (time sync for logging)
- DNS (resolution)
- HTTP/HTTPS (streaming, APIs)

Block by default:
- Everything else (implicit deny rule at bottom)

NAT Configuration

If exposing services to the internet, see NAT & Private IP Ranges for the underlying concept — pfSense exposes the same idea through its GUI:

Firewall → NAT → Port Forward

Example: Expose streaming server on internal 10.0.10.100:8080
External: WAN IP:8080 → Internal: 10.0.10.100:8080

Always restrict to specific ports and IPs — never open entire ranges.

High Availability

Dual-WAN Failover

If two internet connections are available:

  1. Assign the second ISP to the WAN2 combo port (ix2) via Interfaces → Assignments
  2. System → Routing → Gateways: confirm one gateway per WAN and give each a unique Monitor IP (e.g. 8.8.8.8 on WAN1, 1.1.1.1 on WAN2)
  3. System → Routing → Gateway Groups: create a failover group — primary gateway Tier 1, secondary Tier 2, Trigger Level "Member down"
  4. Set the group as the IPv4 default gateway (System → Routing → Gateways → Default gateway), or select it under Gateway in the advanced options of LAN firewall rules for per-service policy routing

Failover should be automatic and tested before deployment — never assumed to work.

UPS Integration

Connect a UPS via USB (if the model supports it) — install the NUT package first, or the Services → UPS menu will not exist:

System → Package Manager → Available Packages → nut
Services → UPS → select the UPS driver/cable for your model
Set the shutdown behavior on low battery (prevents filesystem corruption)

Install and test this in advance — package installation needs internet access, and the GUI will not warn you about invalid driver/cable combinations (check Status → System Logs for "nut:" entries if the service fails to start).

Monitoring & Logging

System Monitoring

Check regularly:

  • Status → Dashboard — CPU, memory, disk space
  • Status → System Logs — warnings and errors
  • Status → Interfaces — link status, packet counts, errors

Syslog Configuration

Send logs to an external server for archival — pairs with the Logging & Alerts setup already documented for the Cisco switch, so both devices land in one place:

Status → System Logs → Settings → Remote Logging
Enable Remote Logging: checked
Remote log servers: 10.0.99.5:514
Remote Syslog Contents: System Events + Firewall Events (or Everything)

Packet Capture (tcpdump)

For troubleshooting network issues:

Diagnostics → Command Prompt
tcpdump -i igc0 -n port 53      # Capture DNS
tcpdump -i ix3 -n host X.X.X.X # Capture specific IP traffic

Security Best Practices

Access Control

  • Change the default password immediately
  • Enable SSH for CLI access — the GUI alone is insufficient for recovery scenarios
  • Restrict admin access to the management VLAN only
  • Use strong, unique credentials

Firewall Hardening

  • Disable unnecessary services (UPnP, SNMP unless needed)
  • Block WAN access to the GUI (use VPN or a jump host instead)
  • For internet-exposed services, consider State type Synproxy in the WAN pass rule's Advanced Options — the firewall completes the TCP handshake itself, blocking SYN floods (but it disables TCP window scaling, SACK, and timestamps, so expect reduced throughput; skip it unless a service is actually exposed)
  • Review and test rules after every change, not just at first setup

Updates & Backups

  • Backup configuration — Diagnostics → Backup & Restore, before and after changes (same principle as the TFTP config backups on the Cisco switch)
  • Check for updates — System → Update, tested in advance rather than on a live network
  • Recovery media — a USB installer image restores the OS if the SSD fails

Network Integration

Topology

Internet
   ↓
Netgate 6100 MAX (firewall/router)
   ↓
Cisco 3560CX (managed switch)
   ↓
VLANs (office, guest, management, streaming)

Typical Configuration

The Netgate handles:

  • WAN uplink — one or two internet connections
  • LAN gateway — default gateway for all internal devices (e.g. 10.0.0.0/8)
  • DHCP (optional) — can delegate to the Cisco switch instead, see DHCP Fundamentals
  • NAT/Port forwarding — for external services if needed
  • Firewall — protects the internal network from internet threats

VPN for Remote Access

For monitoring and administration from a remote location:

VPN → OpenVPN → Servers (or use the Wizards tab for a guided remote-access setup)
Create certificate-based connection
Restrict to management VLAN traffic only
Test failover and connectivity in advance

This is the 6100 acting as a VPN server for inbound admin access — the reverse direction from running it as a client that sends outbound traffic through a commercial provider.

Troubleshooting Quick Reference

  • No internet: Status → Gateways (check WAN link status and routing)
  • Slow traffic: Status → Dashboard (check CPU/memory), review rules
  • Clients can't reach internet: Firewall → Rules → LAN (verify allow rules)
  • Management access lost: reset via the console port — USB Micro-B cable, or an RJ45 Cisco-style console cable (the same rollover cable as the 3560-CX; the RJ45 port takes priority if both are connected). 115200 baud, not the 9600 used on the Cisco console
  • Log files growing: Status → System Logs → Settings (reduce log retention/entries or per-log overrides)

Deployment Checklist

  • Default password changed
  • Hostname set
  • WAN and LAN interfaces configured
  • Static IPs assigned (no DHCP for critical interfaces)
  • Firewall rules created and tested
  • Syslog configured to external server
  • NTP synchronized
  • Backup configuration saved
  • Dual-WAN failover tested (if applicable)
  • UPS connected and tested
  • Console access verified for recovery (USB Micro-B or RJ45 Cisco-style cable, 115200 baud)
  • Documentation with IP addresses and passwords in secure storage