pfSense (FreeBSD) Cheatsheet

pfSense is an open-source firewall/router computer software distribution based on FreeBSD. While mostly managed via the WebGUI, the CLI provides powerful troubleshooting tools.

When you SSH into pfSense or access it via serial, you are greeted with the pfSense menu (usually /etc/rc.initial).

Press 8 to drop into the standard FreeBSD Shell.

Network Troubleshooting

# Show all interfaces and IP addresses
ifconfig
 
# Show routing table
netstat -rn
 
# Show ARP table (MAC address to IP mappings)
arp -a
 
# Ping a host
ping 8.8.8.8

Packet Sniffing (`tcpdump`)

Since pfSense is FreeBSD, tcpdump is the primary tool for packet capture.

# Capture traffic on the WAN interface (usually igb0, ix0, etc.)
tcpdump -i ix0
 
# Capture only ICMP (ping) traffic
tcpdump -i ix0 icmp
 
# Capture traffic for a specific IP
tcpdump -i ix0 host 192.168.1.50

Firewall State Table (`pf`)

pfSense uses pf (Packet Filter) under the hood.

# Show current firewall states
pfctl -s states
 
# Flush all states (Drops all active connections!)
pfctl -F states
 
# Reload firewall rules
pfctl -f /tmp/rules.debug

Configuration Backup and Restore

The entire pfSense configuration is stored in a single XML file: /conf/config.xml.

# Force a sync/backup (if using AutoConfigBackup)
/etc/rc.create_acb_backup
 
# Reboot the firewall safely
/etc/rc.reboot

Cheatsheets