Networking advanced ⏱ 90 minutes

pfSense: Enterprise Firewall for Your Homelab

FreeBSD-based firewall with advanced features. VPN, traffic shaping, and high availability.

By homelabbing.io • 2025-12-17
#pfsense#firewall#router#vpn#security

Introduction

pfSense is the world’s most popular open-source firewall and routing platform, trusted by millions of users from home enthusiasts to Fortune 500 companies. Built on FreeBSD with a focus on security and reliability, pfSense transforms commodity hardware into a powerful network appliance with enterprise-grade features. This comprehensive guide will walk you through deploying, configuring, and mastering pfSense in your homelab environment.

What You’ll Learn

  • Installing pfSense on bare metal and virtual machines
  • Configuring firewall rules and NAT policies
  • Setting up multiple VPN types (OpenVPN, IPsec, WireGuard)
  • Implementing advanced traffic shaping and QoS
  • Deploying high availability with CARP
  • Installing and configuring essential packages
  • Monitoring and logging best practices
  • Security hardening techniques
  • Troubleshooting common issues
  • Integration with homelab services

Why pfSense?

Proven Track Record: Over 15 years of development with a massive user community. When you have a question, someone has already answered it.

Enterprise Features Free: Multi-WAN load balancing, VLAN support, advanced routing (BGP, OSPF), captive portal, high availability clustering, and more - all without licensing costs.

Extensive Package Ecosystem: Expand functionality with packages like HAProxy, Squid proxy, Snort/Suricata IDS/IPS, pfBlockerNG for geo-blocking and ad-blocking, and dozens more.

Hardware Flexibility: Runs on anything from a Raspberry Pi 4 to enterprise servers. Official Netgate appliances available for those who want commercial support.

Active Development: Regular security updates and feature releases. Commercial backing by Netgate ensures long-term viability.

Prerequisites

Hardware Requirements (Minimum):

  • CPU: 64-bit dual-core processor (Intel/AMD)
  • RAM: 1GB minimum (2GB+ recommended)
  • Storage: 8GB minimum (16GB+ SSD recommended)
  • Network: 2x Gigabit NICs minimum (one WAN, one LAN)

Recommended Specifications:

  • CPU: Quad-core Intel/AMD with AES-NI support
  • RAM: 4GB+ (8GB for packages like Snort/Suricata)
  • Storage: 32GB+ SSD for packages and logging
  • Network: 4+ Gigabit NICs for VLANs and DMZ

Knowledge Requirements:

  • Understanding of networking fundamentals (TCP/IP, DNS, DHCP)
  • Basic firewall concepts (allow/deny rules, NAT)
  • Comfort with web interfaces
  • Basic command line skills helpful but not required

Infrastructure:

  • Dedicated hardware or hypervisor for VM
  • Network diagram and IP scheme planned
  • Access to modem/upstream internet connection
  • Managed switch recommended for VLAN support

Time Commitment:

  • Initial installation: 30-60 minutes
  • Basic configuration: 1-2 hours
  • Advanced features: 4-8 hours
  • Ongoing maintenance: 30 minutes monthly

Understanding pfSense Architecture

The pfSense Stack

FreeBSD Foundation

  • Rock-solid Unix-based operating system
  • Proven network stack performance
  • Native support for ZFS, jails, and advanced networking
  • Packet Filter (PF) firewall - extremely powerful and flexible

pfSense Layer

  • Web-based management interface (PHP-based)
  • Configuration management and backup system
  • Package manager for extending functionality
  • Real-time monitoring and logging

Network Topology Design

Internet (WAN)
    |
    | PPPoE/DHCP/Static
    |
pfSense Firewall
    |
    +-- LAN (192.168.1.0/24) - Trusted clients
    +-- DMZ (192.168.10.0/24) - Public-facing services
    +-- IoT (192.168.20.0/24) - Smart devices
    +-- Guest (192.168.30.0/24) - Guest WiFi
    +-- VPN (10.8.0.0/24) - Remote access

Interface Types Explained

WAN (Wide Area Network)

  • Internet-facing interface
  • Typically receives IP via DHCP, PPPoE, or static assignment
  • Default deny inbound, allow outbound
  • Gateway for internet connectivity

LAN (Local Area Network)

