Book Image

pfSense 2.x Cookbook - Second Edition

By : David Zientara
Book Image

pfSense 2.x Cookbook - Second Edition

By: David Zientara

Overview of this book

pfSense is an open source distribution of the FreeBSD-based firewall that provides a platform for ?exible and powerful routing and firewalling. The versatility of pfSense presents us with a wide array of configuration options, which makes determining requirements a little more difficult and a lot more important compared to other offerings. pfSense 2.x Cookbook – Second Edition starts by providing you with an understanding of how to complete the basic steps needed to render a pfSense firewall operational. It starts by showing you how to set up different forms of NAT entries and firewall rules and use aliases and scheduling in firewall rules. Moving on, you will learn how to implement a captive portal set up in different ways (no authentication, user manager authentication, and RADIUS authentication), as well as NTP and SNMP configuration. You will then learn how to set up a VPN tunnel with pfSense. The book then focuses on setting up traffic shaping with pfSense, using either the built-in traffic shaping wizard, custom ?oating rules, or Snort. Toward the end, you will set up multiple WAN interfaces, load balancing and failover groups, and a CARP failover group. You will also learn how to bridge interfaces, add static routing entries, and use dynamic routing protocols via third-party packages.
Table of Contents (18 chapters)
Title Page
Copyright and Credits
About Packt

Choosing a standard or embedded image

In this section, we will understand when to use the standard or embedded version of pfSense.

Every standard feature of pfSense is supported on both the standard and embedded platforms, but certain packages are not. The Squid web caching package, for example, required extensive writing to disk and should not be run on a compact flash drive.

There is a third type of image called Netgate ADI, which is designed and optimized for Netgate embedded appliances that run pfSense. If you are installing onto one of these appliances (for example, the SG-2440), you should use the Netgate ADI.

First, we should review the package we've chosen to install:

NTop package: This is a traffic analysis tool. It requires a minimum of 512 KB RAM, but has no restrictions on the storage type.

Based on this and the overall convenience of compact flash cards, we're going to install the embedded version of pfSense.



The standard image is meant to be installed on a hard drive. The embedded version is meant to be installed on a compact flash drive. Compact flash drives only have a limited number of writes during their lifespan, and the embedded version of pfSense is designed to limit writes to the disk for that very reason. That being said, each platform has advantages and disadvantages:





All packages and features supported

Entire drive must be overwritten

Requires larger power supply


Fast access times

Cards can be easily swapped (backups, upgrades, and so on)

Requires little power


CF cards have a limited number of writes

Not all packages supported

Netgate ADI

Designed to work optimally with Netgate pfSense appliances

Not designed to work with non-Netgate hardware


Refer to the pfSense online documentation: Versions of pfSense and FreeBSD: