pfSense Setup & Configuration Guide (2026): Install to First Rules

To set up pfSense for the first time: write the USB Memstick installer, boot and install to disk with Auto (ZFS), assign your WAN and LAN interfaces at the console, browse to https://192.168.1.1 to run the setup wizard, then harden the management plane before you build anything on it. pfSense CE and pfSense Plus are FreeBSD-based firewall and routing platforms developed by Netgate. This guide walks you through that whole path, from a fresh install on USB to a working, locked-down WAN+LAN configuration. Installing writes pfSense to disk; the harder part is what comes after — this guide shows how to configure pfSense step by step, from interface assignment and the setup wizard through DHCP, DNS, and your first firewall rules.

How to set up pfSense for the first time:

1. Download and verify the installer. Get the AMD64 USB Memstick Installer from the official pfSense download page and check it against the published SHA-256 checksum.
2. Write the installer to USB. Decompress and dd the image to a USB stick (confirm the target with lsblk first).
3. Boot and install. Boot from USB, accept the notice, choose Auto (ZFS) disk layout, select your disk, then reboot and remove the USB.
4. Assign interfaces. At the console, select option 1 (Assign Interfaces) and set WAN and LAN (for example, igb0 for WAN and igb1 for LAN).
5. Run the setup wizard. From a LAN device browse to https://192.168.1.1 (default login admin / pfsense), then set hostname, DNS, timezone, WAN, and a new admin password.
6. Harden the management plane. Force HTTPS, restrict the GUI to LAN, enable key-only SSH if needed, apply updates, and back up config.xml.

pfSense Configuration: What to Set Up First

Installation only copies pfSense to disk; configuration is what turns it into a working firewall. Once the install completes, configure pfSense in this order — each step depends on the one before it:

1. Assign the WAN and LAN interfaces at the console so pfSense knows which physical port faces the internet and which faces your network (details in Interface assignment).
2. Run the Setup Wizard in the web UI to set the hostname, DNS servers, timezone, WAN mode (DHCP, PPPoE, or static), and the LAN IP (details in First-boot web UI access).
3. Confirm the DHCP server. pfSense enables a DHCP server on the LAN interface by default, handing out 192.168.1.100–199 so client devices get addresses automatically. Adjust the pool under Services → DHCP Server → LAN.
4. Set the DNS Resolver. pfSense runs Unbound (the DNS Resolver) out of the box and resolves names for LAN clients immediately. Point it at upstream resolvers under System → General Setup, or leave it resolving from the root servers.
5. Add your first firewall rules. LAN ships with a default allow-all-outbound rule and WAN blocks all unsolicited inbound. Tighten LAN egress or add port-forwards under Firewall → Rules; rules are evaluated top-down and the first match wins. To block whole regions at the edge, see pfBlockerNG GeoIP blocking.
6. Lock down admin access: force HTTPS, keep the changed admin password, restrict the GUI to LAN, and enable key-only SSH if needed (details in Immediate hardening steps).

Work through those six areas and pfSense goes from a bare install to a firewall that routes, hands out addresses, resolves DNS, and enforces rules. The rest of this guide expands each step.

Hardware: What you need

Any x86-64 system with at least two NICs works. Common homelab choices:

• Protectli FW4C — Intel J3160, 4×GbE, fanless, ~$250 used — community favorite for pfSense CE
• Netgate 1100 — ARM-based, ~$189, ships with pfSense Plus pre-installed
• Netgate 2100 — ARM-based (Marvell OCTEON TX2), official hardware, ~$349, pfSense Plus
• Topton/Cwwk N5105 mini-PC — 4×GbE or 2.5GbE, ~$200, runs pfSense CE well

For a basic WAN+LAN setup any two-NIC x86-64 box is sufficient. If you have not picked a box yet, the best hardware for pfSense in 2026 and the best mini-PC for pfSense round-ups compare the current options on NICs, throughput, and price. Note: pfSense Plus is only officially supported on Netgate hardware or as a paid cloud image; pfSense CE runs on any x86-64. Hardware notes that save trouble later: prefer Intel NICs (igb/em/ix drivers) over Realtek — the Realtek FreeBSD drivers have a long history of throughput/stability issues, and pfSense is FreeBSD-based. Disable onboard hardware RAID and present plain AHCI disks. Keep any IPMI/BMC on a separate management port, never on WAN. Budget a real SSD (not a USB stick) if you’ll run Snort, pfBlockerNG, or reporting — those write continuously and kill cheap flash.

pfSense minimum requirements

pfSense CE and Plus are lightweight. The practical minimum is a 64-bit (amd64) CPU, 1 GB of RAM, 8 GB of disk, and two network interfaces (or one NIC plus a VLAN-capable switch). A basic home firewall runs comfortably on those specs. Add RAM and a real SSD once you enable packages like Snort, Suricata, or pfBlockerNG, which use more memory and write to disk continuously. AES-NI is no longer required but still helps VPN throughput.