  • Primary internal network
  • pfSense acts as default gateway and DHCP server
  • Full internet access by default
  • Trusted zone with fewer restrictions

OPT Interfaces (Optional)

  • Additional interfaces for network segmentation
  • Can be VLANs or physical NICs
  • DMZ, Guest networks, IoT segregation
  • Management networks

VPN Interfaces

  • Created dynamically by VPN services
  • OpenVPN, IPsec, WireGuard tunnels
  • Remote access or site-to-site connectivity

Installation Guide

Method 1: Bare Metal Installation

Step 1: Download pfSense

Visit https://www.pfsense.org/download/

Choose:

  • Architecture: AMD64 (Intel/AMD 64-bit)
  • Installer: DVD Image (ISO)
  • Mirror: Select closest geographic location

Step 2: Create Bootable Media

# Linux
sudo dd if=pfSense-CE-*.iso of=/dev/sdX bs=4M status=progress
sync

# macOS
sudo dd if=pfSense-CE-*.iso of=/dev/diskX bs=1m

# Windows - use Rufus or Etcher

Step 3: Boot and Install

  1. Boot from USB drive
  2. Accept copyright notice
  3. Select “Install pfSense”
  4. Keymap: Select your keyboard layout (US for most)
  5. Partitioning: Auto (UFS) - recommended for most setups
    • ZFS available for advanced users (better data integrity)
  6. Confirm installation
  7. Wait for installation (approximately 5-10 minutes)
  8. Select “No” to manual configuration
  9. Reboot and remove installation media

Step 4: Initial Console Setup

After reboot, pfSense presents console menu:

1. Assign Interfaces
2. Set interface IP address
3. Reset webConfigurator password
4. Reset to factory defaults
5. Reboot system
6. Halt system
...

Configure Interfaces:

  1. Select option 1 (Assign Interfaces)
  2. VLANs: n (we’ll configure later)
  3. WAN interface: Enter your internet-facing NIC (typically em0, igb0, or re0)
  4. LAN interface: Enter your internal NIC
  5. Optional interfaces: Press Enter to skip (configure later)
  6. Confirm: y

Set LAN IP:

  1. Select option 2 (Set interface IP address)
  2. Select LAN interface (typically 2)
  3. IPv4 address: 192.168.1.1 (or your preferred)
  4. Subnet mask: 24 (255.255.255.0)
  5. IPv4 upstream gateway: Press Enter (none for LAN)
  6. IPv6: Press Enter to skip (configure later if needed)
  7. Enable DHCP: y
  8. Start address: 192.168.1.100
  9. End address: 192.168.1.200
  10. Revert webConfigurator protocol to HTTP: n

Step 5: Access Web Interface

Connect computer to LAN port, navigate to: https://192.168.1.1

Default credentials:

  • Username: admin
  • Password: pfsense

Accept SSL warning (self-signed certificate initially)

Method 2: Proxmox Virtual Machine

Create VM in Proxmox:

# Via Proxmox web interface:
VM ID: 100
Name: pfSense-FW
OS: Other
ISO: pfSense-CE-*.iso (upload to Proxmox first)

System:
  BIOS: SeaBIOS (or OVMF for UEFI)
  Machine: q35
  SCSI Controller: VirtIO SCSI

Disks:
  Bus/Device: VirtIO Block (scsi0)
  Storage: local-lvm
  Disk size: 16 GB minimum
  Cache: Write back (for better performance)
  Discard: Enabled (for SSD trim)
  SSD emulation: Yes (if using SSD storage)

CPU:
  Cores: 2 (4+ recommended)
  Type: host (for best performance)

Memory:
  RAM: 2048 MB (4096+ recommended)

Network:
  Bridge: vmbr0 (WAN) - Model: VirtIO
  Add second NIC: vmbr1 (LAN) - Model: VirtIO
  Add additional NICs for OPT interfaces as needed

Important VM Settings:

# Disable hardware checksum offloading (prevents issues)
System → Advanced → Networking
  Hardware Checksum Offloading: Disable
  Hardware TCP Segmentation Offloading: Disable
  Hardware Large Receive Offloading: Disable

Step 6: Proceed with installation as described in bare metal steps above.

