pfSense (FreeBSD) Cheatsheet

pfSense is an open-source firewall/router computer software distribution based on FreeBSD. It is installed via a bare-metal ISO. While mostly managed via the WebGUI, the CLI provides powerful troubleshooting tools.

When you SSH into pfSense or access it via serial, you are greeted with the pfSense menu (usually /etc/rc.initial).

Press 8 to drop into the standard FreeBSD Shell.
Press 15 to restore a recent configuration backup.
Press 16 to restart PHP-FPM (useful if the WebGUI crashes).

Network Troubleshooting (`pf` and FreeBSD Tools)

# Show routing table
netstat -rn
 
# Show active network connections
netstat -an
 
# Show active states in the pf firewall (equivalent to connection tracking)
pfctl -s states
 
# View pf firewall rules
pfctl -s rules
 
# Reload pf firewall rules (useful if you get locked out and change config.xml)
pfctl -f /tmp/rules.debug
 
# Disable packet filtering entirely (Emergency use only! Drops all security)
pfctl -d
 
# Re-enable packet filtering
pfctl -e

Packet Capture (`tcpdump`)

Since pfSense is FreeBSD-based, it uses standard tcpdump.

# Capture traffic on WAN interface (e.g., igb0) on port 80
tcpdump -i igb0 port 80
 
# Capture traffic from a specific IP
tcpdump -i igb1 host 192.168.1.100
 
# Capture ICMP (ping) traffic
tcpdump -i igb1 icmp

Configuration Management

pfSense stores its entire configuration in a single XML file: /conf/config.xml.

# View the config file
cat /conf/config.xml
 
# Backup the config file locally
cp /conf/config.xml /conf/config.xml.backup

If you lock yourself out, you can restore from a backup using the console menu (Option 15). Backups are stored in /conf/backup/.

Logs

pfSense uses a circular logging system (clog) to prevent logs from filling the disk.

# View the firewall filter log
clog /var/log/filter.log
 
# View the DHCP log
clog /var/log/dhcpd.log
 
# View the system log
clog /var/log/system.log
 
# Follow a log in real-time
clog -f /var/log/system.log

System Updates

While usually done via the GUI, you can update from the CLI menu by selecting option 13, or from the shell:

pfSense-upgrade

Useful FreeBSD Commands

top -a                     # Monitor processes (press 'q' to quit)
ifconfig                   # View interface IP and MAC addresses
sockstat -4                # Show listening IPv4 ports (FreeBSD equivalent to netstat -tulpn)

Cheatsheets