pfSense turns an ordinary x86 box into an enterprise-grade firewall and router, free and open source. It gives you stateful filtering, NAT, VPN, traffic shaping and detailed logging — the feature set of appliances costing thousands. The learning curve is mostly about one thing: understanding how pfSense decides whether to allow a packet. Get that, and the rest of the configuration is straightforward. This guide covers installation, interface assignment, firewall rules and NAT port forwarding.

Hardware and Planning

pfSense needs at least two network interfaces — one facing the internet (WAN) and one facing your network (LAN). A dual-core CPU with 4 GB RAM and a 16 GB SSD handles a gigabit connection comfortably; add AES-NI support if you plan to terminate VPNs. It also runs perfectly well as a KVM or Proxmox virtual machine, provided you pass through or bridge separate NICs for WAN and LAN.

Decide your addressing before you start. A common layout:

Interface	Purpose	Example
WAN	Internet uplink	DHCP or static from your ISP
LAN	Trusted internal network	192.168.10.1/24
OPT1 (optional)	DMZ for public-facing servers	192.168.20.1/24
OPT2 (optional)	Guest Wi-Fi, isolated	192.168.30.1/24

Step 1: Install and Assign Interfaces

Write the pfSense installer image to a USB stick, boot it, and accept the guided ZFS or UFS install. After the reboot you land at the console menu, where the first real decision is interface assignment.

pfSense lists NICs by driver name (em0, igb0, vtnet0). If you can’t tell them apart, decline auto-detection and use the auto-detect by plugging in a cable option — it identifies each port as you connect it. Assign WAN first, then LAN.

Then choose option 2) Set interface(s) IP address to give LAN a static IP such as 192.168.10.1/24 and enable its DHCP server. Plug a laptop into the LAN port and browse to https://192.168.10.1. The default credentials are admin / pfsense — change them in the setup wizard immediately.

Step 2: The Setup Wizard

The wizard covers hostname, DNS servers, timezone, WAN configuration and the admin password. Two options are worth pausing on, both on the WAN page and both enabled by default — leave them that way:

• Block RFC1918 private networks — drops private-range source addresses arriving on WAN.
• Block bogon networks — drops traffic from address ranges that should never appear on the internet.

Disable them only if pfSense sits behind another router that legitimately hands it a private WAN address.

Step 3: How pfSense Evaluates Rules

This is the section that saves you hours of confusion. Five principles govern everything:

1. Rules are evaluated on the interface where traffic enters pfSense. To let LAN clients reach the internet, you write a rule on the LAN tab — not WAN. This trips up nearly every newcomer.
2. Rules are processed top to bottom, and the first match wins. Nothing below a matching rule is considered, so order matters more than anything else.
3. There is an implicit deny at the bottom of every interface. Anything not explicitly allowed is dropped.
4. WAN starts with no allow rules (nothing gets in); LAN starts with a default allow-all (everything gets out). Tighten the LAN rule once you know what your network needs.
5. The firewall is stateful. Allow the outbound request and the reply traffic returns automatically — you never write rules for return traffic.

Step 4: Create Aliases First

Under Firewall » Aliases, define named groups of hosts, networks or ports — for example WebServers containing two IPs, or MgmtPorts containing 22 and 8443. Use aliases everywhere in your rules. When an address changes, you edit one alias instead of hunting through fifteen rules, and the rule list stays readable months later.

Step 5: Write Sensible LAN Rules

Go to Firewall » Rules » LAN. A reasonable ordered rule set for a small network:

#	Action	Source	Destination	Port	Purpose
1	Pass	LAN net	LAN address	53, 853	Allow DNS to the firewall
2	Pass	LAN net	LAN address	443	Allow access to the web GUI
3	Block	LAN net	This Firewall	any	Block all other access to pfSense itself
4	Block	LAN net	GuestNet, DMZ	any	Keep networks separated
5	Pass	LAN net	any	any	General internet access

Note how the specific allows come before the broad allow, and the inter-network blocks come before general internet access. Reverse rules 4 and 5 and your guest network isolation silently stops working.

Step 6: NAT Port Forwarding

To publish an internal web server, go to Firewall » NAT » Port Forward and add a rule:

• Interface: WAN  ·  Protocol: TCP
• Destination: WAN address  ·  Destination port range: HTTPS (443)
• Redirect target IP: 192.168.10.20  ·  Redirect target port: 443
• Filter rule association: Add associated filter rule

That last setting matters. A port forward only rewrites the destination address — it does not permit the traffic. Choosing add associated filter rule creates the matching WAN pass rule and keeps the two linked, so editing the forward updates the rule automatically. Without it, your forward is configured correctly and nothing works.

If internal clients can’t reach the public URL

That’s the classic NAT reflection problem: a LAN machine requesting your public IP hits the firewall from the inside, where the WAN rule doesn’t apply. Two fixes:

• Split DNS (preferred) — under Services » DNS Resolver » Host Overrides, resolve example.com to the internal IP for LAN clients.
• NAT reflection — set System » Advanced » Firewall & NAT » NAT Reflection mode to Pure NAT and enable automatic outbound NAT for reflection.

Step 7: Logging and Troubleshooting

When a rule doesn’t behave, go to Status » System Logs » Firewall. Each entry shows the rule that acted on the packet — click the rule ID to jump straight to it. Two more tools worth knowing:

• Diagnostics » States — shows live connections. If a state exists, traffic was permitted; if not, something blocked it. Note that changing a rule does not kill existing states — reset them to test properly.
• Diagnostics » Packet Capture — confirms whether traffic is even arriving at the interface before you blame the rules.

Finally, take a config backup from Diagnostics » Backup & Restore once the firewall works. The whole configuration is a single XML file — restoring it onto replacement hardware takes minutes.

Conclusion

pfSense is only confusing until the rule model clicks: rules apply on the interface traffic enters, they match top-down with first-match-wins, and anything not allowed is denied. Assign your interfaces, run the wizard, build aliases before rules, order your LAN rules specific-to-general, and always tick add associated filter rule on port forwards. Back up the XML config, and you have a firewall that will run for years.