Download the installer

pfSense CE (free, community edition):

1. Go to the official pfSense download page and select the AMD64 architecture, USB Memstick Installer (or the ISO if installing to a VM/optical), and the console type that matches your box (VGA for a monitor, Serial for headless appliances).
2. Verify the download against the published SHA-256 checksum before writing — a tampered firewall image compromises everything behind it: sha256sum pfSense-CE-*.img.gz and compare to the site.
3. Decompress and write to USB: gunzip pfSense-CE-*.img.gz then dd if=pfSense-CE-*.img of=/dev/sdX bs=4M status=progress conv=fsync (Linux/macOS). Confirm /dev/sdX with lsblk first — the wrong target destroys that disk.

pfSense Plus (Netgate hardware):

• Comes pre-installed on Netgate appliances. Updates available through the web UI.

Boot and install

1. Boot from USB. The installer launches automatically.
2. Accept the copyright notice → select Install pfSense.
3. Choose Auto (ZFS) for disk layout on modern hardware (recommended), or Auto (UFS) for compatibility.
4. Select your disk → confirm destruction → let install complete.
5. Reboot, remove USB.

Interface assignment

At the console menu, select 1 — Assign Interfaces:

Should VLANs be set up now? → n
Enter the WAN interface name or 'a' for auto-detection: igb0
Enter the LAN interface name: igb1
Do you want to proceed? → y

pfSense will assign interfaces and reboot. If you can’t tell which physical port is which, the assignment dialog supports link-state detection — unplug all cables, then plug into the port you want as WAN when prompted; the interface that comes up is selected. Getting WAN/LAN swapped is the most common first-install mistake and locks you out of the GUI, so confirm the console summary shows LAN as 192.168.1.1/24 before proceeding.

First-boot web UI access

From a LAN-connected device, browse to https://192.168.1.1. Default credentials: admin / pfsense.

The Setup Wizard launches automatically:

• Set hostname and domain (e.g., firewall.home.arpa)
• Configure DNS (1.1.1.1 + 9.9.9.9 or your preferred upstream)
• Set timezone
• Configure WAN (DHCP for most ISPs, PPPoE if required)
• Confirm LAN IP (default 192.168.1.1/24)
• Change the admin password — required step at the end of the wizard

Immediate hardening steps

Lock down the management plane before building services on the box:

1. Force HTTPS, restrict the GUI — System → Advanced → Admin Access: protocol HTTPS, uncheck “WebGUI redirect” so only HTTPS works, optionally move off port 443. pfSense auto-creates an anti-lockout rule on LAN so you can’t fence yourself out; leave it until you have verified out-of-band access if you later tighten LAN rules.
2. Create a non-admin-reuse account / strong password — System → User Manager: keep the default admin password changed (the wizard forces this) and consider a separate named admin account for day-to-day use.
3. SSH, only if needed — System → Advanced → Admin Access → Secure Shell: enable, set Authentication Method to public key only, disable root password login. The GUI and SSH should listen on LAN, never WAN.
4. Never expose the GUI to WAN. There is no legitimate reason to have the pfSense web UI reachable from the internet without, at minimum, an IP allowlist and HTTPS; exposed firewall panels are continuously scanned. Use a VPN for remote administration instead, such as the tunnel in the WireGuard VPN setup guide, which lets you reach the LAN-side GUI without opening it to the internet.
5. Updates — System → Update: set Branch to the current stable, and apply the latest patch level before configuring anything — the installer image usually lags.
6. Back up the config now — Diagnostics → Backup & Restore: download config.xml (encrypt it; it contains secrets) and set up Auto Config Backup if you have a Netgate account. A firewall config is trivial to back up and painful to rebuild from memory.
7. Plan remote logging — Status → System Logs → Settings: add a remote syslog target so logs survive a disk failure.