Method 3: VMware ESXi

Create New VM:

Name: pfSense
Guest OS: FreeBSD 13 or later (64-bit)
Storage: 16GB (thin provisioned)
CPU: 2 vCPUs (4+ recommended)
Memory: 2GB (4GB+ recommended)
Network:
  - Adapter 1: WAN (on appropriate portgroup)
  - Adapter 2: LAN (on appropriate portgroup)
  - Adapter Type: VMXNET3 (best performance)
CD/DVD: pfSense ISO

VMware-Specific Tuning:

  • Enable CPU performance counters for better monitoring
  • Disable side-channel mitigations if trusted environment (performance gain)

Method 4: Hyper-V

Create Generation 1 VM (Generation 2 has boot issues):

Name: pfSense
Generation: 1
Memory: 2048MB (static - don't use dynamic)
Network: Connect to external virtual switch (WAN)
Hard Disk: 16GB VHDX

After creation:

  • Add second network adapter for LAN
  • Settings → Integration Services → Uncheck all (not supported on FreeBSD)
  • Install from ISO

Initial Configuration Wizard

After first login, pfSense launches setup wizard.

Step 1: General Information

Hostname: pfsense
Domain: localdomain (or your actual domain)
Primary DNS: 1.1.1.1
Secondary DNS: 8.8.8.8
Override DNS: Checked (allows pfSense to use these instead of ISP)

Step 2: Time Server Configuration

Timezone: Select your timezone
Timeserver: pool.ntp.org (or your preferred)

Step 3: Configure WAN Interface

Varies by ISP connection type:

Cable/DHCP:

Type: DHCP
MAC Address: Leave blank (unless MAC cloning needed)
MTU: Leave blank (auto)
MSS: Leave blank (auto)
RFC1918 Networks: Block private networks (recommended)
Block bogon networks: Checked

DSL/PPPoE:

Type: PPPoE
Username: (from ISP)
Password: (from ISP)
Service name: Leave blank
Dial on demand: Unchecked
Idle timeout: 0

Static IP:

Type: Static IPv4
IP Address: (from ISP)
Subnet Mask: (from ISP)
Upstream Gateway: (ISP gateway IP)

Step 4: Configure LAN Interface

LAN IP Address: 192.168.1.1
Subnet Mask: 24

Step 5: Set Admin Password

Choose a strong, unique password. This protects your entire network.

Step 6: Reload Configuration

Click “Reload” to apply settings. pfSense will restart services (approximately 30 seconds).

Step 7: Finish

The wizard completes. You’re now on the pfSense dashboard.

Firewall Rules Deep Dive

Understanding pfSense firewall rules is critical to network security.

Rule Processing Logic

Key Principles:

  1. Rules evaluated from top to bottom
  2. First match wins (processing stops)
  3. Implicit deny at end (if no rule matches, traffic blocked)
  4. Rules applied on ingress interface (where traffic enters)
  5. Stateful firewall (return traffic automatically allowed)

Example Flow:

Client (LAN) wants to reach Google (Internet)
  ↓
Traffic enters LAN interface
  ↓
pfSense checks LAN interface rules (top to bottom)
  ↓
First matching rule: "Allow LAN to any"
  ↓
Traffic allowed, state created
  ↓
Return traffic automatically allowed (stateful)

Default Rules Explained

WAN Interface:

Default: Block all inbound
Reason: Internet is untrusted
Action: Only create rules for specific services you want to expose

LAN Interface:

Default: Allow all outbound
Reason: Internal network is trusted
Note: Includes anti-lockout rule (prevents blocking GUI access)

Creating Firewall Rules

Basic LAN Rule (Allow Internet Access):

Firewall → Rules → LAN → Add

Action: Pass
Interface: LAN
Address Family: IPv4
Protocol: Any

Source:
  Type: LAN net

Destination:
  Type: Any

Description: Allow LAN to Internet

Advanced Options:
  Log: Unchecked (unless debugging)

Save and Apply

Block Specific Website:

Firewall → Rules → LAN → Add

Action: Block
Protocol: TCP
Source: LAN net
Destination: Single host or alias (example: 192.0.2.10)
Destination Port: 80, 443
Description: Block access to specific site
Position: Place ABOVE general allow rule

Allow Inbound Port Forward:

Firewall → NAT → Port Forward → Add

Interface: WAN
Protocol: TCP
Destination: WAN address
Destination Port: 443
Redirect Target IP: 192.168.10.10 (internal web server)
Redirect Target Port: 443
Description: HTTPS to internal web server
NAT Reflection: Pure NAT (recommended)
Filter Rule Association: Add associated filter rule

Save and Apply

This automatically creates a WAN rule allowing inbound HTTPS.

