pfSense Hardware Appliance: Netgate vs Protectli vs DIY

To set up pfSense for the first time: write the USB Memstick installer, boot and install to disk with Auto (ZFS), assign your WAN and LAN interfaces at the console, browse to https://192.168.1.1 to run the setup wizard, then harden the management plane before you build anything on it. pfSense CE and pfSense Plus are FreeBSD-based firewall and routing platforms developed by Netgate. This guide walks you through that whole path, from a fresh install on USB to a working, locked-down WAN+LAN configuration.

How to set up pfSense for the first time:

1. Download and verify the installer. Get the AMD64 USB Memstick Installer from the official pfSense download page and check it against the published SHA-256 checksum.
2. Write the installer to USB. Decompress and dd the image to a USB stick (confirm the target with lsblk first).
3. Boot and install. Boot from USB, accept the notice, choose Auto (ZFS) disk layout, select your disk, then reboot and remove the USB.
4. Assign interfaces. At the console, select option 1 (Assign Interfaces) and set WAN and LAN (for example, igb0 for WAN and igb1 for LAN).
5. Run the setup wizard. From a LAN device browse to https://192.168.1.1 (default login admin / pfsense), then set hostname, DNS, timezone, WAN, and a new admin password.
6. Harden the management plane. Force HTTPS, restrict the GUI to LAN, enable key-only SSH if needed, apply updates, and back up config.xml.

Hardware: What you need

Any x86-64 system with at least two NICs works. Common homelab choices:

• Protectli FW4C — Intel J3160, 4×GbE, fanless, ~$250 used — community favorite for pfSense CE
• Netgate 1100 — ARM-based, ~$189, ships with pfSense Plus pre-installed
• Netgate 2100 — ARM-based (Marvell OCTEON TX2), official hardware, ~$349, pfSense Plus
• Topton/Cwwk N5105 mini-PC — 4×GbE or 2.5GbE, ~$200, runs pfSense CE well

For a basic WAN+LAN setup any two-NIC x86-64 box is sufficient. If you have not picked a box yet, check the documented floors in the pfSense hardware requirements guide first, then compare current options on NICs, throughput, and price in the best hardware for pfSense in 2026 and best mini-PC for pfSense round-ups. If you are still deciding between a Netgate box, a third-party fanless unit, and a build of your own, the pfSense appliance versus DIY comparison walks the trade-offs. Note: pfSense CE runs on any x86-64 hardware, while pfSense Plus ships pre-installed on Netgate appliances and is otherwise licensed separately for third-party hardware or cloud instances; Netgate’s ARM appliances run Plus only, not CE. Hardware notes that save trouble later: prefer Intel NICs (igb/em/ix drivers) over Realtek — the Realtek FreeBSD drivers have a long history of throughput/stability issues, and pfSense is FreeBSD-based. Disable onboard hardware RAID and present plain AHCI disks. Keep any IPMI/BMC on a separate management port, never on WAN. Budget a real SSD (not a USB stick) if you’ll run Snort, pfBlockerNG, or reporting — those write continuously and kill cheap flash.

Download the installer

pfSense CE (free, community edition):

1. Go to the official pfSense download page and select the AMD64 architecture, USB Memstick Installer (or the ISO if installing to a VM/optical), and the console type that matches your box (VGA for a monitor, Serial for headless appliances).
2. Verify the download against the published SHA-256 checksum before writing — a tampered firewall image compromises everything behind it: sha256sum pfSense-CE-*.img.gz and compare to the site.
3. Decompress and write to USB: gunzip pfSense-CE-*.img.gz then dd if=pfSense-CE-*.img of=/dev/sdX bs=4M status=progress conv=fsync (Linux/macOS). Confirm /dev/sdX with lsblk first — the wrong target destroys that disk.

pfSense Plus (Netgate hardware):

• Comes pre-installed on Netgate appliances. Updates available through the web UI.

Boot and install

1. Boot from USB. The installer launches automatically.
2. Accept the copyright notice → select Install pfSense.
3. Choose Auto (ZFS) for disk layout on modern hardware (recommended), or Auto (UFS) for compatibility.
4. Select your disk → confirm destruction → let install complete.
5. Reboot, remove USB.

Interface assignment

At the console menu, select 1 — Assign Interfaces:

Should VLANs be set up now? → n
Enter the WAN interface name or 'a' for auto-detection: igb0
Enter the LAN interface name: igb1
Do you want to proceed? → y

pfSense will assign interfaces and reboot. If you can’t tell which physical port is which, the assignment dialog supports link-state detection — unplug all cables, then plug into the port you want as WAN when prompted; the interface that comes up is selected. Getting WAN/LAN swapped is the most common first-install mistake and locks you out of the GUI, so confirm the console summary shows LAN as 192.168.1.1/24 before proceeding.

