What Is pfSense and How to Use It: VLAN and Firewall Guide

If you are asking what is pfsense and how to use it, pfSense is firewall/router software between an ISP and a network. It provides routing, stateful filtering, IPv4 NAT, DHCP, DNS, and VPNs, but does not replace a managed switch or AP.

What pfSense is and the goal

Netgate describes pfSense as a customized FreeBSD firewall/router distribution. Community Edition (CE) is the open-source project; pfSense Plus is Netgate’s product with additional features.

The goal is segmentation: trusted, IoT, guest, and management devices occupy separate broadcast domains. pfSense routes between them with deny-by-default policy; a switch carries VLANs and APs map SSIDs. Remote administration uses a VPN, not a WAN port forward to TCP 443. UPnP stays off unless a documented requirement justifies it.

Install and make the first configuration

Use a Netgate appliance or compatible two-NIC hardware. The Netgate Installer requires Internet connectivity. Defaults include LAN 192.168.1.1/24, HTTPS on TCP 443, LAN DHCP, outbound IPv4 NAT, and blocked unsolicited WAN traffic.

Connect a laptop to LAN, open https://192.168.1.1, change the admin password, and confirm WAN. Keep console or temporary untagged-LAN access; do not convert the active management link mid-session.

Under Interfaces > Assignments > VLANs, create each tag, assign and enable its interface, set its static address/prefix, then enable DHCPv4. Leave Upstream Gateway unset on inside VLANs. Netgate’s VLAN procedure confirms that a tag alone does not create DHCP or firewall policy.

After VLAN 10 works from port 13, disable legacy-LAN DHCP and pass rules, then unassign parent igc0 or set IPv4/IPv6 to None. If VLAN 10 becomes logical LAN, disable anti-lockout only after its explicit admin rule works. Confirm untagged 192.168.1.1/24 no longer answers.

Topology

Example, not required: ISP ONT/CPE -> Netgate 6100 WAN1 (ix3, 1 Gbps) -> LAN1 (igc0, 2.5 Gbps) -> USW-Pro-Max-24-PoE port 17 -> U6-Enterprise on port 24.

• Switch port 17: trunk to unaddressed parent igc0; VLANs 10, 20, 30, and 40 tagged; unused VLAN 999 native/PVID and unrouted.
• Switch port 24: trunk to the U6-Enterprise; VLAN 10 native/PVID for AP management; SSIDs tagged as trusted 20, IoT 30, and guest 40.
• Ports 1-8: access VLAN 20, PVID 20; ports 9-12: access VLAN 30, PVID 30; ports 13-14: access VLAN 10 for admin and controller. Reserve 10.10.10.2, .3, and .10 for switch, AP, and UniFi Network controller.

Set the switch as RSTP root and enable BPDU guard on endpoint access ports, not trunks.

VLAN plan

VLAN ID	Name	CIDR	DHCP range	Gateway	Inter-VLAN policy
10	management	10.10.10.0/24	10.10.10.100-149	10.10.10.1	Admin alias may manage infrastructure; otherwise deny
20	trusted	10.20.0.0/24	10.20.0.100-199	10.20.0.1	Deny other VLANs except named services such as a printer
30	iot	10.30.0.0/24	10.30.0.100-239	10.30.0.1	Deny internal networks; allow required Internet ports
40	guest	10.40.0.0/24	10.40.0.100-239	10.40.0.1	Deny firewall management and all internal networks

IPv6 needs an ISP PD prefix of /62 or larger so each VLAN gets a /64. Enable RA everywhere; SLAAC and/or DHCPv6 assign addresses, but RA supplies the gateway. Put local/VPN prefixes in INTERNAL_V6, mirror policy, and preserve NDP plus ICMPv6 Packet Too Big. NAT is not a firewall.

Firewall rules in apply order

Rules are stateful, ingress, and first-match; floating and group rules precede interface rules. Define Network alias INTERNAL_NETS with RFC 1918, VPN, and private-upstream CIDRs; Host aliases ADMIN_HOSTS and IOT_PRINTER; and Port alias MGMT_PORTS (443, plus 22 only if SSH runs). Apply top-to-bottom:

