FreeBSD Server Setup: ZFS, pf, jails, Hardening

Setting Up a FreeBSD Server from Scratch: ZFS, pf, jails, and Hardening

Want a stable server with minimal overhead? Professional FreeBSD configuration is the foundation for predictable service operation. Over 5 years of experience and 30+ commercial projects guarantee a robust solution.

FreeBSD is not Linux. This is a fundamental difference: a different kernel, a different default filesystem (UFS or ZFS), a different package manager (pkg), a different firewall (pf), a different init (rc.d). Specialists choose FreeBSD for several things: native ZFS without DKMS overhead, pf as one of the best stateful firewalls, strong data integrity through CoW, and predictable network stack performance. We have been configuring FreeBSD servers for over 5 years — with 30+ commercial projects, including high-load systems handling up to 100 Gbps and databases at 5000 queries per second. Contact us for a consultation — we will assess your project and propose the optimal configuration under load.

How to set up a FreeBSD server turnkey?

The FreeBSD installer (bsdinstall) is quite conservative — questions are asked sequentially. For servers, we choose a minimal set of components: kernel, base, lib32. src and ports-tree on the server are usually unnecessary unless we plan to build software from source.

Filesystem selection at installation is a critical decision. ZFS on FreeBSD is native, not FUSE, and performs quickly and stably. Example partitioning:

Partition Scheme: GPT - freebsd-boot (512K) - freebsd-swap (RAM size) - freebsd-zfs (remaining) → zpool: zroot 

After installation and first login via console, configure /etc/rc.conf — the main service configuration file. Immediately enable pf, sshd, ntpd, and set the hostname:

cat >> /etc/rc.conf << 'EOF'
hostname="freebsd-prod-01"
ifconfig_vtnet0="DHCP"
sshd_enable="YES"
ntpd_enable="YES"
ntpd_sync_on_start="YES"
pf_enable="YES"
pflog_enable="YES"
EOF"}

pkg: Binary package manager and basic tools

Install necessary packages: pkg bootstrap, pkg update, pkg upgrade -y, then pkg install -y vim curl wget git bash sudo. The ports tree (/usr/ports) allows building packages from source with custom flags. On a production server, this is rarely needed — binary packages from pkg cover 95% of needs.

pf: Firewall with expressive syntax

FreeBSD uses pf from OpenBSD — one of the most expressive firewall rule syntaxes. The config is at /etc/pf.conf:

# Interface ext_if = "vtnet0"
# Block all incoming, allow outgoing
set block-policy drop
block in all
pass out all keep state
# Loopback
pass in on lo0 all
# Allow SSH only from management subnet
pass in on $ext_if proto tcp from <10.0.0.0/24> to any port 22 flags S/SA keep state
# HTTP/HTTPS
pass in on $ext_if proto tcp to any port { 80, 443 } flags S/SA keep state
# ICMP
pass in inet proto icmp all icmp-type echoreq
EOF
pfctl -f /etc/pf.conf && pfctl -sr && pfctl -s info

SSH and users

pw useradd deploy -m -s /bin/bash && pw groupmod wheel -m deploy
pkg install -y sudo
echo "%wheel ALL=(ALL) ALL" >> /usr/local/etc/sudoers
cat > /etc/ssh/sshd_config.d/hardening.conf << 'EOF'
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
X11Forwarding no
EOF
service sshd restart

Why choose ZFS on FreeBSD?

If you selected ZFS during installation, the base pool zroot is already created. Pool and dataset management is done via zpool and zfs. Snapshots before freebsd-update or major package updates are mandatory practice on FreeBSD. Rollback takes seconds. ZFS on FreeBSD performs 20-30% faster than ZFS on Linux via DKMS, thanks to no additional abstraction layer. Also, lz4 compression is available out of the box, saving up to 40% space on typical logs.

zpool status && \
zfs list zfs snapshot zroot/ROOT/default@before-update \
zfs rollback zroot/ROOT/default@before-update \
zfs set compression=lz4 zroot/data

Updating the base system

Unlike Linux, the FreeBSD base system (kernel + userland) is updated separately from packages. The process is safe: take a snapshot, update, reboot, and install again for userland. Packages are updated via pkg upgrade. For periodic updates, use freebsd-update and configure automatic checks via cron. This reduces vulnerability risk with minimal overhead.

How to create isolated environments with jails?

Jails are a process isolation tool, similar to containers. On FreeBSD, jails operate at the kernel level, giving minimal overhead. We use iocage for convenient management. Example creation:

iocage create -n web01 -r 13.3-RELEASE ip4_addr="vnet0|10.0.0.10/24" boot=on iocage start web01 

Jails allow separating services without running separate virtual machines. This saves resources and simplifies updates.

How to organize monitoring for a FreeBSD server?

Install node_exporter and Prometheus:

pkg install -y prometheus node_exporter grafana 

Configure metric collection: CPU, memory, ZFS stats, network. Use Prometheus for storage and Grafana for visualization. This gives a full performance picture and early problem detection.

How to enhance FreeBSD server security?

Beyond pf and SSH hardening, use fail2ban (via pkg), configure auditdist, set security.bsd.see_other_uids=0 in sysctl, disable unused services. Regularly run freebsd-update fetch install and check logs via syslog.

What is included in FreeBSD server setup

• Audit of the current infrastructure and choice between FreeBSD and Linux.
• OS installation with ZFS or UFS, disk partitioning, zpool configuration.
• Configuration of rc.conf, pf, SSH with hardening, NTP (ntpd or chrony).
• Installation and updates of packages via pkg, sudo configuration.
• Jails configuration (if needed) via ezjail or iocage.
• Documentation of configuration and delivery of automation scripts.
• Team training on basic operations.

Additionally, we can configure monitoring via Prometheus and Grafana, as well as logging with Loki. This provides transparency and predictability.

Process of work

Assessment → Installation and initial configuration → ZFS pools and jails → Software installation → Hardening → Documentation → Project handover. We document and test each phase.

Comparison table: FreeBSD vs Linux for a server

The cost is calculated individually based on the specifics of the FreeBSD stack and server requirements. Contact us to get a consultation and an accurate assessment within a day. With our proven methodology, you get a guaranteed secure and high-performance FreeBSD server setup.