How to Install pfSense in a Proxmox VM: Step-by-Step Guide

If you want a capable open-source firewall running inside your Proxmox hypervisor, knowing how to install pfSense in a Proxmox VM is the right starting point. This guide covers every decision that actually matters: bridge topology, VirtIO driver settings, ZFS partitioning during install, and the hardware checksum offload fix that causes mysterious packet drops if you skip it.

Prerequisites

Before creating the VM, confirm you have:

• Proxmox VE 7.x or 8.x installed on the host with web GUI access
• Two physical NICs on the Proxmox host — one for WAN uplink, one for the LAN segment. A single-NIC setup with VLAN trunking is possible but adds complexity; skip it for a first deployment.
• pfSense CE ISO (AMD64 DVD Image) downloaded from the official Netgate mirrors. The AMD64 DVD Image is the correct artifact — not the memstick variant.
• Host headroom for the guest. The documented floor is 1 GB RAM and an 8 GB disk; 2-4 vCPUs, 4 GB RAM, and a 32 GB virtual disk is the sensible baseline for a homelab router, and IDS/IPS pushes it higher again. Scale it with the same package rules that apply on bare metal — the pfSense hardware requirements guide sets out what Suricata and pfBlockerNG add to the RAM and storage figures.

Create the Linux Bridges

Proxmox uses Linux bridges to connect VM NICs to the physical network. You need two: one for WAN, one for LAN.

In the Proxmox web UI, navigate to your node → System > Network, then click Create > Linux Bridge:

• vmbr1 (WAN bridge): Assign your WAN-facing physical interface (e.g., enp4s0) as the bridge port.
• vmbr2 (LAN bridge): Assign your LAN-facing physical interface (e.g., enp5s0) as the bridge port.

Click Apply Configuration. Proxmox may require a reboot before new bridges show as active. If your host only has one physical NIC, you can leave the LAN bridge without a physical port and connect guest VMs to it directly — pfSense will route between them through NAT.

Upload the pfSense ISO

Go to your node → local storage > ISO Images > Upload. Select the pfSense CE ISO you downloaded. Wait for the “TASK OK” confirmation before proceeding.

Create the VM

Click Create VM in the top-right corner of the Proxmox UI and configure each tab:

Tab	Setting	Value
General	Name	pfsense (or any label)
OS	CD/DVD image	Select your uploaded pfSense ISO
OS	Guest OS type	Other
System	Machine	i440fx (default); use q35 only if you need PCI passthrough
System	BIOS	SeaBIOS (default); switch to OVMF for UEFI, but add an EFI disk and disable Secure Boot on first boot
Disks	Bus/Device	VirtIO Block
Disks	Disk size	8 GB minimum, 32 GB recommended
CPU	Sockets/Cores	1 socket, 2–4 cores
CPU	Type	host
Memory	RAM	1024 MiB minimum, 4096 MiB recommended
Network	Bridge	vmbr1
Network	Model	VirtIO (paravirtualized)

After the wizard completes, add the second NIC manually: select the VM → Hardware > Add > Network Device. Set bridge to vmbr2, model to VirtIO (paravirtualized). You now have vtnet0 on vmbr1 and vtnet1 on vmbr2.

VirtIO provides near-native throughput by bypassing the emulation layer. Using the default e1000 or rtl8139 model works but cuts performance significantly and gains you nothing on pfSense.

Install pfSense from the Console

Start the VM and open the Console tab. pfSense CE boots the installer automatically:

1. Accept the copyright notice.
2. Select Install pfSense.
3. Choose your keymap (default US is fine).
4. Select Auto (ZFS) for partitioning — it handles boot environments cleanly.
5. Choose stripe for ZFS VDEV type (you have one virtual disk).
6. Select vtbd0 using the spacebar, then confirm with OK.
7. Confirm the installation target. The installer will warn this destroys the disk — accept it.
8. Decline the optional shell access prompt, then select Reboot.

Remove the ISO after the reboot prompt: in Proxmox, go to the VM’s Hardware tab, select the CD/DVD drive, and click Do not use any media before the VM boots back up.

Assign Interfaces and Fix Checksum Offloading

On the first boot, pfSense presents a CLI interface assignment prompt:

Do you want to set up VLANs now? (y/n): n
Enter the WAN interface name: vtnet0
Enter the LAN interface name: vtnet1
Do you want to proceed? (y/n): y

Once the system finishes booting, the LAN IP defaults to 192.168.1.1. Access the web GUI from a machine on the LAN segment at http://192.168.1.1 using credentials admin / pfsense. Change the password immediately. Everything after this point is the same as on bare metal, so the wizard, WAN configuration, and management-plane lockdown are covered in the pfSense initial setup guide.

The single most common gotcha with pfSense on Proxmox: hardware checksum offloading. VirtIO NICs under Proxmox report offload capabilities that pfSense acts on, causing corrupted checksums and packet drops that look like general network instability. Per the official Netgate documentation, you must disable this:

Navigate to System > Advanced > Networking, check Disable hardware checksum offload, save, and reboot the VM. Recent pfSense versions attempt to auto-disable this for vtnet interfaces, but verify the checkbox manually — the cost of a missed packet is harder to debug than a 30-second settings check.

Optional: QEMU Guest Agent

Install the qemu-guest-agent package through the pfSense package manager (System > Package Manager > Available Packages). This enables proper VM lifecycle management from the Proxmox host — graceful shutdown, memory ballooning, and filesystem freeze during snapshots. Enable it in Proxmox under the VM’s Options > QEMU Guest Agent after the package is installed.

What You Have Now

A pfSense VM on Proxmox with VirtIO drivers, correctly assigned WAN/LAN bridges, and checksum offload disabled. From here, the standard hardening path applies: assign a real WAN IP via DHCP or static, configure firewall rules, and optionally run an inline IDS/IPS on the WAN interface, where the Snort vs Suricata comparison covers which engine to install and how to stage it without dropping legitimate traffic. Segmentation is the other natural next step: the pfSense VLAN configuration guide turns the single LAN bridge above into isolated trusted, IoT, and guest networks, which on a Proxmox host means either extra bridges or 802.1Q tags handled inside the VM.