1. Each VLAN: VLAN net -> VLAN Address, TCP/UDP 53 -> pass; add separate passes for UDP 123 and ICMP echo request.
2. Each VLAN: VLAN net -> any, TCP/UDP 53 -> block and log; separately block DoT and DoQ on TCP/UDP 853.
3. If reflecting mDNS, Trusted and IoT: VLAN net -> 224.0.0.251, UDP 5353 -> pass; on the same ingress tabs, IPv6 any -> ff02::fb/128, UDP 5353 -> pass.
4. Management: ADMIN_HOSTS -> This Firewall, TCP 443 -> pass; ADMIN_HOSTS -> INTERNAL_NETS, TCP MGMT_PORTS -> pass; add a separate ICMP pass. Block MGMT net -> This Firewall, then INTERNAL_NETS, any; finally pass MGMT net -> any, TCP 80,443 and UDP 443.
5. Trusted: TRUSTED net -> IOT_PRINTER (10.30.0.50), TCP 631,9100 -> pass; block TRUSTED net -> This Firewall, then INTERNAL_NETS, any; finally pass TRUSTED net -> any, any.
6. IoT: block IOT net -> This Firewall, then INTERNAL_NETS, any; pass IOT net -> any, TCP 80,443 and UDP 443. Log blocks; add ports only when logs justify them.
7. Guest: GUEST net -> This Firewall, any -> block; GUEST net -> INTERNAL_NETS, any -> block and log; then GUEST net -> any, any -> pass.
8. Optional WireGuard package: define WG_NET as 10.6.210.0/24; WAN any -> WAN Address, UDP 51820 -> pass; WireGuard tab WG_NET -> 10.10.10.1, TCP 443 -> pass. Add no broad group pass. See Netgate’s recipe.

The printer exception must precede the block or it is shadowed. A Quick floating pass any can preempt interface policy. Unmatched traffic hits implicit deny.

DNS and discovery

Hand clients their VLAN gateway as Unbound DNS. Its automatic ACLs permit attached internal IPv4 and IPv6 networks; if auto-add is disabled, manual ACLs must cover both families. ACLs select clients, not domains. Per-VLAN domain allow-lists need a policy resolver because port rules cannot distinguish DoH/DoH3 from allowed web traffic.

mDNS uses UDP 5353 and link-local groups under RFC 6762. If needed, configure Avahi to reflect only VLANs 20 and 30; it reflects all records, while unicast rules control service access. Exclude guest 40. RFC 4541 says IGMP snooping should flood IPv4 224.0.0.0/24; MLD is the IPv6 counterpart. Neither routes multicast.

Remote access and maintenance

Use WireGuard, OpenVPN, or IKEv2 and permit the VPN subnet only to required destinations. A VPN is Netgate’s safest remote-GUI method. Do not expose TCP 443 to WAN.

Before upgrades, export config.xml and keep an encrypted copy off-box. Netgate recommends frequent, external, tested backups. Use Netgate advisories for change control; broader cybersecurity advisories provide context, not firmware instructions.

Things to test before you call it done

Install mtr, iperf3, dig, and Avahi client tools on test hosts, not pfSense. Expected failures do not justify disabling the firewall.

# From trusted: gateway and Internet path should answer
ping -c 4 10.20.0.1
mtr -rwzc 20 1.1.1.1

# Local resolver should work; direct external DNS should fail
dig @10.20.0.1 example.com A +short
dig @1.1.1.1 example.com A +time=2 +tries=1
dig +tcp @1.1.1.1 example.com A +time=2 +tries=1

# Port 631 should connect; confirm port 22 denial in the pfSense log
nc -vz -w 3 10.30.0.50 631
nc -vz -w 3 10.30.0.50 22

# Same-VLAN switch/AP test (this bypasses pfSense); server runs iperf3 -s
iperf3 -c 10.20.0.10 -P 4 -t 20

# From IoT, a trusted host should be unreachable while HTTPS works
ping -c 4 10.20.0.10
curl -4 -I https://example.com
curl -6 -I https://example.com

# From Guest this must fail; from WireGuard it should connect
nc -vz -w 3 10.10.10.1 443

# Linux: local trusted and reflected IoT services may appear; guest must not
avahi-browse -art

Inspect Status > System Logs > Firewall for blocks and repeat the isolation tests over IPv6. A green dashboard proves little.

Related across the network

• OPNsense vs pfSense for Homelab: Which Wins in 2026? — opnsenselab.com
• Best Firewall for Small Business 2026: 6 Options Compared — firewallcompare.com
• Best Homelab Firewall 2026: Four Platforms Compared — firewallcompare.com
• WireGuard on OPNsense: Road Warrior and Site-to-Site — firewallcompare.com
• pfSense Alternatives: 7 Platforms Compared for 2026 — firewallcompare.com