Advanced Firewall Techniques

Alias Management (Firewall → Aliases)

Create reusable groups:

Name: WebServers
Type: Host(s)
Hosts:
  192.168.10.10
  192.168.10.11
  192.168.10.12
Description: Production web servers

Use in rules:

Destination: WebServers (alias)

Time-Based Rules:

Firewall → Schedules → Add

Name: BusinessHours
Month: All
Day: Monday through Friday
Time: 08:00 - 17:00

Then in rule:
  Advanced → Schedule: BusinessHours

Floating Rules:

Apply rules across multiple interfaces:

Firewall → Rules → Floating → Add

Interface: WAN, LAN, DMZ (select multiple)
Direction: Any
Action: Block
Protocol: TCP
Destination Port: 23 (Telnet)
Description: Block Telnet globally

Rate Limiting:

Firewall → Rules → LAN → Add rule

Advanced Options:
  Max states: 100
  Max source states: 10
  Max source conn rate: 5 / 60 seconds
  Max source conn rates: 50

Use case: Prevent abuse, limit connection floods

VPN Configuration

OpenVPN Remote Access Setup

Step 1: Create Certificate Authority (CA)

System → Cert Manager → CAs → Add

Descriptive Name: pfSense-CA
Method: Create an internal Certificate Authority
Key Length: 2048 bit (or 4096 for paranoid)
Digest Algorithm: SHA256
Lifetime: 3650 days (10 years)
Common Name: pfSense-CA

Save

Step 2: Create Server Certificate

System → Cert Manager → Certificates → Add/Sign

Method: Create an internal Certificate
Descriptive Name: pfSense-VPN-Server
Certificate Authority: pfSense-CA
Key Length: 2048 bit
Digest Algorithm: SHA256
Lifetime: 3650 days
Common Name: vpn.example.com
Certificate Type: Server Certificate

Save

Step 3: Create OpenVPN Server

VPN → OpenVPN → Wizards

Type of Server: Local User Access
Backend for authentication: Local Database
Certificate Authority: pfSense-CA

Server Certificate:
  Existing Certificate: pfSense-VPN-Server

General Information:
  Interface: WAN
  Protocol: UDP on IPv4 only
  Local Port: 1194
  Description: Remote Access VPN

Cryptographic Settings:
  TLS Configuration: Use a TLS Key
  TLS Key: (auto-generated)
  DH Parameters: 2048 bit
  Encryption Algorithm: AES-256-GCM
  Auth Digest Algorithm: SHA256
  Hardware Crypto: Intel RDRAND engine (if supported)

Tunnel Settings:
  IPv4 Tunnel Network: 10.8.0.0/24
  IPv4 Local Network: 192.168.1.0/24 (your LAN)
  Concurrent Connections: 10
  Inter-Client Communication: Leave unchecked (usually)
  Duplicate Connections: Allow (for same user on multiple devices)

Client Settings:
  DNS Default Domain: localdomain
  DNS Server 1: 192.168.1.1 (pfSense)
  DNS Server 2: 1.1.1.1
  Force DNS: Checked (prevent DNS leaks)

Advanced:
  Compression: Enabled with Adaptive Compression (LZ4)
  Type-of-Service: Unchecked
  Don't pull routes: Unchecked
  Don't add/remove routes: Unchecked

Firewall Rule Configuration:
  Firewall Rule: WAN: Yes
  OpenVPN Rule: Yes

Next and Finish

Step 4: Create VPN Users

System → User Manager → Users → Add

Username: john.doe
Password: (strong password)
Full name: John Doe
Certificate: Yes
  Descriptive name: john-doe-cert
  Certificate Authority: pfSense-CA

Save

Step 5: Export Client Configuration

VPN → OpenVPN → Client Export

Remote Access Server: (select your VPN server)
Host Name Resolution: Other (specify: vpn.example.com)
Verify Server CN: Automatic

For each user:
  Export Standard Configurations → Most Clients → File Only
  Download .ovpn file

Or:
  Windows Installer (for Windows clients)
  Viscosity Bundle (for macOS)

Step 6: Client Setup

Windows/macOS/Linux:

  1. Install OpenVPN client
  2. Import downloaded .ovpn file
  3. Connect using username/password

iOS/Android:

  1. Install OpenVPN Connect app
  2. Import .ovpn via email or file transfer
  3. Connect

IPsec Site-to-Site VPN

Connect two pfSense firewalls or pfSense to another device.