First-boot web UI access

From a LAN-connected device, browse to https://192.168.1.1. Default credentials: admin / pfsense.

The Setup Wizard launches automatically:

• Set hostname and domain (e.g., firewall.home.arpa)
• Configure DNS (1.1.1.1 + 9.9.9.9 or your preferred upstream)
• Set timezone
• Configure WAN (DHCP for most ISPs, PPPoE if required)
• Confirm LAN IP (default 192.168.1.1/24)
• Change the admin password — required step at the end of the wizard

Immediate hardening steps

Lock down the management plane before building services on the box:

1. Force HTTPS, restrict the GUI — System → Advanced → Admin Access: protocol HTTPS, uncheck “WebGUI redirect” so only HTTPS works, optionally move off port 443. pfSense auto-creates an anti-lockout rule on LAN so you can’t fence yourself out; leave it until you have verified out-of-band access if you later tighten LAN rules.
2. Create a non-admin-reuse account / strong password — System → User Manager: keep the default admin password changed (the wizard forces this) and consider a separate named admin account for day-to-day use.
3. SSH, only if needed — System → Advanced → Admin Access → Secure Shell: enable, set Authentication Method to public key only, disable root password login. The GUI and SSH should listen on LAN, never WAN.
4. Never expose the GUI to WAN. There is no legitimate reason to have the pfSense web UI reachable from the internet without, at minimum, an IP allowlist and HTTPS; exposed firewall panels are continuously scanned. Use a VPN for remote administration instead, such as the tunnel in the WireGuard VPN setup guide, which lets you reach the LAN-side GUI without opening it to the internet.
5. Updates — System → Update: set Branch to the current stable, and apply the latest patch level before configuring anything — the installer image usually lags.
6. Back up the config now — Diagnostics → Backup & Restore: download config.xml (encrypt it; it contains secrets) and set up Auto Config Backup if you have a Netgate account. A firewall config is trivial to back up and painful to rebuild from memory.
7. Plan remote logging — Status → System Logs → Settings: add a remote syslog target so logs survive a disk failure.

Quick verification: from LAN, https://192.168.1.1 should load over HTTPS only; from a WAN-side device the GUI and SSH should be unreachable; System → Update should show you on the latest patch.

When not to do certain things

Don’t enable WAN GUI/SSH “temporarily” without an allowlist. Don’t virtualize pfSense on the same host as the workloads it protects unless you fully understand NIC pass-through and the shared failure domain. Don’t skip the post-install update expecting the installer to be current. And for a simple home network, you do not need pfSense Plus or Netgate hardware — pfSense CE on a modest Intel-NIC box is entirely sufficient; choose Plus/Netgate when you specifically want official support or Plus-only features.

Common first-setup problems

The same handful of issues trip up most first installs. Each has a quick fix:

• No internet on LAN after setup. Almost always a WAN that did not pull an address, or WAN/LAN swapped. Check Status → Interfaces for a valid WAN IP. If WAN shows a private/APIPA address, your ISP modem may need a power-cycle to release the old MAC, or it is in router mode handing out a double-NAT address.
• Locked out of the GUI. If you swapped WAN and LAN, the anti-lockout rule is now on the wrong port. Reconnect to the console, re-run option 1 (Assign Interfaces), and confirm LAN is the port your management device is plugged into.
• GUI loads but pages are slow or time out. Frequently a DNS problem. Set explicit upstream resolvers in System → General Setup and confirm the box itself can resolve names from Diagnostics → DNS Lookup.
• Realtek NIC drops under load. A known FreeBSD-driver limitation, not a misconfiguration. If you see throughput collapse during large transfers on a Realtek port, an Intel NIC is the real fix.

Can I restore a config instead of reinstalling?

Yes. If you backed up config.xml from a previous box, a fresh install can be brought up to a known state in minutes via Diagnostics → Backup & Restore → Restore. This is the fastest disaster-recovery path and the reason the hardening checklist puts a config backup first.

Next steps

• VLAN configuration on pfSense — segment IoT, guest, and trusted traffic
• pfBlockerNG setup — DNS-based ad and tracker blocking
• Snort vs Suricata on pfSense — choosing and running inline intrusion detection
• WireGuard VPN setup on pfSense — the secure way to reach the GUI remotely
• Official pfSense documentation: the commands, ports, and config references that back these guides

Comparing platforms? See firewallcompare.com for pfSense vs OPNsense vs UniFi side-by-side.

Related across the network

• OPNsense Initial Setup: Complete Installation Guide (2026) — opnsenselab.com