Enterprise-Grade pfSense Firewall and Router Setup

Enterprise pfSense Firewall and Router Setup

Your corporate network needs a reliable, cost-effective firewall and router that doesn't compromise on security. pfSense, built on FreeBSD, delivers stateful firewall, NAT, VPN concentrator, VLAN routing, and IDS/IPS via Suricata. However, configuring it for high availability and security requires deep expertise. We integrate and tune pfSense to your infrastructure, replacing commercial solutions while maintaining full functionality.

We begin every installation with a network audit: identifying bottlenecks, security blind spots, and single points of failure. Then we design the VLAN scheme, IP addressing, NAT rules, and firewall policies. We deploy pfSense on dedicated hardware (Netgate appliances) or in virtualized environments (ESXi, KVM, Hyper-V).

Basic Architecture and Interfaces

A minimal setup has two interfaces: WAN and LAN. Real installations are more complex: multiple VLANs on one physical interface using IEEE 802.1Q tagging, OPT interfaces for DMZ, and a separate management interface.

VLAN configuration via XML (or through GUI: Interfaces → Assignments → VLANs):

<vlans>
  <vlan>
    <if>em1</if>
    <tag>10</tag>
    <descr>LAN-Users</descr>
  </vlan>
  <vlan>
    <if>em1</if>
    <tag>20</tag>
    <descr>DMZ-Web</descr>
  </vlan>
  <vlan>
    <if>em1</if>
    <tag>30</tag>
    <descr>MGMT</descr>
  </vlan>
</vlans>

On the physical switch, the port toward pfSense is configured as a trunk with allowed VLANs 10, 20, 30.

How pfSense Processes Firewall Rules

pfSense processes rules top-down, stopping on the first match (first-match). The default rule is deny all. This is the reverse of iptables' default ACCEPT. Importantly, rules are applied on the outgoing interface from the traffic's perspective. A common mistake is confusing direction: a rule on the LAN interface applies to traffic LEAVING the LAN, not coming into it.

Typical rule scheme for a DMZ:

# DMZ interface (VLAN 20):
# 1. Allow DMZ → Internet (HTTP/HTTPS for apt updates)
# 2. Allow DMZ → LAN-DB (TCP 5432 — only to DB servers)
# 3. Block DMZ → LAN (all other traffic to LAN)
# 4. Allow any → DMZ:443 (incoming HTTPS via port forward)

Export rules to XML for backup and versioning:

# Via pfSense API (fauxapi or official REST API in pfSense Plus)
curl -k -X GET "https://192.168.1.1/api/v1/firewall/rule" \
  -H "Authorization: Bearer $TOKEN" > firewall-rules-backup.json

NAT: Port Forward and Outbound NAT

Port forwarding is a standard scenario for publishing internal services:

Restricting source IP in a port forward rule is possible at the NAT level without a separate firewall rule. Outbound NAT in Hybrid mode offers flexibility: automatic masquerade for most subnets and fixed IPs for exceptions.

IDS/IPS with Suricata: Benefits and Setup

Suricata is a powerful traffic analysis tool. In pfSense it installs as a package and can run inline (IPS) or passively (IDS). Inline mode blocks packets, IDS only logs. Performance: Suricata handles up to 10 Gbps on modern hardware.

Basic configuration via GUI:

• Interface: WAN (incoming traffic) or LAN (east-west)
• Ruleset: ET Open (free), Emerging Threats Pro, or Snort VRT
• Blocking Mode: Legacy (via pf) or Inline (NFQ)

Automatic rule updates via Cron every 12 hours for ET Open.

Why Choose an HA Cluster with CARP?

For production environments where downtime is unacceptable, we set up High Availability using CARP. Two pfSense nodes, a virtual IP on each interface, and state synchronization via pfsync. Requirements: dedicated sync interface (direct cable or VLAN), bandwidth at least 1 Gbps. On failure of the primary node, the secondary takes over without session loss—we guarantee sub-second failover.

Comparison with Commercial Firewalls

pfSense is 50-70% cheaper than solutions from Cisco, Fortinet, or Juniper with comparable functionality. No license fees, free updates. The only limitation is the lack of round-the-clock vendor support, but we cover this with our own SLA (8/5 and 24/7 plans available).

What's Included in Turnkey pfSense Setup

1. Network audit: topology, security, performance analysis.
2. Design: VLAN scheme, IP policy, NAT, firewall, VPN rules.
3. Deploy pfSense (physical or virtual).
4. Configure firewall rules, NAT, VPN (IPsec/OpenVPN/WireGuard).
5. Install and configure Suricata (IDS/IPS).
6. Set up HA cluster (optional).
7. Testing and performance optimization.
8. Document configuration, hand over GUI access.
9. Train your team in basic administration.
10. 30 days of support included, extended SLA available.

Estimated Timelines

The cost is determined individually after an audit—contact us for an estimate. Our certified engineers have 10+ years of experience in network architecture. Get a consultation on your project today.