Scenario: Connect home lab (192.168.1.0/24) to remote office (192.168.2.0/24)

Site A (Home) Configuration:

VPN → IPsec → Tunnels → Add P1

General Information:
  Disabled: Unchecked
  Key Exchange version: IKEv2
  Internet Protocol: IPv4
  Interface: WAN
  Remote Gateway: <SITE_B_PUBLIC_IP>
  Description: Site-to-Site to Office

Phase 1 Proposal:
  Authentication Method: Mutual PSK
  My identifier: My IP address
  Peer identifier: Peer IP address
  Pre-Shared Key: (generate strong random key, share securely)

Encryption Algorithm:
  AES 256 bits
  SHA256
  DH Group: 14 (2048 bit)

Lifetime: 28800 seconds

Advanced Options:
  NAT Traversal: Auto
  Dead Peer Detection: Enable
  Delay: 10 seconds
  Max failures: 5

Save

Add Phase 2:

Show Phase 2 Entries → Add P2

General Information:
  Mode: Tunnel IPv4
  Local Network: LAN subnet (192.168.1.0/24)
  Remote Network: Network (192.168.2.0/24)
  Description: LAN to Remote Office LAN

Phase 2 Proposal:
  Protocol: ESP
  Encryption: AES 256 bits
  Hash: SHA256
  PFS key group: 14 (2048 bit)

Lifetime: 3600 seconds

Save and Apply

Site B (Office) Configuration:

Mirror the configuration with these changes:

  • Remote Gateway: Site A public IP
  • Local Network: 192.168.2.0/24
  • Remote Network: 192.168.1.0/24
  • Same Pre-Shared Key

Firewall Rules:

Both sites need rules allowing IPsec traffic:

Firewall → Rules → IPsec → Add

Action: Pass
Protocol: Any
Source: Remote_LAN (create alias)
Destination: LAN net
Description: Allow Office to Home LAN

Save and Apply

Status Check:

Status → IPsec → Overview

Should show:
  Status: Established
  Phase 2: ESTABLISHED (data traffic)

WireGuard VPN (Package)

Install WireGuard:

System → Package Manager → Available Packages
Search: wireguard
Install os-wireguard

Configure Server:

VPN → WireGuard → Settings

Enable: Checked
Interface: wg0
Listen Port: 51820
Tunnel Address: 10.0.0.1/24
MTU: 1420

Apply

Add Peer (Client):

VPN → WireGuard → Peers → Add

Peer Name: laptop-client
Public Key: (client's public key)
Allowed IPs: 10.0.0.2/32
Endpoint: Leave blank (dynamic)
Persistent Keepalive: 25

Save and Apply

Firewall Rules:

1. Allow WireGuard on WAN:
   Protocol: UDP
   Destination Port: 51820

2. Allow WireGuard clients access:
   Interface: WireGuard
   Source: 10.0.0.0/24
   Destination: LAN net

Traffic Shaping and QoS

Prioritize critical traffic for optimal performance.

Traffic Shaping Wizard

Firewall → Traffic Shaper → Wizards

Number of WAN connections: 1 (or multiple for load balancing)
Interface: WAN
Scheduler: HFSC (recommended for most)

Upload: (your upload speed in Mbps, enter 90-95% of actual)
Download: (your download speed in Mbps, enter 90-95% of actual)

VoIP: Yes
  VoIP Upload: 128 Kbps per line
  VoIP Download: 128 Kbps per line
  Prioritize: Voice over Video

Penalty Box: Yes (optional - throttle P2P/BitTorrent)

P2P/Torrents:
  P2P Catch: Yes
  Default P2P: P2P Catch All
  Torrents: Lower priority

Games: Yes
  Prioritize multiplayer games

Other Applications:
  Web Browsing: Higher priority
  Streaming: Normal priority

Finish

Manual Queue Creation:

Firewall → Traffic Shaper → By Interface → Add Queue

Name: VoIP_Priority
Priority: 7 (highest)
Bandwidth: 10% or 256 Kbps guaranteed
Queue Limit: 50 packets

