Ospf On Pfsense: Routing Setup And Configuration Guide

Configuring dynamic routing on a firewall lets your network adapt when links fail or topology changes. Static routes break down in larger environments, requiring manual updates across every gateway. If you manage a multi-site network or a complex internal layout using pfSense, Open Shortest Path First (OSPF) automates path selection using link-state information.

By running OSPF on pfSense routers, you ensure traffic takes the most efficient path between subnets without constant manual intervention. Modern pfSense releases handle OSPF through the FRRouting (FRR) package, replacing older Quagga implementations with a stable, actively maintained routing engine. This guide walks you through planning, installing, and configuring OSPF on your pfSense hardware, complete with troubleshooting steps and verification commands.

Understanding OSPF on pfSense

OSPF is an Interior Gateway Protocol (IGP) designed to move packets within a single routing domain, known as an autonomous system. Unlike distance-vector protocols like RIP, OSPF uses a link-state algorithm. Every router running OSPF maintains a complete topological map of the network area, calculating the shortest path to every destination using Dijkstra's algorithm.

In a pfSense deployment, OSPF doesn't run natively in the base FreeBSD kernel routing table by default. Instead, you install the FRR package, which acts as a bridge between the pfSense web interface and the underlying routing daemon. FRR speaks OSPFv2 for IPv4 and OSPFv3 for IPv6, communicating with neighboring routers, exchanging link-state advertisements (LSAs), and injecting dynamic routes directly into the pfSense kernel routing table.

Why Use OSPF Instead of Static Routes

Static routing works fine for single-router edge setups. As soon as you introduce redundant firewalls, secondary internet links, or branch offices connected via VPN tunnels, static routes create administrative overhead.

• Automatic Failover: If a primary link drops, OSPF recalculates the topology and routes traffic through an available backup path automatically.
• Scalability: Adding a new subnet requires updating configurations only on the affected routers, rather than editing routing tables across every device on the network.
• Load Balancing: OSPF natively supports equal-cost multi-path (ECMP) routing, splitting traffic across multiple links with identical metrics.

Preparing Your Network and pfSense Environment

Before installing packages, map out your network topology. You need clear definitions for your router IDs, interface IP addresses, area IDs, and authentication keys if you plan to secure adjacencies.

Prerequisites and Package Installation

To run OSPF on pfSense, verify your hardware meets basic throughput requirements and that you have administrative access to the web configurator.

1. Log into your pfSense web interface.
2. Navigate to System > Package Manager > Available Packages.
3. Search for frr in the search box.
4. Click Install next to FRR (Free Range Routing) and confirm the installation.

Once installed, a new menu item labeled FRR will appear under the Services dropdown.

Defining Router IDs and Area Structures

Every OSPF router needs a unique Router ID (RID), typically formatted as an IPv4 address (e.g., 192.168.100.1). This ID doesn't have to be an active interface IP, but using a loopback address or a stable management IP prevents ID changes if a physical interface bounces.

Most small-to-medium deployments use a single OSPF area, designated as Area 0.0.0.0 (the backbone area). Keep your initial configuration simple by placing all participating interfaces inside Area 0 before splitting into multi-area designs.

Step-by-Step OSPF Configuration in FRR

Configuring OSPF through the FRR package involves enabling the routing engine, defining global options, configuring individual interfaces, and binding the OSPF process to your local networks.

Step 1: Global FRR Settings

First, enable the FRR service and configure global parameters.

1. Go to Services > FRR > Global Settings.
2. Check the box to enable FRR logging if you want detailed diagnostics.
3. Save your changes.

Step 2: Configuring the OSPF Routing Daemon

Next, set up the OSPF daemon parameters.

1. Navigate to Services > FRR > OSPF > Global.
2. Check Enable OSPF.
3. Enter your unique Router ID. If left blank, FRR may pick an interface IP, but setting it explicitly prevents unexpected shifts.
4. Add log adjacency changes to track when neighbors connect or drop.
5. Save the configuration.

Step 3: Defining OSPF Interfaces

You must tell FRR which pfSense interfaces should participate in OSPF routing and exchange Hello packets.

1. Go to Services > FRR > OSPF > Interfaces.
2. Click Add.
3. Select your local interface (such as LAN or a dedicated transit network interface like OPT1).
4. Set the Hello Interval (default is 10 seconds; ensure it matches neighboring routers).
5. Set the Dead Interval (typically 4 times the hello interval, or 40 seconds).
6. Assign an explicit interface cost if you want to influence path preference. Lower costs are preferred over higher ones.
7. Save the interface rule.