Quick verification: from LAN, https://192.168.1.1 should load over HTTPS only; from a WAN-side device the GUI and SSH should be unreachable; System → Update should show you on the latest patch.

When not to do certain things

Don’t enable WAN GUI/SSH “temporarily” without an allowlist. Don’t virtualize pfSense on the same host as the workloads it protects unless you fully understand NIC pass-through and the shared failure domain. Don’t skip the post-install update expecting the installer to be current. And for a simple home network, you do not need pfSense Plus or Netgate hardware — pfSense CE on a modest Intel-NIC box is entirely sufficient; choose Plus/Netgate when you specifically want official support or Plus-only features.

Common first-setup problems

The same handful of issues trip up most first installs. Each has a quick fix:

• No internet on LAN after setup. Almost always a WAN that did not pull an address, or WAN/LAN swapped. Check Status → Interfaces for a valid WAN IP. If WAN shows a private/APIPA address, your ISP modem may need a power-cycle to release the old MAC, or it is in router mode handing out a double-NAT address.
• Locked out of the GUI. If you swapped WAN and LAN, the anti-lockout rule is now on the wrong port. Reconnect to the console, re-run option 1 (Assign Interfaces), and confirm LAN is the port your management device is plugged into.
• GUI loads but pages are slow or time out. Frequently a DNS problem. Set explicit upstream resolvers in System → General Setup and confirm the box itself can resolve names from Diagnostics → DNS Lookup.
• Realtek NIC drops under load. A known FreeBSD-driver limitation, not a misconfiguration. If you see throughput collapse during large transfers on a Realtek port, an Intel NIC is the real fix.

Can I restore a config instead of reinstalling?

Yes. If you backed up config.xml from a previous box, a fresh install can be brought up to a known state in minutes via Diagnostics → Backup & Restore → Restore. This is the fastest disaster-recovery path and the reason the hardening checklist puts a config backup first.

FAQ

How do I configure pfSense? Configure pfSense in six stages: assign the WAN and LAN interfaces at the console, run the web-based Setup Wizard (hostname, DNS, timezone, WAN, admin password), confirm the LAN DHCP server and DNS Resolver, then add rules under Firewall → Rules. Finish by forcing HTTPS, restricting the GUI to LAN, and backing up config.xml before building any services.

How do I install pfSense? Download the AMD64 USB Memstick installer from the official pfSense site, verify its SHA-256 checksum, and write it to a USB stick with dd or a USB imager. Boot from the stick, choose the Auto (ZFS) disk layout, let it install, then reboot and remove the USB. Netgate appliances ship with pfSense Plus pre-installed, so no imaging is needed.

What are the minimum requirements for pfSense? pfSense CE and Plus need a 64-bit (amd64) CPU, at least 1 GB of RAM, 8 GB of disk, and two network interfaces (or one NIC with a VLAN-capable switch). Those specs handle a basic home firewall. Add RAM and a real SSD before enabling packages such as Snort, Suricata, or pfBlockerNG, which use more memory and write continuously.

What is the default IP address and login for pfSense? After installation, pfSense listens on the LAN interface at https://192.168.1.1. The default web-UI login is username admin with password pfsense. The Setup Wizard forces you to change that password on first login, and you should never leave the default in place. The GUI should stay bound to LAN and never be exposed to the WAN or internet.

Is pfSense CE or pfSense Plus better for home use? For most home and homelab networks, pfSense CE is enough: it is free, runs on any x86-64 hardware, and shares the same core firewall engine as Plus. pfSense Plus adds official Netgate support and a few Plus-only features and is officially supported only on Netgate hardware or a paid cloud image. If you are still weighing platforms, compare pfSense vs OPNsense for a homelab and OpenVPN vs WireGuard on pfSense before you commit.

Next steps

• VLAN configuration on pfSense — segment IoT, guest, and trusted traffic
• pfBlockerNG setup — DNS-based ad and tracker blocking
• Snort vs Suricata on pfSense — choosing and running inline intrusion detection
• WireGuard VPN setup on pfSense — the secure way to reach the GUI remotely
• pfSense references hub: the commands, ports, and config references that back these guides

Comparing platforms? See firewallcompare.com ↗ for pfSense vs OPNsense ↗ vs UniFi side-by-side.