Create matching rule:
Firewall → Rules → LAN → Add
  Protocol: UDP
  Destination Port: 5060-5061 (SIP)
  In/Out Queue: VoIP_Priority/VoIP_Priority

Limiters (Per-IP Bandwidth Limits)

Firewall → Traffic Shaper → Limiters → New Limiter

Name: GuestNetwork_Down
Bandwidth: 10 Mbps
Mask: Destination Addresses
Description: Limit guest download speeds

Create upload limiter:
Name: GuestNetwork_Up
Bandwidth: 2 Mbps
Mask: Source Addresses

Apply to firewall rule:
Firewall → Rules → Guest → Edit rule
  Advanced Options
    In/Out pipe: GuestNetwork_Down / GuestNetwork_Up

Essential Packages

pfBlockerNG-devel (Ad Blocking and GeoIP)

Install:

System → Package Manager → Available Packages
Search: pfblockerng-devel
Install

Initial Setup:

Firewall → pfBlockerNG → IP → Configure

Enable pfBlockerNG: Checked
Enable Suppression: Checked
DNSBL Mode: Unbound python mode
DNSBL Listening Interface: LAN

Apply

Add Blocklists:

Firewall → pfBlockerNG → Feeds

IP → Add

Name: EasyList_Ads
Source: IPv4
Action: Deny Both
List Action: Deny
Feeds:
  https://v.firebog.net/hosts/AdguardDNS.txt

Enable and Update

GeoIP Blocking:

Firewall → pfBlockerNG → IP → GeoIP

Select countries to block on WAN interface
Common: China (CN), Russia (RU), North Korea (KP)

Apply and Run

Snort or Suricata (IDS/IPS)

Install Suricata:

System → Package Manager → Available Packages
Search: suricata
Install

Configure:

Services → Suricata → Global Settings

Enable: Checked
Install Emerging Threats rules: Yes
Remove blocked hosts after: 1 hour
Enable Live Rule Swap: Checked

Update Rules Now

Configure Interface:

Services → Suricata → Interfaces → Add

Enable: Checked
Interface: WAN
Description: WAN IDS
Block Offenders: Checked (IPS mode)
Home Net: Define as your LANs

WAN Settings:
  Promiscuous Mode: Unchecked (unnecessary)
  Pattern Matcher: Hyperscan (if supported)

Save

Tune Rules:

Services → Suricata → WAN Rules

Enable categories:
  - Emerging Threats (all)
  - Malware
  - Exploit
  - Web Attacks

Disable noisy rules as needed

Apply

HAProxy (Load Balancer / Reverse Proxy)

Install:

System → Package Manager → Available Packages
Search: haproxy
Install

Backend Configuration:

Services → HAProxy → Backend → Add

Name: webservers_backend
Forwardto: Address + Port
Server List:
  Name: web1
  Address: 192.168.1.100
  Port: 80
  SSL: No

  Name: web2
  Address: 192.168.1.101
  Port: 80

Health Check: HTTP
HTTP Check Method: OPTIONS
URI: /health

Balance: roundrobin

Save

Frontend Configuration:

Services → HAProxy → Frontend → Add

Name: web_frontend
Status: Active
External address: WAN address
Port: 443
Type: ssl / https
Access Control Lists: (optional)
Default backend: webservers_backend

SSL Offloading:
  Certificate: Select certificate

Advanced:
  Use "forwardfor" option: Checked
  Use "httpclose" option: http-keep-alive

Save and Apply

Avahi (mDNS Repeater)

Allows .local domains across VLANs.

System → Package Manager → Available Packages
Search: avahi
Install

Services → Avahi
Enable: Checked
Enable reflection: Checked
Enable reflection across VLANs: Checked
Interfaces: LAN, IoT (select relevant)

Save

High Availability Setup

Create redundant pfSense firewall cluster.

