The pfSense branding applies to two different operating systems, pfSense CE (Community Edition) and pfSense Plus. pfSense CE is Free and Open Source, meaning that the source code is freely available to view, modify, and redistribute. pfSense Plus is a closed-source version maintained by Netgate.
For more information on the differences between pfSense CE and pfSense Plus, view the official FAQ
Note: pfSense Plus used to be free for non-commercial use, but Netgate has removed that subscription tier. The cheapest subscription plan is $129 per year.
Note: This guide assumes that your firewall has a video output. If you are using serial, please follow the official documentation
The pfSense CE download image can be obtained from the pfSense website.
Architecture should be set to AMD64, and installer can be set to USB Memstick or DVD Image. Both can be flashed onto a USB stick. Here is a full comparison
If you have chosen to use pfSense plus, you can update from pfSense CE to pfSense Plus after installation.
Once the file has downloaded, open the usb-flasher of your choice (I recommend Balena Etcher), and flash the file.
Note: This will wipe the contents of the USB stick, so make sure there’s nothing important on it.
DELETE
works.F2
or F12
Enter
or wait a few seconds for the installer to start bootingAfter the system boot process completes, you should see a screen that looks like this.
The router displays its WAN address (public IP address), and LAN address (local IP address)
in my case, the local IP address is 192.168.1.1
Going to http://ROUTER_LOCAL_IP_ADDRESS
in your browser should bring you to a login screen
The default username is admin
, and the default password is pfsense
You should now be prompted with a setup wizard.
Skip step 1 since it’s just an ad for paid support
On step 2:
On step 3:
On step 4, this is where the magic happens. If this firewall is between your ISP provided modem, there is a good chance using DHCP will work completely fine, but it depends on your specific ISP.
On step 5, you can set your local IP Address range. The default is 192.168.1.1/16
but if you need more addresses, you can use 10.0.0.0/8
On step 6, set the password for the webGUI. Make sure to use a secure password
On step 7, and 8: reload the system
The firewall will now restart, if you changed the IP address, you need to change the address in your browser
Note: This list is not comprehensive.
IPv6 is a newer implementation of the Internet Protocol than the classic IPv4 and was mainly created to add more IP addresses. IPv4 supports a maximum of 2^32 (4,294,967,296
) addresses, while IPv6 has a maximum of 2^128 (340,282,366,920,938,463,463,374,607,431,768,211,456) addresses.
IPv4 addresses are now a commodity, and thus some people (including me) have moved to hosting exclusively* using IPv6.
*My website is still accessible over the IPv4 internet through a network translation service, but I will probably pull the plug when IPv6 becomes more widely adopted.
Your ISP might have already rolled out IPv6 to your area. You can check your IPv6 status using this website.
Netgate provides an official tutorial on how to get a block of IPv6 addresses with TunnelBroker and how to configure pfSense to use them.
Snort is a rule-based firewall software that blocks incoming and outgoing network packets based on user-configured rules.
Another issue caused by the IPv4 address space being completely full is that people run bots that ping random addresses for both research and malicious reasons.
Interfaces
tab if it does not send you to that page. Add
button in the bottom right Block Offenders
option, but ensure that it will only block the source address, and be aware that on rare occasion you might accidentally block yourself.Snort Interfaces
tab should show the WAN interface Snort blocks connections based on rulesets that can be obtained from multiple sources:
To Add rules:
Global Settings
Save
Go to Updates and press the Update Rules
button. This will fetch all rules you enabled in the previous step
Snort Interfaces
tabWAN Categories
tabYou can either cherry-pick which rules you would like to apply, or you can press Select All
at the top, and manually whitelist proper traffic that gets blocked.
In the Alerts
tab, you can view IP addresses that have been blocked by the selected rules
This image is from an actual pfSense deployment, so many fields have been blurred
Congratulations! You now have an open-source* firewall protecting your network! Here are some links to other guides on setting up specific packages/programs on pfSense:
*If you have chosen to stick with pfSense CE over pfSense+