pfSense Installation and Basic Configuration for Businesses

pfSense is an open-source firewall and router based on FreeBSD, used in businesses as a central point for network segmentation, VPN, traffic filtering, and intrusion detection. For small and medium-sized enterprises (SMEs), it represents a cost-effective alternative to expensive commercial solutions, while offering features typically found in devices costing ten times as much.

TL;DR — Key Points

• pfSense is a free, commercially supported firewall solution (Netgate)
• For up to 50 employees, a Netgate 4200 class device or a similar mini PC with 2–4 GbE interfaces is sufficient
• Critical steps: separate WAN/LAN, default deny, VLAN segmentation, clock synchronization, regular configuration backups
• For remote access, use WireGuard or OpenVPN; never expose the web interface to the WAN

Why pfSense instead of a consumer router

Consumer routers are designed for home ease of use. In a business, you quickly run into limitations: unreliable VPN, lack of proper segmentation, no control over DNS, and no event logs. pfSense offers a true stateful firewall, packet-level NAT, High Availability (HA) in pairs, built-in IPsec/WireGuard/OpenVPN, and a rich ecosystem of packages such as Suricata (IDS/IPS), pfBlockerNG (DNS filtering), and HAProxy.

Let's compare typical capabilities:

Hardware Selection

Performance depends primarily on connection speed and enabled services. As a general guide:

If you want long-term stability and commercial support, we recommend original Netgate devices. Cheaper mini PCs work great, but in case of issues, you depend on the community.

Step-by-Step Installation

1. Download the pfSense CE or Plus ISO/memstick image from the official site and verify the checksum (SHA256).
2. Boot the device from the USB stick, select Install, and install to SSD (ZFS recommended).
3. After the first boot via the console, define the WAN and LAN interfaces (WAN → to modem, LAN → to switch).
4. Open the web interface at `https://192.168.1.1` with the default credentials `admin / pfsense`.
5. In the wizard, set the hostname, time zone to Europe/Ljubljana, DNS servers (e.g., 1.1.1.1 and 9.9.9.9), and change the password.

After the wizard, always ensure that administrative access is allowed only from the LAN network — in System → Advanced → Admin Access, enable HTTPS and change the default port if possible.

Segmentation with VLANs

Proper VLAN setup makes the difference between a "working network" and a "secure network." Suggested minimal segmentation for SMEs:

• VLAN 10 — LAN (workstations, printers)
• VLAN 20 — Servers (Active Directory, NAS, ERP)
• VLAN 30 — Guests / WiFi (isolated from LAN, internet only)
• VLAN 40 — IoT (cameras, sensors, alarms)
• VLAN 99 — Management (access to switches, access points)

Add VLANs in pfSense under Interfaces → VLANs, then assign each its own network range and DHCP. Establish explicit permissions between VLANs — the default should be deny.

Basic Firewall Rules

When writing rules, follow the principle of least privilege. For a typical SME environment:

1. LAN → WAN: allow HTTP/S, DNS, IMAP/S, SMTPS. Block and log everything else.
2. GUEST → WAN: only TCP 80/443 and UDP 53 to your DNS servers.
3. IoT → WAN: allow only specific destination domains (e.g., camera manufacturer's cloud).
4. Any VLAN → Management: explicitly block, except for the administrative workstation.

Remote Access VPN

For remote users, we recommend WireGuard — it is fast, easy to maintain, and battery-friendly for laptops. IPsec remains the standard choice for site-to-site connections between offices. Read more about the differences in our article on VPN solutions for businesses.

Regardless of the chosen protocol, always enable MFA (e.g., TOTP via FreeRADIUS + Google Authenticator package) and limit access to specific internal resources — the Zero Trust principle.

Monitoring, Backups, and Updates

Export the pfSense configuration regularly (Diagnostics → Backup & Restore) and store it in a secure off-site location — for example, in encrypted object storage in Azure. Perform updates during a maintenance window and always check any release notes. For performance monitoring, we recommend sending syslog events to a central collector (Graylog, Elastic) or Azure Log Analytics.

Common Mistakes Seen in Practice

• Admin interface exposed to WAN without restrictions — always close it or restrict it with TLS + MFA and a source IP filter
• Default "LAN → any" rule not restricting IoT and guests, allowing lateral movement for an attacker
• Missing regular configuration backups
• Not using pfBlockerNG to block known malicious domains

Do I need the paid pfSense Plus version?

For most SMEs, the free pfSense CE is perfectly adequate. The Plus version (included with Netgate hardware) offers additional optimizations, ZFS boot environments, and commercial support, which we recommend for production environments.

How much can pfSense handle on a 1 Gbps connection?

Modern CPU generations (Intel N100, Atom C3000, Xeon-D) easily handle 1 Gbps traffic even with IDS enabled. For 2.5 and 10 Gbps, we recommend a Xeon-D or more powerful platform.

Does pfSense replace Windows Server for DHCP and DNS?

Generally yes for DHCP. For DNS, pfSense is an excellent resolver, but in environments with Active Directory, the internal DNS records should be managed by AD, with pfSense acting as a forwarder for the internet.

How often should pfSense be updated?

Minor patches can be installed monthly; major versions should be tested in a staging environment and upgraded during a maintenance window. Always perform a configuration backup before upgrading.