Prerequisites

  • Two identical pfSense boxes
  • Three network interfaces each (WAN, LAN, SYNC)
  • Direct connection between firewalls for SYNC interface
  • Virtual IP addresses (VIPs) for each interface

Primary Firewall Configuration

Step 1: Configure SYNC Interface

Interfaces → Assignments → Add
Assign third interface as SYNC
Save

Interfaces → SYNC
Enable: Checked
IPv4 Configuration Type: Static
IPv4 Address: 192.168.99.1/24 (private sync network)
Description: HA Sync Interface

Save and Apply

Step 2: Configure Virtual IPs (CARP)

Firewall → Virtual IPs → Add

Type: CARP
Interface: LAN
Address: 192.168.1.1 / 24 (will be shared VIP)
Virtual IP Password: (strong password - must match on secondary)
VHID Group: 1 (unique per interface)
Advertising Frequency: 1
Skew: 0 (primary)
Description: LAN CARP VIP

Save

Repeat for WAN:
  Interface: WAN
  Address: <WAN_VIP> (from ISP or your WAN network)
  VHID Group: 2
  Skew: 0

Apply

Step 3: Configure State Synchronization

System → High Avail Sync

State Synchronization Settings:
  Synchronize states: Checked
  Synchronize Interface: SYNC
  pfsync Synchronize Peer IP: 192.168.99.2 (secondary)

Configuration Synchronization Settings:
  Synchronize Config to IP: 192.168.99.2
  Remote System Username: admin
  Remote System Password: (secondary admin password)

  Select All (to sync all settings)

Save

Secondary Firewall Configuration

Identical steps except:

SYNC Interface IP: 192.168.99.2/24

CARP VIPs:
  Same addresses as primary
  Skew: 100 (higher skew = lower priority = secondary)

High Avail Sync:
  State Sync Peer: 192.168.99.1 (primary)
  Do NOT configure Config Sync (only primary pushes)

Step 4: Update DHCP Server

Services → DHCP Server → LAN

DHCP Server:
  Enable on interface using CARP VIP: Checked

Gateway: 192.168.1.1 (CARP VIP, not physical)
DNS servers: 192.168.1.1 (CARP VIP)

Save

Step 5: Testing Failover

Status → CARP (failover)

Should show:
  MASTER (primary) / BACKUP (secondary)

Test:
1. Ping CARP VIP from client: ping 192.168.1.1
2. Disconnect primary WAN or power off primary
3. Ping should continue without dropping
4. Check Status → CARP on secondary (should be MASTER now)
5. Restore primary
6. Primary should reclaim MASTER status

Monitoring and Logging

Dashboard Widgets

Status → Dashboard

Configure:
  - System Information
  - Interfaces (WAN, LAN traffic graphs)
  - Gateways (monitor WAN status)
  - Services Status
  - Firewall Logs (live view)
  - Traffic Graphs
  - CPU Load
  - Memory Usage

Customize layout by dragging widgets

Logging Configuration

Status → System Logs → Settings

Log Message Format: syslog (RFC 5424)
Forward/Reverse Display: Forward (newest at bottom)
GUI Log Entries: 500 (or higher for busier networks)
Log file size: 512000 (500KB per log)

Remote Logging:
  Enable Remote Logging: Checked
  Remote log servers: 192.168.1.50:514
  Remote Syslog Contents: Everything

Save

Real-Time Log Viewing

Status → System Logs → Firewall

Filters:
  Interface: Select specific
  Action: Pass or Block
  Protocol: TCP, UDP, etc.

Auto Refresh: Enable (10 seconds)

Traffic Monitoring

ntopng Package:

System → Package Manager → Available Packages
Install ntopng

Services → ntopng
Enable: Checked
Interfaces: LAN, WAN
Local Networks: 192.168.1.0/24

Access: https://pfsense.local:3000

Darkstat Package:

Install darkstat

Services → darkstat
Interface: LAN
Enable: Checked

Access: https://pfsense.local:666
View real-time bandwidth usage by host

Security Hardening

Secure Web Interface

System → Advanced → Admin Access

Protocol: HTTPS
SSL/TLS Certificate: Create or import proper certificate
TCP Port: Change from 443 to custom (e.g., 8443) for security through obscurity
Max Processes: 2
Session Timeout: 4 hours
Login Protection: 15 minute block after 5 failed attempts

Secure Shell:
  Enable: Yes
  SSHd Key Only: Public Key Only (disable after key setup)
  SSH port: 22 (or custom)

Save

Disable Unused Services

System → Advanced → Miscellaneous

Disable:
  - SNMP daemon (unless actively monitoring)
  - UPnP and NAT-PMP (if not needed)
  - PowerD (on servers with stable power)

Save

Firewall Optimization

System → Advanced → Firewall & NAT

Firewall Optimization: Conservative (for homelab reliability)
Firewall Maximum States: 100000 (increase for busy networks)
Firewall Maximum Table Entries: 400000

Disable:
  - Disable Firewall Scrub (only if causing issues)

Save

Regular Updates

System → Update

Branch: Latest stable release
Update check: Weekly (automatic)

Monitor for:
  - pfSense updates
  - Package updates
  - FreeBSD security advisories

Multi-WAN Configuration

Load balance or failover across multiple ISPs.

