Glossary

Named lists of IPs/ports/URLs referenceable in firewall rules. URL-table aliases pull and refresh remote lists on a schedule; this is the integration point for community blocklists.

Built-in pfSense feature for splash-page authentication on a specific interface. Useful for a guest VLAN with terms-of-use acknowledgment or RADIUS-backed login.

Common Address Redundancy Protocol. Active/standby HA via a shared virtual IP. Pair with config sync (XML-RPC) and state sync (pfsync) for full failover.

pfSense ships both: Resolver (Unbound, the default) recurses queries itself; Forwarder (dnsmasq) forwards to upstream resolvers. Use Resolver unless you have a specific reason — keeps queries off third-party logs.

Rules that span multiple or all interfaces. Useful for policy routing and global blocks. Match-direction matters: "out" rules can shape outbound traffic on the egress side.

pfSense has four outbound-NAT modes: Automatic, Hybrid, Manual, Disabled. Hybrid is the right pick once you start needing custom rules — automatic rules stay below your manual ones.

Combined DNSBL ad-blocker + GeoIP blocker + IP threat-intel feeds. The single most-installed package on homelab pfSense. Replaces Pi-hole for most users.

CE (Community Edition) is the open-source Apache-licensed release for any x86 hardware. Plus is closed-source, free on Netgate hardware, paid subscription elsewhere. Same FreeBSD base, divergent feature sets since 2021.

Alternative IDS package, the original Cisco-Talos engine. Suricata is the more common choice on modern pfSense, but Snort 3 is still available and useful if you have existing Talos rule subscriptions.

Installer-supported option since pfSense 2.5. Enables boot-environment snapshots ("bectl" or via the GUI). Use it for any production install — UFS doesn't offer pre-upgrade rollbacks.