pfSense (FreeBSD) Cheatsheet

Cheatsheet#pfsense

pfSense (FreeBSD) Cheatsheet

pfSense is an open-source FreeBSD-based firewall and router. While primarily managed via the WebGUI, the FreeBSD CLI and pfSense internal utilities (easyrule, pfctl, playback, viconfig) provide essential emergency recovery and troubleshooting capabilities.

The Console Menu (`/etc/rc.initial`)

When accessing pfSense via SSH or Serial Console:

Option	Action	Description
`1`	Assign Interfaces	Reassign physical NICs (WAN, LAN, VLANs)
`2`	Set interface IP address	Configure static IP / DHCP on WAN/LAN
`3`	Reset webConfigurator password	Reset admin password to default (`pfsense`)
`4`	Reset to factory defaults	Full system wipe and factory reset
`8`	Shell	Drop to root FreeBSD shell
`11`	Restart webConfigurator	Restart PHP-FPM and Lighttpd/Nginx WebGUI
`15`	Restore recent configuration	Restore from automatic XML backup points
`16`	Restart PHP-FPM	Quick fix for blank WebGUI or 502 Bad Gateway

EasyRule CLI (`easyrule`)

easyrule allows administrators to add firewall rules directly from the command line without logging into the WebGUI or manual XML editing. It automatically updates /conf/config.xml and reloads the filter.

Syntax & Operations

# Block an IP address on WAN interface
easyrule block wan <ip_address>
 
# Pass (Allow) traffic from a source IP to a destination IP/Port
easyrule pass <interface> <protocol> <source_ip> <destination_ip> [destination_port]
 
# Unblock an IP address
easyrule unblock <interface> <ip_address>

Real-World Examples

# Emergency: Allow SSH (Port 22) to LAN interface from any host
easyrule pass lan tcp any 192.168.1.1 22
 
# Allow HTTPS (Port 443) from WAN to a specific server IP
easyrule pass wan tcp any 192.168.1.50 443
 
# Instantly block a malicious attacker IP on WAN
easyrule block wan 203.0.113.45
 
# View current EasyRule blocklist table
pfctl -t easyrule_block_wan -T show

Packet Filtering & State Table Control (`pfctl`)

pfSense uses FreeBSD's pf (Packet Filter). pfctl controls the runtime state and rule engine.

Inspecting Rules & States

# Display active connection states (Connection tracking)
pfctl -s states
 
# Filter state table for a specific IP
pfctl -s states | grep 192.168.1.100
 
# Display currently active rules in memory
pfctl -s rules
 
# Display pf tables (e.g., bogons, virutaldns, easyrule)
pfctl -s Tables
 
# View contents of a specific table
pfctl -t sshguard -T show

Emergency Filter Controls

# Reload firewall rules from generated debug file (Safe reload)
pfctl -f /tmp/rules.debug
 
# Flush state table (Drop all active connections)
pfctl -F state
 
# Flush all rules, states, and tables
pfctl -F all
 
# Disable packet filter ENTIRELY (Emergency unblock - DROPS ALL FIREWALL SECURITY)
pfctl -d
 
# Re-enable packet filter
pfctl -e

Configuration Management (`/conf/config.xml`)

pfSense stores its entire system configuration in a single XML file.

# View active configuration
cat /conf/config.xml
 
# Safely edit config.xml with auto-validation & automatic PHP-FPM reload
viconfig
 
# Manual backup of config.xml
cp /conf/config.xml /conf/config.xml.bak_$(date +%F)
 
# List automatic configuration backups
ls -lh /conf/backup/

Resetting Admin Password from Shell

If locked out of WebGUI and Option 3 fails:

# Run pfSense PHP script to reset admin password to 'pfsense'
/etc/rc.initial.password

System Scripts & Service Management

# Reload WebGUI services & certificates
/etc/rc.restart_webgui
 
# Reload DNS Resolver (Unbound)
/etc/rc.d/unbound restart
 
# Force dyndns update
/etc/rc.dyndns.update
 
# Force rule generation and reload filter
/etc/rc.filter_configure

Log Inspection (`clog` & `logf`)

pfSense 2.4+ uses circular binary log files (clog) to prevent disk exhaustion. Modern 2.5+ / 2.6+ uses standard text logs or clog wrappers.

# View firewall filter logs (Blocked/Allowed packets)
clog /var/log/filter.log | tail -n 50
 
# Follow firewall logs in real-time
clog -f /var/log/filter.log
 
# View system log
clog /var/log/system.log
 
# View DHCP Server log
clog /var/log/dhcpd.log
 
# View OpenVPN log
clog /var/log/openvpn.log

Packet Capture (`tcpdump`)

# Capture traffic on WAN interface (e.g., igb0 / em0)
tcpdump -i igb0 -n
 
# Capture traffic on LAN for specific IP and Port 80/443
tcpdump -i igb1 -n host 192.168.1.100 and '\(port 80 or port 443\)'
 
# Capture ICMP (Ping) traffic on WAN
tcpdump -i igb0 -n icmp
 
# Save packet capture to PCAP file for Wireshark analysis
tcpdump -i igb0 -w /tmp/capture.pcap

Useful FreeBSD Utilities

# Check physical network link status and MAC addresses
ifconfig
 
# Display routing table
netstat -rn
 
# Display listening ports and owning processes (FreeBSD equivalent to netstat -tulpn)
sockstat -4 -l
 
# Monitor CPU, RAM, and system load
top -a

Cheatsheets