Setup:

Interfaces → Assignments
  Assign WAN2, WAN3, etc.

Interfaces → WAN2
  Configure similar to WAN
  Gateway: Create new gateway (e.g., WAN2_GW)
  Monitor IP: 8.8.8.8 (or ISP gateway)

System → Routing → Gateway Groups → Add

Group Name: WAN_LoadBalance
Gateway Priority:
  WAN_DHCP - Tier 1
  WAN2_DHCP - Tier 1
Trigger Level: Packet Loss or High Latency

Save

Firewall → Rules → LAN → Edit default allow rule
  Advanced → Gateway: WAN_LoadBalance

Save and Apply

Failover Configuration:

Gateway Group: WAN_Failover
  WAN_DHCP - Tier 1
  WAN2_DHCP - Tier 2 (only used if WAN fails)

Troubleshooting

No Internet Access

Diagnostics → States → Reset States
System → Routing → Gateways
  Verify WAN gateway is ONLINE

Diagnostics → Ping
  Test connectivity to 8.8.8.8
  Test DNS: ping google.com

Check:
  - WAN interface has valid IP
  - Gateway is reachable
  - DNS servers configured
  - Firewall rules allow LAN to any
  - NAT outbound rules exist

Cannot Access Web GUI

Console → Option 11 (Reset webConfigurator password)
Console → Option 14 (Enable Secure Shell)

SSH to LAN IP:
  pfctl -d (temporarily disable firewall)
  Access GUI
  Fix issue
  pfctl -e (re-enable firewall)

VPN Not Connecting

OpenVPN:
  Status → OpenVPN
    Check server status (should be up)

  Status → System Logs → OpenVPN
    Review connection attempts

  Common fixes:
    - Verify firewall rule on WAN allows UDP 1194
    - Check client certificate validity
    - Verify user credentials
    - Test from different network (rule out ISP blocking)

IPsec:
  Status → IPsec
    Phase 1: Should show ESTABLISHED
    Phase 2: Should show INSTALLED

  Logs: Status → System Logs → IPsec

  Common issues:
    - Pre-shared keys don't match
    - Phase 1/2 encryption mismatch
    - Firewall blocking UDP 500, 4500, ESP protocol

Performance Issues

Diagnostics → Command Prompt

# Check CPU usage
top

# Check memory
top | head

# Check network stats
netstat -i

# Check firewall states
pfctl -si

System → Advanced → Firewall & NAT
  Increase Firewall Maximum States if near limit

Disable unnecessary packages temporarily
Check for DoS/DDoS (Status → System Logs → Firewall)

Conclusion

pfSense transforms networking from a necessary complexity into a powerful tool you fully control. With enterprise features, extensive community support, and proven reliability, pfSense is the ideal firewall solution for serious homelabbers.

Key Takeaways

  • Flexibility: One platform handles routing, firewall, VPN, IDS/IPS, load balancing, and more
  • Cost-Effective: Enterprise features without enterprise pricing
  • Community: Massive user base means solutions to almost any problem exist
  • Scalability: Grows from home lab to production infrastructure
  • Reliability: FreeBSD foundation provides rock-solid stability

Next Steps

Immediate Actions:

  • Deploy pfSense in your lab
  • Configure basic firewall rules
  • Set up OpenVPN for remote access
  • Enable logging and monitoring

Advanced Exploration:

  • Implement VLANs for network segmentation
  • Deploy high availability cluster
  • Add IDS/IPS with Suricata
  • Set up pfBlockerNG for enhanced security

Additional Resources

Document Version: 1.0 Last Updated: December 16, 2025 Difficulty: Advanced Estimated Setup Time: 4-8 hours for full deployment Maintenance: Monthly updates and monitoring