To set up pfSense for the first time: write the USB Memstick installer, boot and install to disk with Auto (ZFS), assign your WAN and LAN interfaces at the console, browse to https://192.168.1.1 to run the setup wizard, then harden the management plane before you build anything on it. For the platform basics, read what pfSense actually is. This guide walks you through that whole path, from a fresh install on USB to a working, locked-down WAN+LAN configuration.
How to set up pfSense for the first time:
- Download and verify the installer. Get the appropriate Netgate Installer USB Memstick image from the official pfSense download page and check it against the published SHA-256 checksum.
- Write the installer to USB. Use the documented image-writing procedure for your operating system and double-check the target USB device.
- Boot and install. Boot from USB, accept the notice, choose Auto (ZFS) disk layout, select your disk, then reboot and remove the USB.
- Assign interfaces. At the console, select option 1 (Assign Interfaces) and set WAN and LAN (for example,
igb0for WAN andigb1for LAN). - Run the setup wizard. From a LAN device browse to
https://192.168.1.1(default loginadmin/pfsense), then set hostname, DNS, timezone, WAN, and a new admin password. - Harden the management plane. Force HTTPS, restrict the GUI to LAN, enable key-only SSH if needed, apply updates, and back up
config.xml.
Before installing pfSense
Confirm that your hardware meets the pfSense hardware requirements and identify the physical WAN and LAN ports. Keep console access available while assigning interfaces. If you still need a device, use the pfSense hardware buying guide; this walkthrough starts once that choice is made.
The Netgate Installer needs an internet connection to fetch installation data. Connect its WAN port to a working upstream network and have any required static-address or PPPoE details ready.
Download the installer
Download the USB Memstick image through the official pfSense download page. Choose the architecture and console type appropriate to your hardware; use an ISO where the virtual machine or optical boot process requires it. Verify the downloaded file against its published checksum.
Write the decompressed image with an image-writing utility, selecting the USB device carefully: writing installation media overwrites the selected device. Follow the preparation instructions linked from Netgate’s installation documentation for your operating system. The USB stick is installation media; install the firewall onto its intended internal disk.
Boot and install
- Boot from USB. The installer launches automatically.
- Follow the Netgate Installer prompts to configure upstream networking, confirm eligibility, and select the available pfSense edition.
- Choose the offered disk layout appropriate to the device; review the ZFS disk selection before continuing.
- Select your disk → confirm destruction → let install complete.
- Reboot, remove USB.
Interface assignment
At the console menu, select 1 — Assign Interfaces:
Should VLANs be set up now? → n
Enter the WAN interface name or 'a' for auto-detection: igb0
Enter the LAN interface name: igb1
Do you want to proceed? → ypfSense will assign interfaces and reboot. If you can’t tell which physical port is which, the assignment dialog supports link-state detection — unplug all cables, then plug into the port you want as WAN when prompted; the interface that comes up is selected. Getting WAN/LAN swapped is the most common first-install mistake and locks you out of the GUI, so confirm the console summary shows LAN as 192.168.1.1/24 before proceeding.
First-boot web UI access
From a LAN-connected device, browse to https://192.168.1.1. Default credentials: admin / pfsense.
The Setup Wizard launches automatically:
- Set hostname and domain (e.g.,
firewall.home.arpa) - Configure DNS (1.1.1.1 + 9.9.9.9 or your preferred upstream)
- Set timezone
- Configure WAN (DHCP for most ISPs, PPPoE if required)
- Confirm LAN IP (default 192.168.1.1/24)
- Change the admin password — required step at the end of the wizard
Immediate hardening steps
Lock down the management plane before building services on the box:
- Force HTTPS, restrict the GUI — System → Advanced → Admin Access: protocol HTTPS, uncheck “WebGUI redirect” so only HTTPS works, optionally move off port 443. pfSense auto-creates an anti-lockout rule on LAN so you can’t fence yourself out; leave it until you have verified out-of-band access if you later tighten LAN rules.
- Create a non-admin-reuse account / strong password — System → User Manager: keep the default
adminpassword changed (the wizard forces this) and consider a separate named admin account for day-to-day use. - SSH, only if needed — System → Advanced → Admin Access → Secure Shell: enable, set Authentication Method to public key only, disable root password login. Use firewall rules to restrict GUI and SSH access to your management network.
- Never expose the GUI to WAN. There is no legitimate reason to have the pfSense web UI reachable from the internet without, at minimum, an IP allowlist and HTTPS; exposed firewall panels are continuously scanned. Use a VPN for remote administration instead, such as the tunnel in the WireGuard VPN setup guide, which lets you reach the LAN-side GUI without opening it to the internet.
- Updates — System → Update: set Branch to the current stable, and apply the latest patch level before configuring anything — the installer image usually lags.
- Back up the config now — Diagnostics → Backup & Restore: download
config.xml(encrypt it; it contains secrets) and set up Auto Config Backup if you have a Netgate account. A firewall config is trivial to back up and painful to rebuild from memory. - Plan remote logging — Status → System Logs → Settings: add a remote syslog target so logs survive a disk failure.
Quick verification: from LAN, https://192.168.1.1 should load over HTTPS only; from a WAN-side device the GUI and SSH should be unreachable; System → Update should show you on the latest patch.
When not to do certain things
Don’t enable WAN GUI/SSH “temporarily” without an allowlist. Don’t virtualize pfSense on the same host as the workloads it protects unless you fully understand NIC pass-through and the shared failure domain. Don’t skip the post-install update expecting the installer to be current. And for a simple home network, you do not need pfSense Plus or Netgate hardware — pfSense CE on a modest Intel-NIC box is entirely sufficient; choose Plus/Netgate when you specifically want official support or Plus-only features.
Common first-setup problems
The same handful of issues trip up most first installs. Each has a quick fix:
- No internet on LAN after setup. Almost always a WAN that did not pull an address, or WAN/LAN swapped. Check Status → Interfaces for a valid WAN IP. If WAN shows a private/APIPA address, your ISP modem may need a power-cycle to release the old MAC, or it is in router mode handing out a double-NAT address.
- Locked out of the GUI. If you swapped WAN and LAN, the anti-lockout rule is now on the wrong port. Reconnect to the console, re-run option 1 (Assign Interfaces), and confirm LAN is the port your management device is plugged into.
- GUI loads but pages are slow or time out. Frequently a DNS problem. Set explicit upstream resolvers in System → General Setup and confirm the box itself can resolve names from Diagnostics → DNS Lookup.
- Realtek NIC drops under load. A known FreeBSD-driver limitation, not a misconfiguration. If you see throughput collapse during large transfers on a Realtek port, an Intel NIC is the real fix.
Can I restore a config instead of reinstalling?
Yes. If you backed up config.xml from a previous box, a fresh install can be brought up to a known state in minutes via Diagnostics → Backup & Restore → Restore. This is the fastest disaster-recovery path and the reason the hardening checklist puts a config backup first.
Next steps
- VLAN configuration on pfSense — segment IoT, guest, and trusted traffic
- pfBlockerNG setup — DNS-based ad and tracker blocking
- Snort vs Suricata on pfSense — choosing and running inline intrusion detection
- WireGuard VPN setup on pfSense — the secure way to reach the GUI remotely
- Official pfSense documentation: the commands, ports, and config references that back these guides
Comparing platforms? See firewallcompare.com for pfSense vs OPNsense vs UniFi side-by-side.
Related across the network
- OPNsense Initial Setup: Complete Installation Guide (2026) — opnsenselab.com