Step 4: Configuring OSPF Networks and Areas

Now bind specific subnets to OSPF areas so the router knows which local networks to advertise to neighbors.

1. Go to Services > FRR > OSPF > Networks.
2. Click Add.
3. Enter the network prefix in CIDR notation (for example, 192.168.1.0/24).
4. Enter the target OSPF area, usually 0.0.0.0 for the backbone.
5. Save the network entry.

Repeat this for every local subnet attached to this pfSense router that you want other routers to reach.

Firewall Rules and Security Considerations

By default, pfSense blocks all incoming traffic on internal interfaces unless explicit rules permit it. OSPF relies on multicast traffic sent to 224.0.0.5 (AllSPFRouters) and 224.0.0.6 (AllDRouters) using IP protocol number 89.

Configuring pfSense Firewall Rules for OSPF

If you run OSPF over internal interfaces or point-to-point links between routers, you must ensure the firewall permits OSPF protocol traffic.

1. Navigate to Firewall > Rules and select the tab for the interface connecting your routers (e.g., OPT1).
2. Add a new rule:
   • Action: Pass
   • Interface: OPT1
   • Address Family: IPv4
   • Protocol: OSPF
   • Source: Any (or specific neighbor router IPs)
   • Destination: Any
3. Save and apply changes.

Failing to add this rule results in silent packet drops, preventing routers from forming adjacencies.

Securing OSPF Adjacencies

Unauthenticated OSPF allows rogue devices on your local network to inject malicious routing tables and hijack traffic. Always enable authentication on production links.

• Plaintext Authentication: Sends passwords in clear text. Avoid this unless necessary.
• MD5 Cryptographic Authentication: Uses a shared secret key hashed with MD5, ensuring routing updates cannot be spoofed easily.

To configure MD5 authentication in FRR, edit your OSPF interface settings, select MD5 authentication, and provide a secure shared key that matches the configuration on your neighboring routers.

Verifying OSPF Operation and Troubleshooting

Once configurations are saved and firewall rules are applied, verify that your pfSense router successfully discovers neighbors and installs routes.

Essential FRR Status Commands

FRR includes an integrated terminal interface (VTY) accessible via SSH or the pfSense web GUI diagnostic tools.

1. Go to Services > FRR > Status > OSPF.
2. Review the Neighbor Summary to confirm adjacency states reach Full. If a neighbor stays stuck in Init or 2-Way, check your firewall rules and subnet masks.
3. Check the Route Table to verify that remote subnets learned from other routers appear with an O prefix.

You can also log into the pfSense shell via SSH and run the integrated VTY shell:

vtysh
show ip ospf neighbor
show ip route ospf

Common Pitfalls and Troubleshooting

• Mismatched Timers: If Hello and Dead intervals don't match between adjacent routers, adjacencies will never form.
• Area ID Mismatches: All routers on a shared segment must belong to the same OSPF area unless configured as area border routers (ABRs).
• Incorrect Subnet Masks: OSPF requires participating interfaces on a shared broadcast domain to share matching subnet masks.
• Blocked Multicast Traffic: Forgetting to permit protocol 89 or multicast addresses in the pfSense firewall is the single most frequent cause of deployment failure.

Frequently Asked Questions

Can pfSense run OSPF alongside BGP?

Yes. The FRR package supports multiple routing daemons simultaneously, allowing you to run OSPF for internal routing and BGP for external WAN or ISP peering on the same pfSense hardware.

How do I advertise a default route (gateway of last resort) via OSPF?

In the FRR OSPF global configuration, you can enable the option to originate a default route. This tells the router to inject 0.0.0.0/0 into the OSPF domain, allowing internal routers to direct all unassigned traffic through your primary firewall.

Why is my OSPF adjacency stuck in Exchange/ExStart state?

This usually points to a Maximum Transmission Unit (MTU) mismatch on the connecting interface or an MTU black hole along a bridged link. Ensure interface MTUs match across all participating routers.

Does OSPF support IPv6 on pfSense?

Yes. FRR includes support for OSPFv3, which handles IPv6 routing identically to how OSPFv2 handles IPv4. You configure OSPFv3 through dedicated tabs within the FRR package menu in pfSense.