pfSense is open source software that can be used to turn a computer into a firewall/router. Its origins can be traced to the FreeBSD packet-filtering program known as PF, which has been part of FreeBSD since 2001. As PF is a command-line utility, work soon began on developing software that would provide a graphical frontend to PF. The m0n0wall project, which provides an easy-to-use, web-based interface for PF, was thus started. The first release of m0n0wall took place in 2003. pfSense began as a fork of the m0n0wall project.

Version 1.0 of pfSense was released on October 4, 2006, and version 2.0 was released on September 17, 2011. A key point in the development of pfSense took place with the release of Version 2.3 on April 12, 2016. This version phased out support for legacy technologies such as Point to Point Tunneling Protocol (PPTP), Wireless Encryption Protocol (WEP), and Single DES, and also provided a face-lift for the web GUI. Version 2.4, released on October 12, 2017, continues this trend of phasing out support for legacy technologies while also adding features. Support for 32 bit x86 architectures has been deprecated, while support for Netgate Advanced RISC Machines (ARM) devices has been added. A new pfSense installer (based on FreeBSD’s bsdinstall) has been incorporated into pfSense, and there is support for the ZFS filesystem, as well as the Unified Extensible Firmware Interface (UEFI). pfSense now supports multiple languages; the web GUI has been translated into 13 different languages.

This chapter will cover the basic configuration steps common to virtually all deployments. Once you have completed the recipes in this chapter, you will have a fully functional router/firewall. By following the recipes in subsequent chapters, you can enhance that functionality by adding specific firewall rules, enabling traffic shaping, adding load balancing and multi-WAN capabilities, and much more.

This recipe describes how to configure core pfSense settings from the web GUI.

All that is required for this recipe is a fresh install of pfSense and access to the web GUI.

1. In the web GUI, navigate to System | General Setup.
2. In the first section of the page (System), enter a Hostname. This name can be used to access the firewall instead of the IP address:

3. In the next field, enter the Domain:

4. The next field is DNS Servers. By default, pfSense will act as the primary DNS server; however, you can specify alternate DNS servers here. The Add DNS Server button causes an additional edit box to appear, into which you can enter another DNS server; you can add as many alternate DNS servers as is necessary:

5. Check the Allow DNS server list to be overridden by DHCP/PPP on WAN checkbox (it should be checked by default). This ensures that any DNS requests that cannot be processed internally will be passed on to the external DNS servers, as specified by your ISP:

6. In the Localization section, specify a Timezone and leave Timeservers at the default value of 0.pfsense.pool.ntp.org. Specify the appropriate Language (the default is English):

7. In the webConfigurator section, I’d recommend the default Theme of pfSense. You can set Top Navigation to either Scrolls with page (appropriate for all screen sizes) or Fixed (designed for large screens only). You may also set the number of Dashboard Columns (the default is 2):

8. When done, click on the Save button.

• The Configuring the DNS Forwarder recipe in Chapter 2, Essential Services.

This recipe describes how to identify interfaces on a network configuration and how to assign them in pfSense.

You need to identify the MAC addresses for each Ethernet port on your pfSense system before attempting to assign them.

1. Navigate to Interfaces | Interface Assignments.
2. Assign a WAN interface, first by selecting the correct MAC address from the drop-down list for the WAN interface:

3. Repeat this process for the LAN interface, selecting the correct MAC address from the drop-down list for the LAN interface. If necessary, add the LAN interface to the list by following this process:
   1. Click on the Add button in the Available network ports column.
   2. Click on the name of the newly created interface in the Interfaces column (it should be OPT1).
   3. When the configuration page for the interface loads, change Description to LAN.
   4. Click on the Save button at the bottom of the page.
   5. Navigate back to Interfaces | Interface Assignments.
4. If you want to add optional interfaces, you can do so by repeating step 3 and substituting the name of the optional interface (for example, DMZ) for LAN.
5. When you are done assigning interfaces, click on the Save button.

• The Assigning interfaces at the console recipe

This recipe describes how to configure the Wide Area Network (WAN) interface, which provides access to external networks on our pfSense system.

The WAN interface is your connection to external networks (in most cases, the public internet). You will need a properly configured WAN interface and an internet connection. In this example, we will connect to the internet via an Internet Service Provider (ISP) and a cable modem.

1. Navigate to Interfaces | WAN.
2. Check the Enable Interface checkbox (it should be checked by default):

3. Choose an IPv4 Configuration Type (usually DHCP).
4. Choose an IPv6 Configuration Type, or leave it set to None.
5. Leave MAC Address blank. Manually entering a MAC address here is known as MAC address spoofing. You can enter a MAC address here if you want to force your ISP to hand you a different IP address, or a different set of DNS servers. Be warned, however, that the MAC address entered must have a valid manufacturer’s prefix or it won’t work.
6. Leave MTU, MSS, Hostname, and Alias IP address blank.

7. Check the Block private networks and loopback addresses checkbox (it should be checked by default). This will block RFC 1918 private addresses from being sent out over the public internet.
8. Check the Block bogon networks checkbox (it should be checked by default). This will block packets from IP addresses not yet assigned by IANA from being sent or received:

9. Click on the Save button when done.

We must first establish a connection to the internet before we can configure pfSense to allow other networks to access it. The example we provided is a typical WAN configuration for a Small Office/Home Office (SOHO) environment. By setting up the WAN interface as the only interface with direct access to the internet, we are securing the network behind the firewall and establishing complete control over our networks. All networks behind the firewall must now abide by the rules we create.

Now that we have configured the WAN interface, we can connect the cable modem to the WAN port on pfSense and check the status of the WAN port by navigating to Status | Interfaces.

• The Identifying and assigning interfaces recipe in this chapter
• The Configuring a LAN interface recipe in this chapter
• The Configuring optional interfaces from the console recipe in this chapter

This recipe describes how to configure the Local Area Network (LAN) internal interface of our pfSense firewall.

The LAN interface is the interface to the internal network through which our nodes will be able to securely connect to other internal nodes and to the internet. An assigned LAN interface is required.

1. Navigate to Interfaces | LAN.
2. Check the Enable Interface checkbox:

3. Choose an IPv4 Configuration Type (usually Static IPv4).
4. Choose an IPv6 Configuration Type (or leave it set to None).
5. Enter an IPv4 Address in the appropriate field, and the correct CIDR in the adjacent drop-down box. Leave IPv4 Upstream gateway set to None.
6. If you enabled IPv6 by setting the IPv6 Configuration Type, enter an IPv4 Address in the appropriate field and the correct CIDR in the adjacent drop-down box.
7. Leave Block private networks and Block bogon networks unchecked (they should be unchecked by default).
8. When you are done making changes, click on the Save button. When the page reloads, click on the Apply Changes button.

You have just defined your first internal network. If you have been following these recipes in order, you now have met the minimal requirements for a fully functional network. You can now either continue adding networks, or start configuring the rules to regulate traffic between the networks.

You can now connect a switch to the LAN port of your pfSense system, and connect nodes to the LAN network.

• The Identifying and assigning interfaces recipe in this chapter
• The Configuring a WAN interface recipe in this chapter
• The Configuring optional interfaces from the console recipe in this chapter