What pfSense is
pfSense is a free, open-source firewall and router platform based on FreeBSD. It provides stateful packet inspection, NAT, VPN (OpenVPN, WireGuard, IPsec), VLAN support, DHCP, DNS, traffic shaping, high availability and a web-based management interface. With packages like pfBlockerNG, Snort and ntopng, it becomes a full network security appliance comparable to commercial products costing thousands of pounds.
Screenshot evidence
pfSense is the network edge of my entire lab — every packet that enters or leaves the network passes through it, and every VLAN, firewall rule, DNS policy and VPN tunnel is configured here.
Why I run it
I run pfSense because I want a real, configurable firewall — not a consumer router with a simplified interface that hides what it is actually doing. pfSense gives me full control over routing, firewall rules, NAT, VLANs, DNS and VPN configuration, plus the ability to add intrusion detection (Snort), GeoIP blocking (pfBlockerNG) and traffic analysis (ntopng).
What I have done with it
- Configured VLAN segmentation to separate workloads, IoT devices and guest networks
- Built firewall rules with proper ordering and logging
- Deployed pfBlockerNG for GeoIP-based blocking and DNS-level ad/tracker filtering
- Configured Snort for intrusion detection and prevention
- Used ntopng for traffic analysis and bandwidth monitoring
- Set up OpenVPN and WireGuard for secure remote access
- Configured policy routing for VPN exit-node traffic
- Prevented DNS bypass by redirecting all port-53 traffic through AdGuard Home
- Diagnosed DNS spoofing attempts and blocked them at the firewall level
- Resolved the 3CX STUN/pfBlockerNG conflict (separate case study)
Why this matters
pfSense is the single most important piece of infrastructure in the lab. Understanding how to configure and troubleshoot a real firewall — not just set it to "allow all" — is fundamental to any networking or security role. Every VLAN, every rule, every VPN tunnel and every DNS policy flows through this device, and I maintain all of it myself.